CWE-94 · Code Injection (page 26)
Page 26 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27218 | Medium | 5.3 | 2025-02-20 | Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization. |
CVE-2025-25944 | High | 7.3 | 2025-02-19 | Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the Ap4RtpAtom.cpp, specifically in AP4_RtpAtom::AP4_… |
CVE-2025-25943 | High | 7.8 | 2025-02-19 | Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the AP4_Stz2Atom::AP4_Stz2Atom component located in A… |
CVE-2025-1465 | Medium | 4.1 | 2025-02-19 | A vulnerability, which was classified as problematic, was found in lmxcms 1.41. Affected is an unknown function of the file db.inc.php of the component Mainten… |
CVE-2025-25467 | Critical | 9.8 | 2025-02-18 | Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file. |
CVE-2024-13689 | Medium | 6.3 | 2025-02-18 | The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.9.1.6. This is due to the software… |
CVE-2024-13797 | High | 7.3 | 2025-02-18 | The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and incl… |
CVE-2025-1392 | Low | 3.5 | 2025-02-17 | A vulnerability has been found in D-Link DIR-816 1.01TO and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2025-1360 | Low | 3.5 | 2025-02-16 | A vulnerability, which was classified as problematic, was found in Internet Web Solutions Sublime CRM up to 20250207. Affected is an unknown function of the fi… |
CVE-2025-1359 | Medium | 4.3 | 2025-02-16 | A vulnerability, which was classified as problematic, has been found in SIAM Industria de Automação e Monitoramento SIAM 2.0. This issue affects some unknown p… |
CVE-2025-1337 | Low | 3.5 | 2025-02-16 | A vulnerability was found in Eastnets PaymentSafe 2.5.26.0. It has been classified as problematic. This affects an unknown part of the component BIC Search. Th… |
CVE-2025-1332 | Low | 2.4 | 2025-02-16 | A vulnerability has been found in FastCMS up to 0.1.5 and classified as problematic. This vulnerability affects unknown code of the file /fastcms.html#/templat… |
CVE-2025-1302 | Critical | 9.8 | 2025-02-15 | Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute a… |
CVE-2024-13346 | High | 7.3 | 2025-02-13 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including… |
CVE-2024-13345 | High | 7.3 | 2025-02-13 | The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.11.13. This is due to the softwar… |
CVE-2025-1213 | Low | 3.5 | 2025-02-12 | A vulnerability was found in pihome-shc PiHome 1.77. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index… |
CVE-2025-1209 | Low | 3.5 | 2025-02-12 | A vulnerability classified as problematic has been found in code-projects Wazifa System 1.0. Affected is the function searchuser of the file /search_resualts.p… |
CVE-2025-1208 | Low | 3.5 | 2025-02-12 | A vulnerability was found in code-projects Wazifa System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /Profile… |
CVE-2025-1196 | Low | 3.5 | 2025-02-12 | A vulnerability, which was classified as problematic, was found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of… |
CVE-2025-1195 | Low | 3.5 | 2025-02-12 | A vulnerability, which was classified as problematic, has been found in code-projects Real Estate Property Management System 1.0. This issue affects some unkno… |
CVE-2025-1190 | Low | 3.5 | 2025-02-12 | A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. This vulnerability affects unknown code of the file /_parse/… |
CVE-2024-13814 | Medium | 5.4 | 2025-02-12 | The The Global Gallery - WordPress Responsive Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including… |
CVE-2024-10644 | Critical | 9.1 | 2025-02-11 | Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with ad… |
CVE-2025-1174 | Low | 2.4 | 2025-02-11 | A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the f… |
CVE-2025-1171 | Low | 3.5 | 2025-02-11 | A vulnerability classified as problematic was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerability is an unknown f… |
CVE-2025-1170 | Low | 3.5 | 2025-02-11 | A vulnerability classified as problematic has been found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the fi… |
CVE-2025-1169 | Low | 3.5 | 2025-02-11 | A vulnerability was found in SourceCodester Image Compressor Tool 1.0. It has been rated as problematic. This issue affects some unknown processing of the file… |
CVE-2025-1159 | Low | 3.5 | 2025-02-10 | A vulnerability was found in CampCodes School Management Software 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2025-1155 | Medium | 4.3 | 2025-02-10 | A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of the component Your… |
CVE-2024-27859 | High | 8.8 | 2025-02-10 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, watchOS 10… |
CVE-2025-1114 | Low | 3.5 | 2025-02-07 | A vulnerability classified as problematic has been found in newbee-mall 1.0. Affected is the function save of the file /admin/categories/save of the component… |
CVE-2021-41527 | | 2025-02-07 | An error related to the 2-factor authorization (2FA) on the RISC Platform prior to the saas-2021-12-29 release can potentially be exploited to bypass the 2FA… | |
CVE-2025-1105 | Medium | 4.3 | 2025-02-07 | A vulnerability was found in SiberianCMS 4.20.6. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /app/sae/de… |
CVE-2024-7425 | Medium | 6.8 | 2025-02-07 | The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to improper user input… |
CVE-2024-7419 | High | 8.3 | 2025-02-07 | The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields. Thi… |
CVE-2024-57707 | Critical | 9.8 | 2025-02-07 | An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components. |
CVE-2025-1085 | Medium | 4.3 | 2025-02-07 | A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the file /login. The manip… |
CVE-2025-1082 | Low | 3.5 | 2025-02-06 | A vulnerability classified as problematic has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected is an unknown function of the file /api/admin/question… |
CVE-2024-57609 | High | 8.6 | 2025-02-06 | An issue in Kanaries Inc Pygwalker before v.0.4.9.9 allows a remote attacker to obtain sensitive information and execute arbitrary code via the redirect_path p… |
CVE-2024-55241 | High | 8.8 | 2025-02-06 | An issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py component. |
CVE-2024-13487 | High | 7.3 | 2025-02-06 | The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to… |
CVE-2025-25246 | High | 8.1 | 2025-02-05 | NETGEAR XR1000 before 1.0.0.74, XR1000v2 before 1.1.0.22, and XR500 before 2.3.2.134 allow remote code execution by unauthenticated users. |
CVE-2025-24677 | Critical | 9.9 | 2025-02-04 | Improper Control of Generation of Code ('Code Injection') vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies a… |
CVE-2025-1011 | High | 8.8 | 2025-02-04 | A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vul… |
CVE-2025-22204 | Critical | 9.8 | 2025-02-04 | Improper control of generation of code in the sourcerer extension for Joomla in versions before 11.0.0 lead to a remote code execution vulnerability. |
CVE-2025-24959 | | 2025-02-03 | zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into `process.en… | |
CVE-2024-57099 | Critical | 9.8 | 2025-02-03 | ClassCMS v4.8 has a code execution vulnerability. Attackers can exploit this vulnerability by constructing a payload in the classview parameter of the model ma… |
CVE-2025-0972 | Low | 3.5 | 2025-02-03 | A vulnerability classified as problematic has been found in Zenvia Movidesk up to 25.01.22. This affects an unknown part of the component New Ticket Handler. T… |
CVE-2025-0971 | Low | 3.5 | 2025-02-03 | A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been rated as problematic. Affected by this issue is some unknown functionality of the file… |
CVE-2025-0961 | Low | 3.5 | 2025-02-01 | A vulnerability, which was classified as problematic, has been found in code-projects Job Recruitment 1.0. Affected by this issue is some unknown functionality… |
CVE-2024-12415 | Medium | 6.5 | 2025-01-31 | The The AI Infographic Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.9.0. This is due to th… |
CVE-2024-13472 | High | 7.3 | 2025-01-31 | The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.9.4. This is… |
CVE-2024-23921 | High | 8.8 | 2025-01-31 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentica… |
CVE-2024-23963 | High | 8.0 | 2025-01-31 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. An attacker must first obtain… |
CVE-2025-0871 | Low | 3.5 | 2025-01-30 | A vulnerability classified as problematic has been found in Maybecms 1.2. This affects an unknown part of the file /mb/admin/index.php?u=article-edit of the co… |
CVE-2024-11600 | High | 7.2 | 2025-01-30 | The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Remote Code Execution in all versions… |
CVE-2025-0869 | Medium | 4.3 | 2025-01-30 | A vulnerability was found in Cianet ONU GW24AC up to 20250127. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2024-13453 | High | 7.3 | 2025-01-30 | The The Contact Form & SMTP Plugin for WordPress by PirateForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and… |
CVE-2025-0844 | Medium | 4.3 | 2025-01-30 | A vulnerability was found in needyamin Library Card System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2024-10001 | High | 7.1 | 2025-01-29 | A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the ident… |
CVE-2025-0806 | Medium | 4.3 | 2025-01-29 | A vulnerability was found in code-projects Job Recruitment 1.0. It has been rated as problematic. This issue affects some unknown processing of the file _call_… |
CVE-2025-0800 | Low | 2.4 | 2025-01-29 | A vulnerability classified as problematic has been found in SourceCodester Online Courseware 1.0. Affected is an unknown function of the file /pcci/admin/savee… |
CVE-2025-0795 | Low | 3.5 | 2025-01-29 | A vulnerability was found in ESAFENET CDG V5. It has been classified as problematic. This affects an unknown part of the file /todolistjump.jsp. The manipulati… |
CVE-2025-0794 | Low | 3.5 | 2025-01-29 | A vulnerability was found in ESAFENET CDG V5 and classified as problematic. Affected by this issue is some unknown functionality of the file /todoDetail.jsp. T… |
CVE-2025-0790 | Low | 3.5 | 2025-01-29 | A vulnerability classified as problematic was found in ESAFENET CDG V5. This vulnerability affects unknown code of the file /doneDetail.jsp. The manipulation o… |
CVE-2025-0787 | Low | 3.5 | 2025-01-28 | A vulnerability was found in ESAFENET CDG V5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /appD… |
CVE-2025-0785 | Low | 3.5 | 2025-01-28 | A vulnerability was found in ESAFENET CDG V5 and classified as problematic. This issue affects some unknown processing of the file /SysConfig.jsp. The manipula… |
CVE-2025-24482 | | 2025-01-28 | A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default permissions and allows for D… | |
CVE-2024-40673 | Medium | 6.5 | 2025-01-28 | In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to improper input validat… |
CVE-2025-23211 | Critical | 9.9 | 2025-01-28 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute com… |
CVE-2025-24159 | High | 7.8 | 2025-01-27 | A validation issue was addressed with improved logic. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3… |
CVE-2025-0721 | Medium | 4.3 | 2025-01-27 | A vulnerability classified as problematic has been found in needyamin image_gallery 1.0. This affects the function image_gallery of the file /view.php. The man… |
CVE-2025-0710 | Low | 3.5 | 2025-01-24 | A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /notice-list… |
CVE-2025-0709 | Low | 2.4 | 2025-01-24 | A vulnerability was found in Dcat-Admin 2.2.1-beta. It has been rated as problematic. This issue affects some unknown processing of the file /admin/auth/roles… |
CVE-2025-0708 | Low | 3.5 | 2025-01-24 | A vulnerability was found in fumiao opencms 2.2. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/model/addOrUpd… |
CVE-2025-0706 | Low | 2.4 | 2025-01-24 | A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by this issue is some un… |
CVE-2024-13499 | High | 7.3 | 2025-01-22 | The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode e… |
CVE-2024-13495 | High | 7.3 | 2025-01-22 | The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode e… |
CVE-2024-49747 | Critical | 9.8 | 2025-01-21 | In gatts_process_read_by_type_req of gatt_sr.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to remote code execu… |
CVE-2024-43771 | High | 8.8 | 2025-01-21 | In gatts_process_read_req of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) c… |
CVE-2024-43770 | High | 8.8 | 2025-01-21 | In gatts_process_find_info of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent)… |
CVE-2024-24421 | Critical | 9.8 | 2025-01-21 | A type confusion in the nas_message_decode function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to execu… |
CVE-2024-51941 | High | 8.8 | 2025-01-21 | A remote code injection vulnerability exists in the Ambari Metrics and AMS Alerts feature, allowing authenticated users to inject and execute arbitrary code… |
CVE-2024-42936 | Critical | 9.8 | 2025-01-21 | The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker mess… |
CVE-2024-55504 | Medium | 5.5 | 2025-01-21 | An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote control and unauthori… |
CVE-2025-0581 | Low | 3.5 | 2025-01-20 | A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. This affects an unknown part of the file /chat/group/send… |
CVE-2025-0578 | Low | 3.5 | 2025-01-20 | A vulnerability was found in Facile Sistemas Cloud Apps up to 20250107. It has been classified as problematic. Affected is an unknown function of the file /acc… |
CVE-2025-0576 | Medium | 4.3 | 2025-01-20 | A vulnerability was found in Mobotix M15 4.3.4.83 and classified as problematic. This issue affects some unknown processing of the file /control/player?center&… |
CVE-2025-0560 | Low | 2.4 | 2025-01-18 | A vulnerability, which was classified as problematic, was found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /photo… |
CVE-2025-0559 | Low | 2.4 | 2025-01-18 | A vulnerability, which was classified as problematic, has been found in Campcodes School Management Software 1.0. This issue affects some unknown processing of… |
CVE-2025-0557 | Medium | 4.3 | 2025-01-18 | A vulnerability classified as problematic has been found in Hyland Alfresco Community Edition and Alfresco Enterprise Edition up to 6.2.2. This affects an unkn… |
CVE-2025-23209 | High | 8.0 | 2025-01-18 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that… |
CVE-2025-0538 | Low | 3.5 | 2025-01-17 | A vulnerability, which was classified as problematic, was found in code-projects Tourism Management System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-0537 | Low | 2.4 | 2025-01-17 | A vulnerability, which was classified as problematic, has been found in code-projects Car Rental Management System 1.0. This issue affects some unknown process… |
CVE-2025-0530 | Low | 3.5 | 2025-01-17 | A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. This vulnerability affects unknown code of the file /_parse/… |
CVE-2025-22906 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName parameter at /goform/setWAN. |
CVE-2025-22905 | Critical | 9.8 | 2025-01-16 | RE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter at /goform/mp. |
CVE-2024-10970 | Medium | 5.4 | 2025-01-16 | The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1… |
CVE-2025-0485 | Low | 3.5 | 2025-01-15 | A vulnerability was found in Fanli2012 native-php-cms 1.0. It has been classified as problematic. Affected is an unknown function of the file /fladmin/sysconfi… |
CVE-2025-0483 | Low | 3.5 | 2025-01-15 | A vulnerability has been found in Fanli2012 native-php-cms 1.0 and classified as problematic. This vulnerability affects unknown code of the file /fladmin/jump… |