CWE-94 · Code Injection (page 28)
Page 28 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-12932 | Low | 3.5 | 2024-12-26 | A vulnerability was found in code-projects Simple Admin Panel 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2024-12930 | Low | 3.5 | 2024-12-26 | A vulnerability was found in code-projects Simple Admin Panel 1.0 and classified as problematic. This issue affects some unknown processing of the file addCatC… |
CVE-2024-12900 | Medium | 6.3 | 2024-12-23 | A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /install/installdb.php of the component… |
CVE-2024-12893 | Low | 2.4 | 2024-12-22 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9. Affected by this issue is some unknown functionality of… |
CVE-2024-12892 | Low | 3.5 | 2024-12-22 | A vulnerability classified as problematic was found in code-projects Online Exam Mastering System 1.0. Affected by this vulnerability is an unknown functionali… |
CVE-2024-12883 | Medium | 4.3 | 2024-12-21 | A vulnerability was found in code-projects Job Recruitment 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2024-11977 | High | 7.3 | 2024-12-21 | The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-12846 | Medium | 4.3 | 2024-12-21 | A vulnerability, which was classified as problematic, has been found in Emlog Pro up to 2.4.1. Affected by this issue is some unknown functionality of the file… |
CVE-2024-12845 | Low | 3.5 | 2024-12-20 | A vulnerability classified as problematic was found in Emlog Pro up to 2.4.1. Affected by this vulnerability is an unknown functionality in the library /includ… |
CVE-2024-56334 | High | 7.8 | 2024-12-20 | systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter t… |
CVE-2024-12844 | Medium | 4.3 | 2024-12-20 | A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.1. Affected is an unknown function of the file /admin/store.php. The manipulati… |
CVE-2024-12843 | Medium | 4.3 | 2024-12-20 | A vulnerability was found in Emlog Pro up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/plugin.php… |
CVE-2024-56333 | | 2024-12-20 | Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environment for data scient… | |
CVE-2024-12842 | Medium | 4.3 | 2024-12-20 | A vulnerability was found in Emlog Pro up to 2.4.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/user.php. T… |
CVE-2024-12841 | Medium | 4.3 | 2024-12-20 | A vulnerability was found in Emlog Pro up to 2.4.1. It has been classified as problematic. This affects an unknown part of the file /admin/tag.php. The manipul… |
CVE-2024-56327 | Critical | 9.8 | 2024-12-19 | pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `a… |
CVE-2024-12729 | High | 8.8 | 2024-12-19 | A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1… |
CVE-2024-12790 | Low | 3.5 | 2024-12-19 | A vulnerability was found in code-projects Hostel Management Site 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-12789 | Medium | 6.3 | 2024-12-19 | A vulnerability was found in PbootCMS up to 3.2.3. It has been classified as critical. This affects an unknown part of the file apps/home/controller/IndexContr… |
CVE-2024-9154 | | 2024-12-19 | A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device. This issue affects Ewon Flexy 205: throu… | |
CVE-2024-12783 | Low | 3.5 | 2024-12-19 | A vulnerability was found in itsourcecode Vehicle Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /… |
CVE-2024-11740 | High | 7.3 | 2024-12-19 | The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the s… |
CVE-2024-55505 | High | 8.8 | 2024-12-18 | An issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the mess-view.php component. |
CVE-2024-56145 | Critical | 9.8 | 2024-12-18 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerabi… |
CVE-2024-36694 | High | 7.2 | 2024-12-18 | OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function. |
CVE-2024-56051 | High | 8.5 | 2024-12-18 | Improper Control of Generation of Code ('Code Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Code Injection.This issue affects WPLMS: from n… |
CVE-2024-12372 | | 2024-12-18 | A denial-of-service and possible remote code execution vulnerability exists in the Rockwell Automation Power Monitor 1000. The vulnerability results in corrupt… | |
CVE-2023-34990 | Critical | 9.8 | 2024-12-18 | A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via… |
CVE-2024-21546 | Critical | 9.8 | 2024-12-18 | Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting th… |
CVE-2024-55085 | Critical | 9.8 | 2024-12-16 | GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an att… |
CVE-2024-37773 | Medium | 4.8 | 2024-12-16 | An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows attackers authenticated as administrators to inject arbitrary HTML code in an admin screen. |
CVE-2024-12665 | Low | 3.5 | 2024-12-16 | A vulnerability, which was classified as problematic, was found in ruifang-tech Rebuild 3.8.5. Affected is an unknown function of the component Task Comment At… |
CVE-2024-12664 | Low | 3.5 | 2024-12-16 | A vulnerability, which was classified as problematic, has been found in ruifang-tech Rebuild 3.8.5. This issue affects some unknown processing of the component… |
CVE-2024-56072 | High | 7.5 | 2024-12-15 | An issue was discovered in FastNetMon Community Edition through 1.2.7. The sFlow v5 plugin allows remote attackers to cause a denial of service (application cr… |
CVE-2024-55661 | High | 8.8 | 2024-12-13 | Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pul… |
CVE-2024-21577 | Critical | 10.0 | 2024-12-13 | ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval() in its entrypoint function that accepts arbitrary user-contro… |
CVE-2024-21576 | Critical | 10.0 | 2024-12-13 | ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour c… |
CVE-2024-11012 | Medium | 6.3 | 2024-12-13 | The The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via njt_nofi_text AJAX action in all versi… |
CVE-2024-12421 | Medium | 6.5 | 2024-12-13 | The The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-12420 | Medium | 6.5 | 2024-12-13 | The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includ… |
CVE-2024-12417 | Medium | 6.5 | 2024-12-13 | The The Simple Link Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.4.5. This is due to t… |
CVE-2024-55918 | Medium | 5.3 | 2024-12-13 | An issue was discovered in the Graphics::ColorNames package before 3.2.0 for Perl. There is an ambiguity between modules and filenames that can lead to HTML in… |
CVE-2024-55877 | Critical | 9.9 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perfor… |
CVE-2024-55662 | Critical | 9.9 | 2024-12-12 | XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Reposito… |
CVE-2024-21574 | Critical | 10.0 | 2024-12-12 | The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is add… |
CVE-2024-12333 | Medium | 6.5 | 2024-12-12 | The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowi… |
CVE-2024-10910 | High | 7.3 | 2024-12-12 | The The Grid Plus – Unlimited grid layout plugin for WordPress is vulnerable to arbitrary shortcode execution via grid_plus_load_by_category AJAX action in all… |
CVE-2024-55660 | Critical | 9.8 | 2024-12-12 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template… |
CVE-2024-54529 | High | 7.8 | 2024-12-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to e… |
CVE-2024-12536 | Low | 3.5 | 2024-12-12 | A vulnerability, which was classified as problematic, has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected by this issu… |
CVE-2024-12503 | Low | 2.4 | 2024-12-12 | A vulnerability classified as problematic was found in ClassCMS 4.8. Affected by this vulnerability is an unknown functionality of the file /index.php/admin of… |
CVE-2024-42448 | Critical | 9.9 | 2024-12-12 | From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution… |
CVE-2024-54152 | | 2024-12-10 | Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious exp… | |
CVE-2024-10959 | High | 7.3 | 2024-12-10 | The The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to arbitrary shortcode execution via woot_g… |
CVE-2022-38946 | Critical | 9.8 | 2024-12-09 | Arbitrary File Upload vulnerability in Doctor-Appointment version 1.0 in /Frontend/signup_com.php, allows attackers to execute arbitrary code. |
CVE-2024-12359 | Low | 3.5 | 2024-12-09 | A vulnerability was found in code-projects Admin Dashboard 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /vendo… |
CVE-2024-55580 | High | 7.5 | 2024-12-09 | An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. Unprivileged users with network access may be able to execute remote comm… |
CVE-2024-12350 | Medium | 6.3 | 2024-12-09 | A vulnerability was found in JFinalCMS 1.0. It has been rated as critical. Affected by this issue is the function update of the file \src\main\java\com\cms\con… |
CVE-2024-12348 | Low | 3.5 | 2024-12-09 | A vulnerability was found in Guizhou Xiaoma Technology jpress 5.1.2. It has been classified as problematic. Affected is the function AttachmentUtils.isUnSafe o… |
CVE-2024-12346 | Low | 3.5 | 2024-12-09 | A vulnerability has been found in Talentera up to 20241128 and classified as problematic. This vulnerability affects unknown code of the file /app/control/byt_… |
CVE-2024-51815 | Critical | 9.0 | 2024-12-06 | Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member allows Code Injection.This issue affects s2Member… |
CVE-2024-21571 | High | 8.1 | 2024-12-06 | Snyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent. The vulnerability enables an attacker to execute arbitrary code… |
CVE-2024-10771 | High | 8.8 | 2024-12-06 | Due to missing input validation during one step of the firmware update process, the product is vulnerable to remote code execution. With network access and the… |
CVE-2024-10909 | Medium | 6.3 | 2024-12-06 | The The Pojo Forms plugin for WordPress is vulnerable to arbitrary shortcode execution via form_preview_shortcode AJAX action in all versions up to, and includ… |
CVE-2024-10681 | Medium | 6.3 | 2024-12-06 | The The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to arbitrary shortcode… |
CVE-2024-37862 | High | 7.3 | 2024-12-05 | Buffer Overflow vulnerability in Open Robotic Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local attacker to execute… |
CVE-2024-37860 | High | 7.3 | 2024-12-05 | Buffer Overflow vulnerability in Open Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local attacker to execute arbitrar… |
CVE-2024-30964 | High | 7.8 | 2024-12-05 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker… |
CVE-2024-30963 | High | 7.8 | 2024-12-05 | Buffer Overflow vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to ex… |
CVE-2024-30962 | High | 7.8 | 2024-12-05 | Buffer Overflow vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker to ex… |
CVE-2024-30961 | High | 7.8 | 2024-12-05 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a local attacker… |
CVE-2024-12232 | Low | 3.5 | 2024-12-05 | A vulnerability has been found in code-projects Simple CRUD Functionality 1.0 and classified as problematic. This vulnerability affects unknown code of the fil… |
CVE-2024-48840 | Critical | 10.0 | 2024-12-05 | Unauthorized Access vulnerabilities allow Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series… |
CVE-2024-48839 | Critical | 10.0 | 2024-12-05 | Improper Input Validation vulnerability allows Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX S… |
CVE-2024-12183 | Low | 3.5 | 2024-12-04 | A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116. This affects the function RemoveXSS of the file /plus/carbuyaction.php of t… |
CVE-2024-12182 | Low | 3.5 | 2024-12-04 | A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7.116. Affected by this issue is some unknown functionality of the file /memb… |
CVE-2024-12181 | Low | 3.5 | 2024-12-04 | A vulnerability classified as problematic was found in DedeCMS 5.7.116. Affected by this vulnerability is an unknown functionality of the file /member/uploads_… |
CVE-2024-12180 | Low | 3.5 | 2024-12-04 | A vulnerability classified as problematic has been found in DedeCMS 5.7.116. Affected is an unknown function of the file /member/article_add.php. The manipulat… |
CVE-2024-48453 | Critical | 9.8 | 2024-12-04 | An issue in INOVANCE AM401_CPU1608TPTN allows a remote attacker to execute arbitrary code via the ExecuteUserProgramUpgrade function |
CVE-2024-10952 | High | 7.3 | 2024-12-04 | The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution via update_authors_list_ajax AJAX action in all versions up to, and in… |
CVE-2024-12001 | Low | 3.5 | 2024-11-30 | A vulnerability classified as problematic has been found in code-projects Wazifa System 1.0. Affected is an unknown function of the file /controllers/updateset… |
CVE-2024-12000 | Low | 3.5 | 2024-11-30 | A vulnerability was found in code-projects Blood Bank System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /con… |
CVE-2024-11997 | Low | 3.5 | 2024-11-30 | A vulnerability was found in code-projects Farmacia 1.0. It has been classified as problematic. This affects an unknown part of the file /vendas.php. The manip… |
CVE-2024-11996 | Low | 3.5 | 2024-11-30 | A vulnerability was found in code-projects Farmacia 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /editar… |
CVE-2024-11995 | Low | 3.5 | 2024-11-29 | A vulnerability has been found in code-projects Farmacia 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2024-36622 | Critical | 9.8 | 2024-11-29 | In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitizati… |
CVE-2024-11971 | Low | 3.5 | 2024-11-28 | A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of th… |
CVE-2024-11620 | High | 7.2 | 2024-11-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Code Injection.This issue affect… |
CVE-2024-8672 | Critical | 9.9 | 2024-11-28 | The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and incl… |
CVE-2024-53920 | High | 7.8 | 2024-11-27 | In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can… |
CVE-2024-53604 | Critical | 9.8 | 2024-11-27 | A SQL Injection vulnerability was found in /covid-tms/check_availability.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attacke… |
CVE-2024-52959 | High | 7.2 | 2024-11-27 | A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 al… |
CVE-2024-11820 | Low | 3.5 | 2024-11-27 | A vulnerability, which was classified as problematic, has been found in code-projects Crud Operation System 1.0. This issue affects some unknown processing of… |
CVE-2024-11742 | Low | 3.5 | 2024-11-26 | A vulnerability, which was classified as problematic, has been found in SourceCodester Best House Rental Management System 1.0. This issue affects some unknown… |
CVE-2024-11699 | High | 8.8 | 2024-11-26 | Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-11697 | High | 8.8 | 2024-11-26 | When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have l… |
CVE-2024-11002 | Medium | 6.3 | 2024-11-26 | The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_shortcode_template AJAX action in all ver… |
CVE-2024-11678 | Low | 3.5 | 2024-11-26 | A vulnerability was found in CodeAstro Hospital Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file… |
CVE-2024-11677 | Low | 3.5 | 2024-11-26 | A vulnerability was found in CodeAstro Hospital Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /backend… |
CVE-2024-52899 | High | 8.5 | 2024-11-26 | IBM Data Virtualization Manager for z/OS 1.1 and 1.2 could allow an authenticated user to inject malicious JDBC URL parameters and execute code on the server. |