CWE-94 · Code Injection (page 29)
Page 29 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11676 | Low | 3.5 | 2024-11-26 | A vulnerability was found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of th… |
CVE-2024-11675 | Low | 3.5 | 2024-11-26 | A vulnerability has been found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown function… |
CVE-2024-53554 | High | 8.0 | 2024-11-25 | A Client-Side Template Injection (CSTI) vulnerability in the component /project/new/scrum of Taiga v 8.6.1 allows remote attackers to execute arbitrary code by… |
CVE-2024-53268 | High | 7.2 | 2024-11-25 | Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS. In affected versions attackers are… |
CVE-2024-11660 | Low | 3.5 | 2024-11-25 | A vulnerability was found in code-projects Farmacia 1.0. It has been classified as problematic. This affects an unknown part of the file usuario.php. The manip… |
CVE-2024-11034 | High | 7.3 | 2024-11-23 | The The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation plugin for WordPress is vulnerable… |
CVE-2021-38117 | High | 8.8 | 2024-11-22 | Possible Command injection Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000. |
CVE-2024-51367 | Critical | 9.8 | 2024-11-21 | An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitrary code via upload… |
CVE-2024-11587 | Low | 3.5 | 2024-11-21 | A vulnerability was found in idcCMS 1.60. It has been classified as problematic. This affects the function GetCityOptionJs of the file /inc/classProvCity.php… |
CVE-2024-52765 | Critical | 9.8 | 2024-11-20 | H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter. |
CVE-2024-11493 | Low | 3.5 | 2024-11-20 | A vulnerability classified as problematic was found in 115cms up to 20240807. This vulnerability affects unknown code of the file /index.php/setpage/admin/page… |
CVE-2024-11492 | Low | 3.5 | 2024-11-20 | A vulnerability classified as problematic has been found in 115cms up to 20240807. This affects an unknown part of the file /index.php/admin/web/appurladd.html… |
CVE-2024-11491 | Low | 3.5 | 2024-11-20 | A vulnerability was found in 115cms up to 20240807. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.p… |
CVE-2024-11490 | Low | 3.5 | 2024-11-20 | A vulnerability was found in 115cms up to 20240807. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2024-11489 | Low | 3.5 | 2024-11-20 | A vulnerability was found in 115cms up to 20240807. It has been classified as problematic. Affected is an unknown function of the file /index.php/admin/web/fil… |
CVE-2024-11488 | Low | 3.5 | 2024-11-20 | A vulnerability was found in 115cms up to 20240807 and classified as problematic. This issue affects some unknown processing of the file /app/admin/view/web_us… |
CVE-2024-10094 | Critical | 9.1 | 2024-11-20 | Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code |
CVE-2024-10382 | High | 7.5 | 2024-11-20 | There exists a code execution vulnerability in the Car App Android Jetpack Library. CarAppService uses deserialization logic that allows construction of arbitr… |
CVE-2024-10899 | High | 7.3 | 2024-11-20 | The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.6. This is… |
CVE-2024-48694 | Critical | 9.8 | 2024-11-19 | File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute arbitrary code via the… |
CVE-2024-48070 | Critical | 9.8 | 2024-11-19 | An issue in Weaver E-cology v. attackers construct special requests to insert remote malicious code and to trigger malicious code execution, and control server… |
CVE-2024-11038 | High | 7.3 | 2024-11-19 | The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to arbitrary shortcode e… |
CVE-2024-11036 | High | 7.3 | 2024-11-19 | The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shor… |
CVE-2024-50804 | High | 7.8 | 2024-11-18 | Insecure Permissions vulnerability in Micro-star International MSI Center Pro 2.1.37.0 allows a local attacker to execute arbitrary code via the Device_DeviceI… |
CVE-2024-50919 | Critical | 9.8 | 2024-11-18 | Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary c… |
CVE-2024-44757 | High | 7.5 | 2024-11-18 | An arbitrary file download vulnerability in the component /Basics/DownloadInpFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to download arbitra… |
CVE-2024-52434 | Critical | 9.1 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.This issue affects Popup by Supsyst… |
CVE-2024-52427 | Critical | 9.9 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Server Side Include (SS… |
CVE-2024-48962 | High | 8.8 | 2024-11-18 | Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template… |
CVE-2024-47208 | Critical | 9.8 | 2024-11-18 | Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz… |
CVE-2024-52945 | High | 7.8 | 2024-11-18 | An issue was discovered in Veritas NetBackup before 10.5. This only applies to NetBackup components running on a Windows Operating System. If a user executes s… |
CVE-2023-43091 | Critical | 9.8 | 2024-11-17 | A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious… |
CVE-2024-9839 | High | 7.3 | 2024-11-16 | The The Uix Slideshow plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.6.5. This is due to the softw… |
CVE-2024-10262 | Medium | 6.3 | 2024-11-16 | The The Drop Shadow Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.14. This is due to the… |
CVE-2024-44758 | Critical | 9.8 | 2024-11-15 | An arbitrary file upload vulnerability in the component /Production/UploadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to execute arbitrary c… |
CVE-2024-11259 | Low | 3.5 | 2024-11-15 | A vulnerability, which was classified as problematic, has been found in code-projects Farmacia 1.0. This issue affects some unknown processing of the file /for… |
CVE-2024-51330 | Medium | 5.1 | 2024-11-15 | An issue in UltiMaker Cura v.4.41 and 5.8.1 and before allows a local attacker to execute arbitrary code via Inter-process communication (IPC) mechanism betwee… |
CVE-2024-11247 | Low | 3.5 | 2024-11-15 | A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2024-11246 | Low | 3.5 | 2024-11-15 | A vulnerability, which was classified as problematic, was found in code-projects Farmacia 1.0. Affected is an unknown function of the file /adicionar-cliente.p… |
CVE-2024-11243 | Medium | 4.3 | 2024-11-15 | A vulnerability classified as problematic has been found in code-projects Online Shop Store 1.0. This affects an unknown part of the file /signup.php. The mani… |
CVE-2024-11240 | Low | 3.5 | 2024-11-15 | A vulnerability was found in IBPhoenix ibWebAdmin up to 1.0.2 and classified as problematic. This issue affects some unknown processing of the file /database.p… |
CVE-2024-52393 | Critical | 9.1 | 2024-11-14 | Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Po… |
CVE-2024-49362 | High | 7.7 | 2024-11-14 | Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user click… |
CVE-2024-5082 | | 2024-11-14 | A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2. This issue affects Nexus Repository 2 OSS/Pro versions up to and in… | |
CVE-2024-40671 | High | 7.8 | 2024-11-13 | In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible way to achieve arbitrary code execution due to a missing permission check. This could lead… |
CVE-2024-11175 | Low | 3.5 | 2024-11-13 | A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of… |
CVE-2024-21541 | High | 7.3 | 2024-11-13 | Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sani… |
CVE-2024-49048 | High | 8.1 | 2024-11-12 | TorchGeo Remote Code Execution Vulnerability |
CVE-2024-11130 | Low | 2.4 | 2024-11-12 | A vulnerability was found in ZZCMS up to 2023. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/msg.ph… |
CVE-2024-11102 | Low | 3.5 | 2024-11-12 | A vulnerability was found in SourceCodester Hospital Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functional… |
CVE-2024-50636 | Critical | 9.8 | 2024-11-11 | PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM files. Attackers ca… |
CVE-2024-46966 | High | 8.1 | 2024-11-11 | The Ikhgur mn.ikhgur.khotoch (aka Video Downloader Pro & Browser) application through 1.0.42 for Android allows an attacker to execute arbitrary JavaScript cod… |
CVE-2024-46964 | High | 8.1 | 2024-11-11 | The com.video.downloader.all (aka All Video Downloader) application through 11.28 for Android allows an attacker to execute arbitrary JavaScript code via the c… |
CVE-2024-46963 | High | 8.1 | 2024-11-11 | The com.superfast.video.downloader (aka Super Unlimited Video Downloader - All in One) application through 5.1.9 for Android allows an attacker to execute arbi… |
CVE-2024-46962 | Critical | 9.1 | 2024-11-11 | The SYQ com.downloader.video.fast (aka Master Video Downloader) application through 2.0 for Android allows an attacker to execute arbitrary JavaScript code via… |
CVE-2024-46965 | Medium | 5.4 | 2024-11-11 | The DS allvideo.downloader.browser (aka Fast Video Downloader: Browser) application through 1.6-RC1 for Android allows an attacker to execute arbitrary JavaScr… |
CVE-2024-11078 | Low | 3.5 | 2024-11-11 | A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality o… |
CVE-2024-11070 | Low | 3.5 | 2024-11-11 | A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /a… |
CVE-2024-10958 | High | 7.3 | 2024-11-10 | The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions… |
CVE-2024-11050 | Low | 3.5 | 2024-11-10 | A vulnerability was found in AMTT Hotel Broadband Operation System up to 3.0.3.151204 and classified as problematic. This issue affects some unknown processing… |
CVE-2024-10640 | High | 7.3 | 2024-11-09 | The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-10261 | High | 7.3 | 2024-11-09 | The The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to arbitrary shortc… |
CVE-2024-50808 | High | 8.8 | 2024-11-08 | SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe hand… |
CVE-2024-46961 | High | 8.1 | 2024-11-07 | The Inshot com.downloader.privatebrowser (aka Video Downloader - XDownloader) application through 1.3.5 for Android allows an attacker to execute arbitrary Jav… |
CVE-2024-46960 | High | 8.8 | 2024-11-07 | The ASD com.rocks.video.downloader (aka HD Video Downloader All Format) application through 7.0.129 for Android allows an attacker to execute arbitrary JavaScr… |
CVE-2024-43425 | High | 8.1 | 2024-11-07 | A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the ca… |
CVE-2024-51757 | | 2024-11-06 | happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the… | |
CVE-2024-10263 | High | 7.3 | 2024-11-05 | The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.4. This… |
CVE-2024-48061 | Critical | 9.8 | 2024-11-04 | langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rat… |
CVE-2024-48050 | Critical | 9.8 | 2024-11-04 | In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result =… |
CVE-2024-51329 | High | 8.8 | 2024-11-04 | A Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset… |
CVE-2024-10035 | Critical | 9.8 | 2024-11-04 | Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in a Command ('Command Injection'), Improper Neutra… |
CVE-2024-10761 | Medium | 4.3 | 2024-11-04 | A vulnerability was found in Umbraco CMS up to 10.7.7/12.3.6/13.5.2/14.3.1/15.1.1. It has been classified as problematic. Affected is an unknown function of th… |
CVE-2024-48359 | Critical | 9.8 | 2024-10-31 | Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter. |
CVE-2024-21537 | High | 8.8 | 2024-10-31 | Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport… |
CVE-2024-51427 | Critical | 9.8 | 2024-10-30 | An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint functi… |
CVE-2024-51424 | Critical | 9.8 | 2024-10-30 | An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOw… |
CVE-2024-51243 | High | 7.2 | 2024-10-30 | The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system… |
CVE-2024-42041 | High | 8.1 | 2024-10-30 | The com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application 20-30.05.24 for Android allows an attacker to execut… |
CVE-2024-51298 | Critical | 9.8 | 2024-10-30 | In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function. |
CVE-2024-9846 | High | 7.3 | 2024-10-30 | The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and in… |
CVE-2024-10505 | Medium | 6.3 | 2024-10-30 | A vulnerability was found in wuzhicms 4.1.0. It has been classified as critical. Affected is the function add/edit of the file www/coreframe/app/content/admin/… |
CVE-2024-48138 | Critical | 9.8 | 2024-10-29 | A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute… |
CVE-2024-8923 | Critical | 9.8 | 2024-10-29 | ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to… |
CVE-2024-50498 | Critical | 10.0 | 2024-10-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in Ajit Bohra WP Query Console wp-query-console allows Code Injection.This issue affect… |
CVE-2024-50492 | High | 8.3 | 2024-10-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson ScottCart scottcart allows Code Injection.This issue affects ScottCar… |
CVE-2024-50450 | High | 7.3 | 2024-10-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This i… |
CVE-2024-9162 | High | 7.2 | 2024-10-28 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export… |
CVE-2024-50611 | High | 7.2 | 2024-10-27 | CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a sim… |
CVE-2024-9772 | High | 7.3 | 2024-10-26 | The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1… |
CVE-2024-48236 | Medium | 6.5 | 2024-10-25 | An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the FileOutputStream function in the write String method of the ofcms-admin\src\… |
CVE-2024-48235 | Medium | 6.5 | 2024-10-25 | An issue in ofcms 1.1.2 allows a remote attacker to execute arbitrary code via the save method of the TemplateController.java file. |
CVE-2024-37846 | Medium | 4.6 | 2024-10-25 | MangoOS before 5.2.0 was discovered to contain a Client-Side Template Injection (CSTI) vulnerability via the Platform Management Edit page. |
CVE-2024-37845 | High | 7.2 | 2024-10-25 | MangoOS before 5.2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Process Command feature. |
CVE-2024-48700 | High | 7.2 | 2024-10-25 | Kliqqi-CMS has a background arbitrary code execution vulnerability that attackers can exploit to implant backdoors or getShell via the edit_page.php component. |
CVE-2024-48655 | High | 8.8 | 2024-10-25 | An issue in Total.js CMS v.1.0 allows a remote attacker to execute arbitrary code via the func.js file. |
CVE-2024-48581 | Critical | 9.8 | 2024-10-25 | File Upload vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the admin_class.php component. |
CVE-2024-48579 | Critical | 9.8 | 2024-10-25 | SQL Injection vulnerability in Best House rental management system project in php v.1.0 allows a remote attacker to execute arbitrary code via the username par… |
CVE-2024-48204 | Critical | 9.8 | 2024-10-25 | SQL injection vulnerability in Hanzhou Haobo network management system 1.0 allows a remote attacker to execute arbitrary code via a crafted script. |
CVE-2024-47158 | Medium | 5.4 | 2024-10-25 | N-LINE 2.0.6 and prior versions contain a code injection vulnerability. If this vulnerability is exploited, arbitrary code may be executed on the instructor's… |