CWE-94 · Code Injection (page 30)
Page 30 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47879 | High | 7.6 | 2024-10-24 | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expre… |
CVE-2024-48514 | Critical | 9.8 | 2024-10-24 | php-heic-to-jpg <= 1.0.5 is vulnerable to code injection (fixed in 1.0.6). An attacker who can upload heic images is able to execute code on the remote server… |
CVE-2024-48964 | High | 7.5 | 2024-10-23 | The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test… |
CVE-2024-20485 | Medium | 6.0 | 2024-10-23 | A vulnerability in the VPN web server of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an auth… |
CVE-2024-9050 | High | 7.8 | 2024-10-22 | A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from… |
CVE-2024-41714 | High | 8.8 | 2024-10-21 | A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1… |
CVE-2024-41712 | Medium | 6.6 | 2024-10-21 | A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack… |
CVE-2024-35315 | Medium | 5.6 | 2024-10-21 | A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an a… |
CVE-2024-35314 | Critical | 9.8 | 2024-10-21 | A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an u… |
CVE-2024-10131 | High | 8.8 | 2024-10-19 | The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses user-suppli… |
CVE-2024-9593 | High | 8.3 | 2024-10-18 | The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock)… |
CVE-2024-9264 | Critical | 9.9 | 2024-10-18 | The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanit… |
CVE-2024-27766 | Medium | 5.7 | 2024-10-17 | An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function. NOTE: this is disputed by the MariaDB Found… |
CVE-2023-39593 | Medium | 5.6 | 2024-10-17 | Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: thi… |
CVE-2023-26785 | Critical | 9.8 | 2024-10-17 | MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a "create function" state… |
CVE-2024-10073 | Medium | 5.0 | 2024-10-17 | A vulnerability, which was classified as critical, was found in flairNLP flair 0.14.0. Affected is the function ClusteringModel of the file flair\models\cluste… |
CVE-2024-45766 | High | 8.0 | 2024-10-17 | Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code Injection') vulnerability. A low privileg… |
CVE-2024-48744 | Medium | 6.1 | 2024-10-16 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /trms/listed- teachers.php in PHPGurukul Teachers Record Management System v2.1, which allows… |
CVE-2024-49254 | Critical | 10.0 | 2024-10-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in sunjianle ajax-extend ajax-extend allows Code Injection.This issue affects ajax-exte… |
CVE-2024-49271 | Critical | 9.1 | 2024-10-16 | Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for… |
CVE-2024-9061 | High | 7.3 | 2024-10-16 | The The WP Popup Builder – Popup Forms and Marketing Lead Generation plugin for WordPress is vulnerable to arbitrary shortcode execution via the wp_ajax_nopriv… |
CVE-2023-31493 | Medium | 6.6 | 2024-10-15 | RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted pa… |
CVE-2024-48279 | High | 7.6 | 2024-10-15 | A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allow… |
CVE-2024-45271 | High | 8.4 | 2024-10-15 | An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation. |
CVE-2024-9837 | High | 7.3 | 2024-10-15 | The The AADMY – Add Auto Date Month Year Into Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2… |
CVE-2024-47826 | Low | 3.5 | 2024-10-14 | eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tag… |
CVE-2024-48168 | Critical | 9.8 | 2024-10-14 | A stack overflow vulnerability exists in the sub_402280 function of the HNAP service of D-Link DCS-960L 1.09, allowing an attacker to execute arbitrary code. |
CVE-2024-41997 | Medium | 6.6 | 2024-10-14 | An issue was discovered in version of Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02). A command injection vulnerability exists in the Docker integrati… |
CVE-2024-8760 | Medium | 5.3 | 2024-10-12 | The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it p… |
CVE-2024-44414 | High | 8.8 | 2024-10-11 | A vulnerability was discovered in FBM_292W-21.03.10V, which has been classified as critical. This issue affects the sub_4901E0 function in the msp_info.htm fil… |
CVE-2024-21534 | Critical | 9.8 | 2024-10-11 | All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary… |
CVE-2024-9581 | High | 7.3 | 2024-10-10 | The Shortcodes AnyWhere plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.1. This is due to the sof… |
CVE-2024-45874 | Critical | 9.8 | 2024-10-07 | A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the s… |
CVE-2024-45873 | Critical | 9.8 | 2024-10-07 | A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in th… |
CVE-2024-43363 | High | 7.2 | 2024-10-07 | Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat… |
CVE-2024-46076 | Critical | 9.8 | 2024-10-07 | RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of malicious code. |
CVE-2024-45933 | Medium | 6.6 | 2024-10-07 | OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the Title and summary fields in the /admin… |
CVE-2024-8254 | Medium | 5.4 | 2024-10-02 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary… |
CVE-2024-45186 | Critical | 9.8 | 2024-10-02 | FileSender before 2.49 allows server-side template injection (SSTI) for retrieving credentials. |
CVE-2024-46080 | High | 8.0 | 2024-10-01 | Scriptcase v9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_zip function. |
CVE-2024-44744 | Medium | 5.7 | 2024-10-01 | An issue in Malwarebytes Premium Security v5.0.0.883 allows attackers to execute arbitrary code via placing crafted binaries into unspecified directories. NOTE… |
CVE-2024-28811 | Low | 3.3 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. A web application allows a remote privileged attacker to execute applications contained in a specific OS… |
CVE-2024-45200 | Medium | 6.3 | 2024-09-30 | In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to exploit a stack-based buffer overflow up… |
CVE-2024-9324 | Medium | 6.3 | 2024-09-29 | A vulnerability was found in Intelbras InControl up to 2.21.57. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-6983 | High | 8.8 | 2024-09-27 | mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the co… |
CVE-2024-46489 | High | 8.8 | 2024-09-25 | A remote command execution (RCE) vulnerability in promptr v6.0.7 allows attackers to execute arbitrary commands via a crafted URL. |
CVE-2024-8481 | High | 7.3 | 2024-09-25 | The The Special Text Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.2.4. This is due to the… |
CVE-2024-8623 | High | 7.3 | 2024-09-24 | The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.3… |
CVE-2024-46639 | High | 7.6 | 2024-09-23 | A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into th… |
CVE-2024-37779 | High | 8.8 | 2024-09-23 | WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script functionality. |
CVE-2024-0004 | Critical | 9.1 | 2024-09-23 | A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array. |
CVE-2024-40442 | High | 7.2 | 2024-09-23 | An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document au… |
CVE-2024-47219 | Critical | 9.8 | 2024-09-22 | An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows shell command injection. |
CVE-2024-46640 | Critical | 9.8 | 2024-09-20 | SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp. Although the system has a check function, the check function is not ex… |
CVE-2024-46103 | Critical | 9.8 | 2024-09-20 | SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php. |
CVE-2024-9006 | Medium | 6.3 | 2024-09-19 | A vulnerability was found in jeanmarc77 123solar 1.8.4.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file confi… |
CVE-2024-35515 | Critical | 9.8 | 2024-09-18 | Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code. |
CVE-2024-45798 | Critical | 9.9 | 2024-09-17 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The `arduino-esp32` CI is vulnerable to m… |
CVE-2024-44623 | Critical | 9.8 | 2024-09-16 | An issue in TuomoKu SPx-GC v.1.3.0 and before allows a remote attacker to execute arbitrary code via the child_process.js function. |
CVE-2024-7104 | Critical | 9.8 | 2024-09-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in SFS Consulting ww.Winsure allows Code Injection. This issue affects ww.Winsure: bef… |
CVE-2024-8880 | Medium | 5.6 | 2024-09-16 | A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /playsms/index.php?app=ma… |
CVE-2024-8864 | Medium | 5.5 | 2024-09-15 | A vulnerability has been found in composiohq composio up to 0.5.6 and classified as critical. Affected by this vulnerability is the function Calculator of the… |
CVE-2024-8479 | High | 7.3 | 2024-09-14 | The The Simple Spoiler plugin for WordPress is vulnerable to arbitrary shortcode execution in versions 1.2 to 1.3. This is due to the plugin adding the filter… |
CVE-2024-8271 | High | 7.3 | 2024-09-14 | The The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-44430 | Critical | 9.8 | 2024-09-13 | SQL Injection vulnerability in Best Free Law Office Management Software-v1.0 allows an attacker to execute arbitrary code and obtain sensitive information via… |
CVE-2024-8696 | Critical | 9.8 | 2024-09-12 | A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop befo… |
CVE-2024-8695 | Critical | 9.8 | 2024-09-12 | A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34… |
CVE-2024-45851 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45850 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45849 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45848 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on th… |
CVE-2024-45847 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on… |
CVE-2024-45846 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on th… |
CVE-2024-44466 | Critical | 9.8 | 2024-09-11 | COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4. Attackers can send POST request messages to /usr/bin/webmgnt and inject co… |
CVE-2024-43469 | High | 8.8 | 2024-09-10 | Azure CycleCloud Remote Code Execution Vulnerability |
CVE-2024-8258 | High | 7.8 | 2024-09-10 | Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute a… |
CVE-2024-43393 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43392 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43391 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control… |
CVE-2024-43390 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP enviro… |
CVE-2024-43389 | High | 8.1 | 2024-09-10 | A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment… |
CVE-2024-43388 | High | 8.8 | 2024-09-10 | A low privileged remote attacker with write permissions can reconfigure the SNMP service due to improper input validation. |
CVE-2024-6596 | Critical | 9.8 | 2024-09-10 | An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context. |
CVE-2024-8478 | High | 7.3 | 2024-09-10 | The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.5.3. This is due… |
CVE-2024-8268 | High | 8.8 | 2024-09-10 | The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the aj… |
CVE-2024-44411 | Critical | 9.8 | 2024-09-09 | D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the msp_info_htm function. |
CVE-2024-44410 | Critical | 9.8 | 2024-09-09 | D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function. |
CVE-2024-44724 | High | 7.2 | 2024-09-09 | AutoCMS v5.4 was discovered to contain a PHP code injection vulnerability via the txtsite_url parameter at /admin/site_add.php. This vulnerability allows attac… |
CVE-2024-39715 | High | 8.5 | 2024-09-07 | A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST… |
CVE-2024-39714 | Critical | 9.9 | 2024-09-07 | A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server. |
CVE-2024-38651 | High | 8.5 | 2024-09-07 | A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server. |
CVE-2023-39333 | Medium | 5.3 | 2024-09-07 | Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that… |
CVE-2024-8523 | Medium | 4.7 | 2024-09-07 | A vulnerability was found in lmxcms up to 1.4 and classified as critical. Affected by this issue is the function formatData of the file /admin.php?m=Acquisi&a=… |
CVE-2024-7627 | High | 8.1 | 2024-09-05 | The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writin… |
CVE-2024-45053 | Critical | 9.1 | 2024-09-04 | Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without… |
CVE-2024-8411 | Low | 3.5 | 2024-09-04 | A vulnerability was determined in ABCD ABCD2 up to 2.2.0-beta-1. Impacted is an unknown function of the file /buscar_integrada.php. Executing a manipulation of… |
CVE-2024-45507 | Critical | 9.8 | 2024-09-04 | Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz… |
CVE-2024-45390 | High | 7.3 | 2024-09-03 | @blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has acces… |
CVE-2024-42902 | High | 8.8 | 2024-09-03 | An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the ln… |
CVE-2024-7345 | High | 8.3 | 2024-09-03 | Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supporte… |