CWE-94 · Code Injection (page 31)
Page 31 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8374 | High | 7.8 | 2024-09-03 | UltiMaker Cura slicer versions 5.7.0-beta.1 through 5.7.2 are vulnerable to code injection via the 3MF format reader (/plugins/ThreeMFReader.py). The vulnerabi… |
CVE-2024-45623 | Critical | 9.8 | 2024-09-02 | D-Link DAP-2310 Hardware A Firmware 1.16RC028 allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the ATP binary that handle… |
CVE-2024-41369 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWifi.php |
CVE-2024-41368 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWlanIpMail.php |
CVE-2024-41367 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\appendFileToPlaylist.php |
CVE-2024-41366 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.php |
CVE-2024-41364 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.php |
CVE-2024-41361 | Critical | 9.8 | 2024-08-29 | RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFolders.php |
CVE-2024-43922 | Medium | 4.8 | 2024-08-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in NitroPack Inc. NitroPack allows Code Injection.This issue affects NitroPack: from n/… |
CVE-2023-26324 | High | 8.8 | 2024-08-28 | A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an a… |
CVE-2023-26322 | High | 8.8 | 2024-08-28 | A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an a… |
CVE-2024-7720 | Critical | 9.8 | 2024-08-27 | HP Security Manager is potentially vulnerable to Remote Code Execution as a result of code vulnerability within the product's solution open-source libraries. |
CVE-2024-7656 | High | 8.8 | 2024-08-24 | The Image Hotspot by DevVN plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.5 via deserialization of untrus… |
CVE-2024-42845 | High | 8.0 | 2024-08-23 | An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to execute arbitrary cod… |
CVE-2024-42756 | High | 8.8 | 2024-08-23 | An issue in Netgear DGN1000WW v.1.1.00.45 allows a remote attacker to execute arbitrary code via the Diagnostics page |
CVE-2024-5466 | High | 8.8 | 2024-08-23 | Zohocorp ManageEngine OpManager and Remote Monitoring and Management versions 128329 and below are vulnerable to the authenticated remote code execution in the… |
CVE-2024-7559 | High | 8.8 | 2024-08-23 | The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mk_file_fold… |
CVE-2024-45201 | High | 8.8 | 2024-08-22 | An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. |
CVE-2024-42599 | High | 8.8 | 2024-08-22 | SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictions on edited files… |
CVE-2024-6386 | Critical | 9.9 | 2024-08-21 | The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This… |
CVE-2024-40453 | Critical | 9.8 | 2024-08-21 | squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varName. |
CVE-2024-42598 | Medium | 6.7 | 2024-08-20 | SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_editplayer.php imposes restrictions on edited f… |
CVE-2024-43404 | Critical | 9.8 | 2024-08-20 | MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execut… |
CVE-2024-21689 | High | 8.0 | 2024-08-20 | This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo… |
CVE-2024-43202 | Critical | 9.8 | 2024-08-20 | Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache… |
CVE-2024-7899 | Medium | 4.7 | 2024-08-17 | A vulnerability, which was classified as critical, has been found in InnoCMS 0.3.1. This issue affects some unknown processing of the file /panel/pages/1/edit… |
CVE-2024-42634 | Critical | 9.8 | 2024-08-16 | A Command Injection vulnerability exists in formWriteFacMac of the httpd binary in Tenda AC9 v15.03.06.42. As a result, attacker can execute OS commands with r… |
CVE-2024-42739 | High | 8.8 | 2024-08-13 | In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setAccessDeviceCfg. Authenticated A… |
CVE-2024-41623 | Critical | 9.8 | 2024-08-13 | An issue in D3D Security D3D IP Camera (D8801) v.V9.1.17.1.4-20180428 allows a local attacker to execute arbitrary code via a crafted payload |
CVE-2024-37287 | Critical | 9.1 | 2024-08-13 | A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to in… |
CVE-2024-43128 | Medium | 6.5 | 2024-08-13 | Improper Control of Generation of Code ('Code Injection') vulnerability in WC Product Table WooCommerce Product Table Lite allows Code Injection.This issue aff… |
CVE-2024-7094 | Critical | 9.8 | 2024-08-13 | The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all ver… |
CVE-2024-42745 | High | 8.8 | 2024-08-12 | In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers… |
CVE-2024-41651 | High | 8.1 | 2024-08-12 | An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality. NOTE: this is disputed by mu… |
CVE-2024-5651 | High | 8.8 | 2024-08-12 | A flaw was found in the Fence Agents Remediation operator. This vulnerability can allow a Remote Code Execution (RCE) primitive by supplying an arbitrary comma… |
CVE-2024-40487 | High | 7.6 | 2024-08-12 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/view_type.php" of Kashipara Live Membership System v1.0, which allows remote attackers to exec… |
CVE-2024-22123 | Low | 2.7 | 2024-08-12 | Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another… |
CVE-2024-22116 | Critical | 9.9 | 2024-08-12 | An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping f… |
CVE-2023-50810 | Medium | 6.0 | 2024-08-12 | In certain Sonos products before Sonos S1 Release 11.12 and S2 release 15.9, a vulnerability exists in the U-Boot component of the firmware that allow persiste… |
CVE-2023-31315 | High | 7.5 | 2024-08-12 | Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled… |
CVE-2024-37382 | High | 7.2 | 2024-08-08 | An issue discovered in import host feature in Ab Initio Metadata Hub and Authorization Gateway before 4.3.1.1 allows attackers to run arbitrary code via crafte… |
CVE-2023-33206 | Medium | 6.8 | 2024-08-08 | Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR16, 4.0.0 SR06, 4.1.0 SR04, 4.2.0 SR03, and 4.3.0 SR01 fails to validate symlinks during the Pre-Bo… |
CVE-2024-42356 | High | 8.3 | 2024-08-08 | Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Template and allows to a… |
CVE-2024-42355 | High | 8.3 | 2024-08-08 | Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in this tag. Prior to ver… |
CVE-2024-3958 | Medium | 5.3 | 2024-08-08 | An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allo… |
CVE-2024-6891 | High | 8.8 | 2024-08-08 | Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow. |
CVE-2024-42393 | Critical | 9.8 | 2024-08-06 | There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated RCE attack. Successful exploitation coul… |
CVE-2024-7520 | High | 8.8 | 2024-08-06 | A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulnerability affects Firefox < 129, Firefox… |
CVE-2024-34344 | High | 8.8 | 2024-08-05 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the `path` param… |
CVE-2024-22169 | | 2024-08-02 | WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment settings that could allow code execution by utilizing the 'ELECTRO… | |
CVE-2024-41127 | High | 8.3 | 2024-08-02 | Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-com… |
CVE-2024-36268 | Critical | 9.8 | 2024-08-02 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong. This issue affects Apache InLong: from 1.10.0 through 1.12.0, which… |
CVE-2024-7093 | | 2024-08-01 | Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly san… | |
CVE-2024-41961 | Critical | 9.6 | 2024-08-01 | Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search fu… |
CVE-2024-6923 | Medium | 5.5 | 2024-08-01 | There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email mess… |
CVE-2024-37901 | Critical | 9.9 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbit… |
CVE-2024-37900 | Medium | 6.4 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When uploading an attachment with a malicious filename… |
CVE-2024-41304 | Medium | 5.4 | 2024-07-30 | An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file. |
CVE-2024-7218 | Low | 3.5 | 2024-07-30 | A flaw has been found in SourceCodester/Campcodes School Log Management System 1.0. Affected is an unknown function of the file /admin/ajax.php?action=save_stu… |
CVE-2024-6726 | High | 8.8 | 2024-07-29 | Versions of Delphix Engine prior to Release 25.0.0.0 contain a flaw which results in Remote Code Execution (RCE). |
CVE-2024-41468 | Critical | 9.8 | 2024-07-25 | Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the cmdinput parameter at /goform/exeCommand |
CVE-2024-37084 | Critical | 9.8 | 2024-07-25 | In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arb… |
CVE-2024-40495 | High | 8.0 | 2024-07-24 | A vulnerability was discovered in Linksys Router E2500 with firmware 2.0.00, allows authenticated attackers to execute arbitrary code via the hnd_parentalctrl_… |
CVE-2024-41667 | High | 8.8 | 2024-07-24 | OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulne… |
CVE-2024-38944 | Critical | 9.8 | 2024-07-22 | An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateForm.cgi?formID=142 c… |
CVE-2024-21552 | Critical | 9.8 | 2024-07-22 | All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the LLM output to expl… |
CVE-2024-6950 | Medium | 6.3 | 2024-07-21 | A vulnerability, which was classified as critical, has been found in Prain up to 1.3.0. Affected by this issue is some unknown functionality of the file /?impo… |
CVE-2024-6947 | Medium | 4.7 | 2024-07-21 | A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been rated as critical. This issue affects the function replaceContent of the file app/Core/Suppor… |
CVE-2024-6946 | Medium | 4.7 | 2024-07-21 | A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been declared as critical. This vulnerability affects unknown code of the file /admin/pages/list… |
CVE-2024-6940 | Medium | 4.7 | 2024-07-21 | A vulnerability was found in DedeCMS 5.7.114. It has been classified as critical. This affects an unknown part of the file article_template_rand.php. The manip… |
CVE-2024-6936 | Low | 2.7 | 2024-07-21 | A vulnerability, which was classified as problematic, has been found in formtools.org Form Tools 3.1.1. This issue affects some unknown processing of the file… |
CVE-2024-39962 | Critical | 9.8 | 2024-07-19 | D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21_D240126 was discovered to contain a remote code execution (RCE) vulnerability in the ntp_zone_val… |
CVE-2024-29178 | High | 8.8 | 2024-07-18 | On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must succe… |
CVE-2024-29014 | High | 8.8 | 2024-07-18 | Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an attacker to arbitrary code execution when… |
CVE-2024-39877 | High | 8.8 | 2024-07-17 | Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could exec… |
CVE-2024-6807 | Low | 2.4 | 2024-07-17 | A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0 and classified as problematic. Affected by this issue is some unkno… |
CVE-2024-39700 | Critical | 9.9 | 2024-07-16 | JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-in… |
CVE-2024-6655 | High | 7.0 | 2024-07-16 | A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working dire… |
CVE-2024-39915 | Critical | 9.9 | 2024-07-15 | Thruk is a multibackend monitoring webinterface for Naemon, Nagios, Icinga and Shinken using the Livestatus API. This authenticated RCE in Thruk allows authori… |
CVE-2024-36456 | | 2024-07-15 | This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgra… | |
CVE-2024-21513 | High | 8.5 | 2024-07-15 | Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the databas… |
CVE-2024-6345 | High | 8.8 | 2024-07-15 | A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functio… |
CVE-2024-40552 | High | 8.8 | 2024-07-12 | PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java. |
CVE-2024-40546 | High | 8.8 | 2024-07-12 | An arbitrary file upload vulnerability in the component /admin/cmsWebFile/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via upload… |
CVE-2024-40522 | High | 8.8 | 2024-07-12 | There is a remote code execution vulnerability in SeaCMS 12.9. The vulnerability is caused by phomebak.php writing some variable names passed in without filter… |
CVE-2024-40521 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is due to the fact that although admin_template.php imposes certain restrictions on th… |
CVE-2024-37405 | Medium | 6.5 | 2024-07-12 | Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken (pre-authentication) and livechat:loadHistory. |
CVE-2024-37149 | High | 7.2 | 2024-07-10 | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authentic… |
CVE-2024-25077 | Critical | 9.8 | 2024-07-10 | An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. The Nonce used for on-the-fly decryption of flash images is stored… |
CVE-2024-37770 | Critical | 9.1 | 2024-07-10 | 14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function. This vulnerability allows attackers to exec… |
CVE-2024-21832 | Low | 3.5 | 2024-07-09 | A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body. |
CVE-2024-39071 | Critical | 9.8 | 2024-07-09 | Fujian Kelixun <=7.6.6.4391 is vulnerable to SQL Injection in send_event.php. |
CVE-2024-40735 | Medium | 6.1 | 2024-07-09 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the N… |
CVE-2024-40726 | Medium | 6.1 | 2024-07-09 | A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the N… |
CVE-2024-6602 | Critical | 9.8 | 2024-07-09 | A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird <… |
CVE-2024-37934 | Medium | 5.4 | 2024-07-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: fro… |
CVE-2024-6365 | Critical | 9.8 | 2024-07-09 | The Product Table by WBW plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'saveCustomTitle' func… |
CVE-2024-22020 | Medium | 6.5 | 2024-07-09 | A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary co… |
CVE-2024-39864 | Critical | 9.8 | 2024-07-05 | The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configured and enabled via integration.api.port… |
CVE-2024-38346 | Critical | 9.8 | 2024-07-05 | The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack… |