CWE-94 · Code Injection (page 32)
Page 32 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39932 | Critical | 9.9 | 2024-07-04 | Gogs through 0.13.0 allows argument injection during the previewing of changes. |
CVE-2024-39165 | Critical | 9.8 | 2024-07-04 | QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary code via a PHP payload in the data paramet… |
CVE-2024-6507 | High | 8.1 | 2024-07-04 | Command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the ingest_kaggle() API |
CVE-2024-33871 | High | 8.8 | 2024-07-03 | An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable… |
CVE-2024-39844 | Critical | 9.8 | 2024-07-03 | In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK. |
CVE-2024-25086 | High | 7.8 | 2024-07-02 | Improper privilege management in Jungo WinDriver before 12.2.0 allows local attackers to escalate privileges and execute arbitrary code. |
CVE-2024-39236 | Critical | 9.8 | 2024-07-01 | Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a craf… |
CVE-2024-36401 | Critical | 9.8 | 2024-07-01 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC requ… |
CVE-2024-6376 | High | 7.0 | 2024-07-01 | MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connectio… |
CVE-2024-39017 | Critical | 9.8 | 2024-07-01 | agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents. This vulnerability allows attackers to execute… |
CVE-2024-39015 | Critical | 9.8 | 2024-07-01 | cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. This vulnerability allows attackers to execute arbitrary code… |
CVE-2024-39002 | Medium | 6.3 | 2024-07-01 | rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function util.clone. This vulnerability allows attackers to execute arbitr… |
CVE-2024-38993 | Critical | 9.8 | 2024-07-01 | rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary c… |
CVE-2024-38990 | Medium | 6.3 | 2024-07-01 | Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. This vulnerability allows attackers to execute arbitrary c… |
CVE-2024-3995 | | 2024-06-28 | In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins. | |
CVE-2024-39209 | Medium | 6.3 | 2024-06-27 | luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter. |
CVE-2024-36075 | Medium | 6.5 | 2024-06-27 | The CoSoSys Endpoint Protector through 5.9.3 and Unify agent through 7.0.6 is susceptible to an arbitrary code execution vulnerability due to the way an archiv… |
CVE-2024-36074 | High | 7.2 | 2024-06-27 | Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the Endpoint Protector and Un… |
CVE-2024-5979 | High | 7.5 | 2024-06-27 | In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be… |
CVE-2024-5826 | Critical | 9.8 | 2024-06-27 | In the latest version of vanna-ai/vanna, the `vanna.ask` function is vulnerable to remote code execution due to prompt injection. The root cause is the lack of… |
CVE-2024-5751 | Critical | 9.8 | 2024-06-27 | BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulnerability exists in the `add_deployment`… |
CVE-2024-39669 | Critical | 9.8 | 2024-06-27 | In the Console in Soffid IAM before 3.5.39, necessary checks were not applied to some Java objects. A malicious agent could possibly execute arbitrary code in… |
CVE-2023-26877 | Medium | 6.3 | 2024-06-26 | File upload vulnerability found in Softexpert Excellence Suite v.2.1 allows attackers to execute arbitrary code via a .php file upload to the form/efms_exec_ht… |
CVE-2024-6344 | Low | 2.4 | 2024-06-26 | A vulnerability, which was classified as problematic, was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. This affects an unknown part of the component Push Conf… |
CVE-2024-37855 | High | 8.4 | 2024-06-25 | An issue in Nepstech Wifi Router xpon (terminal) NTPL-Xpon1GFEVN, hardware verstion 1.0 firmware 2.0.1 allows a remote attacker to execute arbitrary code via t… |
CVE-2024-6206 | High | 7.5 | 2024-06-25 | A security vulnerability has been identified in HPE Athonet Mobile Core software. The core application contains a code injection vulnerability where a threat a… |
CVE-2024-4884 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The Apm.UI.Areas.APM.Contro… |
CVE-2024-4883 | Critical | 9.8 | 2024-06-25 | In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated… |
CVE-2023-50029 | Critical | 10.0 | 2024-06-24 | PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary co… |
CVE-2024-37109 | Critical | 9.9 | 2024-06-24 | Improper Control of Generation of Code ('Code Injection') vulnerability in Membership Software WishList Member X allows Code Injection.This issue affects WishL… |
CVE-2024-5683 | Critical | 9.8 | 2024-06-24 | Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Remote Code In… |
CVE-2024-3121 | Low | 3.3 | 2024-06-24 | A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from t… |
CVE-2024-39331 | Critical | 9.8 | 2024-06-23 | In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-str… |
CVE-2024-38319 | High | 7.5 | 2024-06-22 | IBM Security SOAR 51.0.2.0 could allow an authenticated user to execute malicious code loaded from a specially crafted script. IBM X-Force ID: 294830. |
CVE-2023-45673 | High | 8.9 | 2024-06-21 | Joplin is a free, open source note taking and to-do application. A remote code execution (RCE) vulnerability in affected versions allows clicking on a link in… |
CVE-2024-37899 | Critical | 9.0 | 2024-06-20 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user's prof… |
CVE-2024-33335 | Medium | 6.3 | 2024-06-20 | SQL Injection vulnerability in H3C technology company SeaSQL DWS V2.0 allows a remote attacker to execute arbitrary code via a crafted file. |
CVE-2024-28397 | Medium | 5.3 | 2024-06-20 | An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call. |
CVE-2024-3562 | High | 8.8 | 2024-06-20 | The Custom Field Suite plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.6.7 via the Loop custom field. This is… |
CVE-2024-36679 | Critical | 10.0 | 2024-06-19 | In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection. Due to a predictable token, the meth… |
CVE-2024-32030 | High | 8.1 | 2024-06-19 | Kafka UI is an Open-Source Web UI for Apache Kafka Management. Kafka UI API allows users to connect to different Kafka brokers by specifying their network addr… |
CVE-2024-37124 | Critical | 9.8 | 2024-06-19 | Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client. If this vulnerability is exploited, an attacker may create an arbitrary fi… |
CVE-2024-37821 | High | 8.8 | 2024-06-18 | An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploadi… |
CVE-2024-36575 | Critical | 9.8 | 2024-06-17 | A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor. |
CVE-2024-36581 | High | 7.6 | 2024-06-17 | A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm. |
CVE-2024-38396 | Critical | 9.8 | 2024-06-16 | An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux inte… |
CVE-2024-38458 | High | 8.8 | 2024-06-16 | Xenforo before 2.2.16 allows code injection. |
CVE-2024-38448 | Critical | 9.1 | 2024-06-16 | htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used. |
CVE-2024-38395 | Critical | 9.8 | 2024-06-16 | In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploit… |
CVE-2024-6006 | Low | 3.5 | 2024-06-15 | A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the… |
CVE-2024-6005 | Low | 3.5 | 2024-06-15 | A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionali… |
CVE-2024-3105 | Critical | 9.9 | 2024-06-15 | The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includi… |
CVE-2024-36598 | High | 8.1 | 2024-06-14 | An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted image file. |
CVE-2024-37885 | Low | 3.8 | 2024-06-14 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS al… |
CVE-2024-32925 | High | 8.8 | 2024-06-13 | In dhd_prot_txstatus_process of dhd_msgbuf.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution w… |
CVE-2024-37849 | Critical | 9.8 | 2024-06-13 | A SQL Injection vulnerability in itsourcecode Billing System 1.0 allows a local attacker to execute arbitrary code in process.php via the username parameter. |
CVE-2024-1577 | Critical | 9.8 | 2024-06-12 | Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by th… |
CVE-2024-5834 | High | 8.8 | 2024-06-11 | Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chro… |
CVE-2024-34405 | Critical | 9.1 | 2024-06-11 | Improper deep link validation in McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to launch an arbitrary URL within the app. |
CVE-2024-27857 | High | 7.8 | 2024-06-10 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visio… |
CVE-2024-37014 | Critical | 9.8 | 2024-06-10 | Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python scr… |
CVE-2022-32897 | High | 7.8 | 2024-06-10 | A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.5. Processing a maliciously crafted tiff file may le… |
CVE-2024-34761 | High | 8.5 | 2024-06-10 | Vulnerability discovered by executing a planned security audit. Improper Control of Generation of Code ('Code Injection') vulnerability in WPENGINE INC Advanc… |
CVE-2024-36531 | Medium | 5.7 | 2024-06-10 | nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.php component. |
CVE-2024-3408 | Critical | 9.8 | 2024-06-06 | man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability ar… |
CVE-2024-4889 | High | 7.2 | 2024-06-06 | A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the s… |
CVE-2024-4194 | Medium | 6.5 | 2024-06-06 | The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. Th… |
CVE-2024-37273 | Critical | 9.8 | 2024-06-04 | An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafte… |
CVE-2024-25600 | Critical | 10.0 | 2024-06-04 | Improper Control of Generation of Code ('Code Injection') vulnerability in Codeer Limited Bricks Builder allows Code Injection.This issue affects Bricks Builde… |
CVE-2024-37061 | High | 8.8 | 2024-06-04 | Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitra… |
CVE-2024-36568 | Critical | 9.8 | 2024-06-03 | Sourcecodester Gas Agency Management System v1.0 is vulnerable to SQL Injection via /gasmark/editbrand.php?id=. |
CVE-2024-36120 | High | 8.1 | 2024-05-31 | javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to… |
CVE-2024-5565 | High | 8.1 | 2024-05-31 | The Vanna library uses a prompt function to present the user with visualized results, it is possible to alter the prompt using prompt injection and run arbitra… |
CVE-2024-23692 | Critical | 9.8 | 2024-05-31 | Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenti… |
CVE-2024-3924 | Medium | 4.4 | 2024-05-30 | A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the `autodocs.yml` workflow file. The vulner… |
CVE-2023-6743 | High | 8.8 | 2024-05-29 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and i… |
CVE-2024-35226 | High | 7.3 | 2024-05-28 | Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could… |
CVE-2024-35581 | Medium | 6.1 | 2024-05-28 | A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2024-23601 | Critical | 9.8 | 2024-05-28 | A code injection vulnerability exists in the scan_lib.bin functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted scan_lib.bin can lead to arbi… |
CVE-2024-28886 | High | 8.4 | 2024-05-28 | OS command injection vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product opens a crafted UTAU project file (.ust file), an arbitra… |
CVE-2024-5407 | Critical | 10.0 | 2024-05-27 | A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm. This vulnerability could allow a remote… |
CVE-2024-35339 | Critical | 9.8 | 2024-05-24 | Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac. |
CVE-2024-4037 | Medium | 6.5 | 2024-05-24 | The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.7.02.003. This is due to th… |
CVE-2024-36361 | Medium | 6.8 | 2024-05-24 | Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or co… |
CVE-2024-0867 | High | 8.1 | 2024-05-24 | The Email Log plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 2.4.8 via the check_nonce function. Th… |
CVE-2024-4662 | High | 8.8 | 2024-05-23 | The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata. This is due to th… |
CVE-2024-33228 | High | 8.4 | 2024-05-22 | An issue in the component segwindrvx64.sys of Insyde Software Corp SEG Windows Driver v100.00.07.02 allows attackers to escalate privileges and execute arbitra… |
CVE-2024-33225 | High | 7.8 | 2024-05-22 | An issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtek(r) High Definition Audio Function Driver v6.0.9549.1 allows attackers to escalate… |
CVE-2024-4261 | Medium | 5.4 | 2024-05-22 | The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-31396 | Medium | 6.6 | 2024-05-22 | Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vuln… |
CVE-2024-21683 | High | 8.8 | 2024-05-21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code Executi… |
CVE-2024-22274 | High | 7.2 | 2024-05-21 | The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative privileges on the vCenter appliance she… |
CVE-2024-24294 | Critical | 9.8 | 2024-05-20 | A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the _utils.setDeepProperty function of en… |
CVE-2024-36078 | Medium | 6.7 | 2024-05-19 | In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. This allowed a local attacker on the server to modify t… |
CVE-2024-4264 | Critical | 9.8 | 2024-05-18 | A remote code execution (RCE) vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the `eval` funct… |
CVE-2024-31974 | Medium | 6.3 | 2024-05-17 | The com.solarized.firedown (aka Solarized FireDown Browser & Downloader) application 1.0.76 for Android allows a remote attacker to execute arbitrary JavaScrip… |
CVE-2024-33644 | Critical | 9.9 | 2024-05-17 | Improper Control of Generation of Code ('Code Injection') vulnerability in WPCustomify Customify Site Library allows Code Injection.This issue affects Customif… |
CVE-2024-32680 | High | 8.8 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Plug… |
CVE-2023-23645 | Critical | 9.9 | 2024-05-17 | Improper Control of Generation of Code ('Code Injection') vulnerability in MainWP MainWP Code Snippets Extension allows Code Injection.This issue affects MainW… |
CVE-2023-48643 | Critical | 9.8 | 2024-05-16 | Shrubbery tac_plus 2.x, 3.x. and 4.x through F4.0.4.28 allows unauthenticated Remote Command Execution. The product allows users to configure authorization che… |