CWE-94 · Code Injection (page 33)
Page 33 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4181 | High | 8.8 | 2024-05-16 | A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect… |
CVE-2024-4202 | High | 7.7 | 2024-05-15 | In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiation vulnerability. |
CVE-2024-3892 | High | 7.2 | 2024-05-15 | A local code execution vulnerability is possible in Telerik UI for WinForms beginning in v2021.1.122 but prior to v2024.2.514. This vulnerability could allow a… |
CVE-2024-3319 | Critical | 9.1 | 2024-05-15 | An issue was identified in the Identity Security Cloud (ISC) Transform preview and IdentityProfile preview API endpoints that allowed an authenticated administ… |
CVE-2024-3044 | Medium | 6.5 | 2024-05-14 | Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execu… |
CVE-2024-4144 | Medium | 6.5 | 2024-05-14 | The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 20240502… |
CVE-2024-32352 | High | 8.8 | 2024-05-14 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecL2tpEnable" param… |
CVE-2024-32350 | High | 8.8 | 2024-05-14 | TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ipsecPsk" parameter in… |
CVE-2024-4605 | High | 8.8 | 2024-05-14 | The Breakdance plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.7.1 via post meta data. This is due to the p… |
CVE-2024-4039 | Medium | 6.5 | 2024-05-14 | The The Orders Tracking for WooCommerce plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including… |
CVE-2024-4038 | Medium | 6.5 | 2024-05-14 | The The Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in… |
CVE-2024-3788 | Medium | 6.6 | 2024-05-14 | Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through License (/admin/CDPUsers). Exploitation of… |
CVE-2024-3787 | Medium | 6.6 | 2024-05-14 | Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through S3 disks (/admin/DeviceS3). Exploitation of… |
CVE-2024-34225 | Medium | 6.1 | 2024-05-14 | Cross Site Scripting vulnerability in php-lms/admin/?page=system_info in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers t… |
CVE-2024-29513 | High | 7.8 | 2024-05-14 | An issue in briscKernelDriver.sys in BlueRiSC WindowsSCOPE Cyber Forensics before 3.3 allows a local attacker to execute arbitrary code within the driver and c… |
CVE-2024-27793 | High | 7.8 | 2024-05-14 | The issue was addressed with improved checks. This issue is fixed in iTunes 12.13.2 for Windows. Parsing a file may lead to an unexpected app termination or ar… |
CVE-2024-4135 | Medium | 5.4 | 2024-05-08 | The WP Latest Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the plugin… |
CVE-2024-29209 | Medium | 6.0 | 2024-05-07 | A medium severity vulnerability has been identified in the update mechanism of the Phish Alert Button for Outlook, which could allow an attacker to remotely ex… |
CVE-2024-30973 | High | 8.8 | 2024-05-06 | An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitive information via c… |
CVE-2024-33294 | Critical | 9.1 | 2024-05-06 | An issue in Library System using PHP/MySQli with Source Code V1.0 allows a remote attacker to execute arbitrary code via the _FAILE variable in the student_edi… |
CVE-2024-34461 | Critical | 9.8 | 2024-05-04 | Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a des… |
CVE-2023-35701 | Medium | 6.6 | 2024-05-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Hive. The vulnerability affects the Hive JDBC driver component and it can po… |
CVE-2023-39469 | High | 7.2 | 2024-05-03 | PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af… |
CVE-2024-33394 | Medium | 5.9 | 2024-05-02 | An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. |
CVE-2024-3957 | Medium | 6.5 | 2024-05-02 | The Booster for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 7.1.8. This allows unauthen… |
CVE-2024-3734 | Medium | 6.5 | 2024-05-02 | The FOX – Currency Switcher Professional for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including… |
CVE-2024-29309 | High | 7.7 | 2024-05-02 | An issue in Alfresco Content Services v.23.3.0.7 allows a remote attacker to execute arbitrary code via the Transfer Service. |
CVE-2024-3955 | Critical | 9.8 | 2024-05-02 | URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/http_endpoints/http_system.py" is subsequently passed to the "os.system" func… |
CVE-2024-33430 | High | 8.8 | 2024-05-01 | An issue in phiola/src/afilter/pcm_convert.h:513 of phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via the a crafted .wav file. |
CVE-2024-33442 | Medium | 4.3 | 2024-05-01 | An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add_post.php component. |
CVE-2024-28893 | High | 7.7 | 2024-05-01 | Certain HP software packages (SoftPaqs) are potentially vulnerable to arbitrary code execution when the SoftPaq configuration file has been modified after extr… |
CVE-2024-33443 | High | 7.1 | 2024-04-29 | An issue in onethink v.1.1 allows a remote attacker to execute arbitrary code via a crafted script to the AddonsController.class.php component. |
CVE-2024-31823 | High | 8.8 | 2024-04-29 | An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the remov… |
CVE-2024-31822 | Critical | 9.8 | 2024-04-29 | An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the saveL… |
CVE-2024-33445 | Critical | 9.8 | 2024-04-29 | An issue in hisiphp v2.0.111 allows a remote attacker to execute arbitrary code via a crafted script to the SystemPlugins::mkInfo parameter in the SystemPlugin… |
CVE-2024-32492 | High | 7.1 | 2024-04-29 | An issue was discovered in Znuny 7.0.1 through 7.0.16 where the ticket detail view in the customer front allows the execution of external JavaScript. |
CVE-2024-32491 | Critical | 9.8 | 2024-04-29 | An issue was discovered in Znuny and Znuny LTS 6.0.31 through 6.5.7 and Znuny 7.0.1 through 7.0.16 where a logged-in user can upload a file (via a manipulated… |
CVE-2024-31621 | High | 7.6 | 2024-04-29 | An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component. |
CVE-2024-32404 | Medium | 6.0 | 2024-04-26 | Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1, allows remote attackers to execute arbitrary code via a crafted payload… |
CVE-2024-22633 | Critical | 9.8 | 2024-04-26 | Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability via the hprinter par… |
CVE-2024-22632 | Critical | 9.8 | 2024-04-26 | Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability via the hmsg paramet… |
CVE-2024-32358 | High | 7.5 | 2024-04-25 | An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a different vulnerabi… |
CVE-2024-25624 | Medium | 6.8 | 2024-04-25 | Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Due to an improper setup of Jinja2 env… |
CVE-2024-31266 | Critical | 9.1 | 2024-04-25 | Improper Control of Generation of Code ('Code Injection') vulnerability in AlgolPlus Advanced Order Export For WooCommerce allows Code Injection.This issue aff… |
CVE-2024-22144 | Critical | 9.0 | 2024-04-25 | Improper Control of Generation of Code ('Code Injection') vulnerability in Eli Scheetz Anti-Malware Security and Brute-Force Firewall gotmls allows Code Inject… |
CVE-2024-20359 | Medium | 6.0 | 2024-04-24 | A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appli… |
CVE-2024-21511 | Critical | 9.8 | 2024-04-23 | Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFo… |
CVE-2024-4040 | Critical | 9.8 | 2024-04-22 | A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to… |
CVE-2024-31666 | Critical | 9.8 | 2024-04-22 | An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the edit_addon_post.php component. |
CVE-2024-28699 | High | 7.8 | 2024-04-22 | A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev func… |
CVE-2024-29991 | Medium | 5.0 | 2024-04-19 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2023-51797 | Medium | 6.7 | 2024-04-19 | Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showwaves.c:722:24 in s… |
CVE-2023-50260 | High | 8.8 | 2024-04-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. A wrong validation in the `host_deny` script allows to write any… |
CVE-2024-30923 | Critical | 9.8 | 2024-04-18 | SQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer Document Rendering |
CVE-2024-32599 | Critical | 10.0 | 2024-04-18 | Improper Control of Generation of Code ('Code Injection') vulnerability in Deepak anand WP Dummy Content Generator wp-dummy-content-generator.This issue affect… |
CVE-2024-3931 | Low | 3.5 | 2024-04-18 | A vulnerability was found in Totara LMS up to 18.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin/ro… |
CVE-2024-3660 | Critical | 9.8 | 2024-04-16 | A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the ap… |
CVE-2024-30567 | Medium | 6.3 | 2024-04-16 | An issue in JNT Telecom JNT Liftcom UMS V1.J Core Version JM-V15 allows a remote attacker to execute arbitrary code via the Network Troubleshooting functionali… |
CVE-2024-31648 | Medium | 6.1 | 2024-04-15 | Cross Site Scripting (XSS) in Insurance Management System v1.0, allows remote attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2024-3786 | Medium | 6.6 | 2024-04-15 | Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through Device Synchronizations (/admin/DeviceRepli… |
CVE-2024-3785 | Medium | 6.6 | 2024-04-15 | Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through Device NAS shared section (/admin/DeviceNAS… |
CVE-2024-3784 | Medium | 6.6 | 2024-04-15 | Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through S3 Accounts (/admin/CloudAccounts). Exploit… |
CVE-2023-6494 | Medium | 4.4 | 2024-04-13 | The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includ… |
CVE-2024-30845 | Medium | 6.1 | 2024-04-12 | Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the validation component… |
CVE-2023-44857 | High | 8.1 | 2024-04-12 | An issue in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the sub_21D24 function in the acu_web c… |
CVE-2023-44853 | Medium | 4.8 | 2024-04-12 | \An issue was discovered in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the sub_219C4 function… |
CVE-2024-25376 | High | 7.8 | 2024-04-11 | An issue discovered in Thesycon Software Solutions Gmbh & Co. KG TUSBAudio MSI-based installers before 5.68.0 allows a local attacker to execute arbitrary code… |
CVE-2024-22722 | High | 7.2 | 2024-04-11 | Server Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms… |
CVE-2024-29399 | High | 7.6 | 2024-04-11 | An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the u… |
CVE-2024-30878 | Medium | 6.1 | 2024-04-11 | A cross-site scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML and obtain sensitive informa… |
CVE-2024-21508 | Critical | 9.8 | 2024-04-11 | Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the suppor… |
CVE-2024-29937 | Critical | 9.8 | 2024-04-11 | NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug tha… |
CVE-2024-31996 | Critical | 10.0 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, the HTML escaping of escaping tool… |
CVE-2024-26362 | High | 8.8 | 2024-04-10 | HTML injection vulnerability in Enpass Password Manager Desktop Client 6.9.2 for Windows and Linux allows attackers to run arbitrary HTML code via creation of… |
CVE-2024-31984 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a sp… |
CVE-2024-31982 | Critical | 10.0 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search a… |
CVE-2024-31819 | Critical | 9.8 | 2024-04-10 | An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php compon… |
CVE-2024-31465 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any… |
CVE-2024-29500 | Critical | 9.8 | 2024-04-10 | An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce applicatio… |
CVE-2024-3098 | Critical | 9.8 | 2024-04-10 | A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt inject… |
CVE-2024-2195 | Critical | 9.8 | 2024-04-10 | A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affe… |
CVE-2024-27476 | Medium | 4.7 | 2024-04-10 | Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. |
CVE-2024-31864 | Critical | 9.8 | 2024-04-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code… |
CVE-2023-47542 | Medium | 6.7 | 2024-04-09 | A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0… |
CVE-2023-45590 | Critical | 9.6 | 2024-04-09 | An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows at… |
CVE-2024-31807 | Critical | 9.8 | 2024-04-08 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the hostTime parameter in the NTPSyncWithHost f… |
CVE-2024-31022 | Critical | 9.8 | 2024-04-08 | An issue was discovered in CandyCMS version 1.0.0, allows remote attackers to execute arbitrary code via the install.php component. |
CVE-2024-25706 | Medium | 6.1 | 2024-04-04 | There is an HTML injection vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL which, when… |
CVE-2023-36645 | Critical | 9.1 | 2024-04-04 | SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function. |
CVE-2024-30565 | High | 8.8 | 2024-04-04 | An issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php. |
CVE-2024-27705 | High | 7.6 | 2024-04-03 | Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the files/browse endpoint. |
CVE-2024-30568 | Critical | 9.8 | 2024-04-03 | Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the c4-IPAddr parameter. |
CVE-2024-25096 | Critical | 10.0 | 2024-04-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3… |
CVE-2024-24707 | Critical | 9.9 | 2024-04-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in Cwicly Builder, SL. Cwicly allows Code Injection.This issue affects Cwicly: from n/a… |
CVE-2024-31390 | Critical | 9.9 | 2024-04-03 | : Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Breakdance allows : Code Injection.This issue affects Breakdance: from n/a… |
CVE-2024-31380 | Critical | 9.9 | 2024-04-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Oxygen Builder allows Code Injection. Vendor is ignoring report, refuses to p… |
CVE-2024-29477 | High | 8.8 | 2024-04-03 | Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arb… |
CVE-2024-27972 | Critical | 9.9 | 2024-04-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite.This issue affects WP Fusion Lite: from n/… |
CVE-2024-27191 | High | 8.5 | 2024-04-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Slivery Extender slivery-extender allows Remote Code Inclusion.This issu… |
CVE-2024-25918 | Critical | 9.9 | 2024-04-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a… |