CWE-94 · Code Injection (page 37)

Page 37 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.

All CVEs classified under CWE-94 — newest first (page 37 of 69)
CVESeverityScorePublishedSummary
CVE-2023-4994Critical9.92023-09-16The Allow PHP in Posts and Pages plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.0.4 via the 'php' shortcode. T…
CVE-2023-4977Medium5.42023-09-15 Code Injection in GitHub repository librenms/librenms prior to 23.9.0.
CVE-2023-41892Critical10.02023-09-13Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15…
CVE-2023-40621Medium6.32023-09-12SAP PowerDesigner Client - version 16.7, allows an unauthenticated attacker to inject VBScript code in a document and have it opened by an unsuspecting user, t…
CVE-2023-42471Critical9.82023-09-11The wave.ai.browser application through 1.0.35 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. It contains a ma…
CVE-2023-42470Critical9.82023-09-11The Imou Life com.mm.android.smartlifeiot application through 6.8.0 for Android allows Remote Code Execution via a crafted intent to an exported component. Thi…
CVE-2023-39320Critical9.82023-09-08The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" comman…
CVE-2023-39956Medium6.12023-09-06Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command lin…
CVE-2023-41319High8.82023-09-06Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of pri…
CVE-2023-38484High8.02023-09-06Vulnerabilities exist in the BIOS implementation of Aruba 9200 and 9000 Series Controllers and Gateways that could allow an attacker to execute arbitrary code…
CVE-2023-39681Critical9.82023-09-05Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php. This vulnerability…
CVE-2022-41763High8.82023-09-05An issue was discovered in NOKIA AMS 9.7.05. Remote Code Execution exists via the debugger of the ipAddress variable. A remote user, authenticated to the AMS s…
CVE-2023-4709Low3.12023-09-01A vulnerability classified as problematic has been found in TOTVS RM 12.1. Affected is an unknown function of the file Login.aspx of the component Portal. The…
CVE-2023-39631Critical9.82023-09-01An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.
CVE-2020-22612Critical9.82023-09-01Installer RCE on settings file write in MyBB before 1.8.22.
CVE-2023-39685High7.52023-09-01An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string.
CVE-2023-41362High7.22023-08-29MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of…
CVE-2023-41005High7.82023-08-28An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in UpdateController.php
CVE-2023-39059High8.82023-08-28An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter.
CVE-2023-40177Critical9.92023-08-23XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their…
CVE-2023-37427High7.22023-08-22A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to run arbitrary commands…
CVE-2023-37424High8.12023-08-22A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to run arbitrary comman…
CVE-2023-36281Critical9.82023-08-22An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to __subclasses__ or a templ…
CVE-2023-39660Critical9.82023-08-21An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function.
CVE-2023-31447Critical9.82023-08-21user_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (and on all versions of Vigor2925 devices) allows attackers to send a crafted payload to modify the…
CVE-2023-39445High8.82023-08-18Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an unauthenticated attacker to execute arbitrary code b…
CVE-2023-38576High8.02023-08-18Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an authenticated user to execute arbitrary OS commands…
CVE-2023-32626Critical9.82023-08-18Hidden functionality vulnerability in LAN-W300N/RS all versions, and LAN-W300N/PR5 all versions allows an unauthenticated attacker to log in to the product's c…
CVE-2023-40313High7.12023-08-17A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary…
CVE-2023-37914Critical9.92023-08-17XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can view `Invitation.WebHome` can execute…
CVE-2023-40252Medium6.02023-08-17Improper Control of Generation of Code ('Code Injection') vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Gen…
CVE-2023-20209Medium6.52023-08-16A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authent…
CVE-2023-38889Critical9.82023-08-15An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.g…
CVE-2023-38860Critical9.82023-08-15An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter.
CVE-2023-33469High7.82023-08-09In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1…
CVE-2023-36923High7.82023-08-08SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03, allows an attacker with local access to the system, to place a malicious library…
CVE-2023-36095Critical9.82023-08-05An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions inclu…
CVE-2023-38943High8.82023-08-05ShuiZe_0x727 v1.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /iniFile/config.ini.
CVE-2023-37470Critical10.02023-08-04Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3, 1.44.7.3, 1.45.4.3…
CVE-2023-4142High8.02023-08-04The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus1' parameter. Th…
CVE-2023-4141High8.02023-08-04The WP Ultimate CSV Importer plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 7.9.8 via the '->cus2' parameter. Th…
CVE-2023-36255High8.82023-08-03An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the UR…
CVE-2023-3401Medium4.82023-08-02An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 bef…
CVE-2023-34842Critical9.82023-07-31Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php.
CVE-2023-34644Critical9.82023-07-31Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S1930 series switches S…
CVE-2023-36542High8.82023-07-29Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authentica…
CVE-2023-39023Critical9.82023-07-28university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.DefaultExecutorManager…
CVE-2023-39022Critical9.82023-07-28oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerab…
CVE-2023-39021Critical9.82023-07-28wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vuln…
CVE-2023-39020Critical9.82023-07-28stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This v…
CVE-2023-39018Critical9.82023-07-28FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is e…
CVE-2023-39017Critical9.82023-07-28quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This…
CVE-2023-39016Critical9.82023-07-28bboss-persistent v6.0.9 and below was discovered to contain a code injection vulnerability in the component com.frameworkset.common.poolman.util.SQLManager.cre…
CVE-2023-39015Critical9.82023-07-28webmagic-extension v0.9.0 and below was discovered to contain a code injection vulnerability via the component us.codecraft.webmagic.downloader.PhantomJSDownlo…
CVE-2023-39013Critical9.82023-07-28Duke v1.2 and below was discovered to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init.
CVE-2023-39010Critical9.82023-07-28BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load. This vulnerability is exploite…
CVE-2023-32418High7.82023-07-27The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. Processing a file may lea…
CVE-2023-33229Low3.52023-07-26The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWin…
CVE-2023-3519Critical9.82023-07-19Unauthenticated remote code execution
CVE-2023-22506High8.82023-07-19This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center.   Th…
CVE-2023-34330High8.22023-07-18AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploi…
CVE-2021-37384Critical9.82023-07-17RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary comma…
CVE-2023-37466Critical9.82023-07-14vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project…
CVE-2023-37274High7.52023-07-13Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. When Auto-GPT is executed directly on the host sys…
CVE-2023-37273High8.12023-07-13Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. Running Auto-GPT version prior to 0.4.3 by cloning…
CVE-2022-42045Medium6.72023-07-13Certain Zemana products are vulnerable to Arbitrary code injection. This affects Watchdog Anti-Malware 4.1.422 and Zemana AntiMalware 3.2.28.
CVE-2023-37565High8.02023-07-13Code injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute arbitrary code by sending a specially c…
CVE-2023-38198Critical9.82023-07-13acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.
CVE-2023-37582Critical9.82023-07-12The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. W…
CVE-2023-37199Medium6.82023-07-12 A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE tamp…
CVE-2023-37198Medium6.82023-07-12 A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote code execution when an admin user on DCE…
CVE-2023-24492Critical9.62023-07-11 A vulnerability has been discovered in the Citrix Secure Access client for Ubuntu which, if exploited, could allow an attacker to remotely execute code if a v…
CVE-2023-35333High8.82023-07-11MediaWiki PandocUpload Extension Remote Code Execution Vulnerability
CVE-2023-33157High8.82023-07-11Microsoft SharePoint Remote Code Execution Vulnerability
CVE-2023-37659Critical9.82023-07-11xalpha v0.11.4 is vulnerable to Remote Command Execution (RCE).
CVE-2023-27869Medium6.32023-07-10IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the syste…
CVE-2023-27868Medium6.32023-07-10IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the syste…
CVE-2023-27867Medium6.32023-07-10IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Inj…
CVE-2023-3551High7.22023-07-08 Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVE-2023-36992High7.22023-07-07PHP injection in TravianZ 8.3.4 and 8.3.3 in the config editor in the admin page allows remote attackers to execute PHP code.
CVE-2023-36859High8.82023-07-06 PiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands.
CVE-2023-29382Critical9.82023-07-06An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component.
CVE-2023-30990High8.62023-07-04IBM i 7.2, 7.3, 7.4, and 7.5 could allow a remote attacker to execute CL commands as QUSER, caused by an exploitation of DDM architecture. IBM X-Force ID: 25…
CVE-2023-36258Critical9.82023-07-03An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used.
CVE-2023-33466High8.82023-06-29Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite arbitrary files on the file system, and in specific deployment sce…
CVE-2023-33570High8.82023-06-28Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).
CVE-2023-27866Medium6.32023-06-28IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver d…
CVE-2023-36467High8.02023-06-28AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do no…
CVE-2023-32528High8.82023-06-26Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code on affected instal…
CVE-2023-32527High8.82023-06-26Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code on affected instal…
CVE-2021-31635Critical9.82023-06-26Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.
CVE-2023-3393High7.22023-06-23 Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1.
CVE-2023-35152Critical9.92023-06-23XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous…
CVE-2023-35150Critical9.92023-06-23XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4…
CVE-2023-35926High8.02023-06-22Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by…
CVE-2020-20918High7.22023-06-20An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden parameter to admin.php when editing a page.
CVE-2023-26436High7.12023-06-20Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Acce…
CVE-2023-2359High8.82023-06-19The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escala…
CVE-2023-35853Critical9.82023-06-19In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling…
CVE-2023-35813Critical9.82023-06-17Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.