CWE-94 · Code Injection (page 38)
Page 38 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-35809 | High | 8.8 | 2023-06-17 | An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By… |
CVE-2023-34448 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav lev… |
CVE-2023-34253 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being exec… |
CVE-2023-34252 | High | 8.8 | 2023-06-14 | Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation… |
CVE-2023-34251 | Critical | 9.9 | 2023-06-14 | Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by… |
CVE-2023-1049 | High | 7.8 | 2023-06-14 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause execution of malicious code when an unsuspicious use… |
CVE-2023-33131 | High | 8.8 | 2023-06-14 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2023-21569 | Medium | 5.5 | 2023-06-14 | Azure DevOps Server Spoofing Vulnerability |
CVE-2023-3224 | Critical | 9.8 | 2023-06-13 | Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3. |
CVE-2023-30179 | High | 7.2 | 2023-06-13 | CraftCMS version 3.7.59 is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field… |
CVE-2023-32546 | Medium | 4.4 | 2023-06-13 | Code injection vulnerability exists in Chatwork Desktop Application (Mac) 2.6.43 and earlier. If this vulnerability is exploited, a non-administrative user of… |
CVE-2023-25910 | Critical | 10.0 | 2023-06-13 | A vulnerability has been identified in SIMATIC PCS 7 (All versions < V9.1 SP2 UC04), SIMATIC S7-PM (All versions < V5.7 SP1 HF1), SIMATIC S7-PM (All versions <… |
CVE-2023-34468 | High | 8.8 | 2023-06-12 | The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configu… |
CVE-2023-35034 | Critical | 9.8 | 2023-06-12 | Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow remote code execution… |
CVE-2019-16283 | High | 7.8 | 2023-06-09 | A potential security vulnerability has been identified with a version of the HP Softpaq installer that can lead to arbitrary code execution. |
CVE-2023-34112 | Medium | 4.3 | 2023-06-09 | JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the `bytedeco/javacpp-presets` use the `github.event.head… |
CVE-2023-29404 | Critical | 9.8 | 2023-06-08 | The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other c… |
CVE-2023-29402 | Critical | 9.8 | 2023-06-08 | The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This… |
CVE-2023-34237 | High | 8.1 | 2023-06-07 | SABnzbd is an open source automated Usenet download tool. A design flaw was discovered in SABnzbd that could allow remote code execution. Manipulating the Para… |
CVE-2020-36708 | Critical | 9.8 | 2023-06-07 | The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0… |
CVE-2023-32540 | High | 7.2 | 2023-06-06 | In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the o… |
CVE-2023-33733 | High | 7.8 | 2023-06-05 | Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file. |
CVE-2023-27744 | High | 7.8 | 2023-06-02 | An issue was discovered in South River Technologies TitanFTP NextGen server that allows for a vertical privilege escalation leading to remote code execution. |
CVE-2022-35743 | High | 7.8 | 2023-05-31 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability |
CVE-2023-25539 | High | 8.4 | 2023-05-31 | Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could potentially exploit t… |
CVE-2023-32692 | Critical | 9.8 | 2023-05-30 | CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerab… |
CVE-2023-2943 | High | 8.8 | 2023-05-27 | Code Injection in GitHub repository openemr/openemr prior to 7.0.1. |
CVE-2023-2928 | Medium | 6.3 | 2023-05-27 | A vulnerability was found in DedeCMS up to 5.7.106. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file up… |
CVE-2023-33440 | High | 7.2 | 2023-05-26 | Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user. |
CVE-2023-30145 | Critical | 9.8 | 2023-05-26 | Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter. |
CVE-2023-33246 | Critical | 9.8 | 2023-05-24 | For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameS… |
CVE-2023-2859 | High | 8.8 | 2023-05-24 | Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9. |
CVE-2023-32697 | High | 8.8 | 2023-05-23 | SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. Th… |
CVE-2023-25953 | Critical | 9.8 | 2023-05-23 | Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the affected product i… |
CVE-2023-29861 | Critical | 9.8 | 2023-05-15 | An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the management page of the devic… |
CVE-2023-29862 | Critical | 9.8 | 2023-05-15 | An issue found in Agasio-Camera device version not specified allows a remote attacker to execute arbitrary code via the check and authLevel parameters. |
CVE-2022-47879 | High | 7.5 | 2023-05-12 | A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the 'rtn' dir… |
CVE-2023-30130 | High | 8.8 | 2023-05-12 | An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter. |
CVE-2023-29400 | High | 7.3 | 2023-05-11 | Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed… |
CVE-2023-24539 | High | 7.3 | 2023-05-11 | Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character… |
CVE-2022-47129 | Critical | 9.8 | 2023-05-11 | PHPOK v6.3 was discovered to contain a remote code execution (RCE) vulnerability. |
CVE-2023-24955 | High | 7.2 | 2023-05-09 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2023-2583 | Critical | 10.0 | 2023-05-08 | Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3. |
CVE-2023-29963 | High | 7.2 | 2023-05-05 | S-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php. |
CVE-2023-31415 | High | 8.8 | 2023-05-04 | Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will… |
CVE-2023-31414 | High | 8.8 | 2023-05-04 | Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. An attacker with write access to Kibana yaml or env configuration could add a spe… |
CVE-2023-1178 | Medium | 5.7 | 2023-05-03 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions start… |
CVE-2023-26546 | High | 8.8 | 2023-05-02 | European Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Side Template Injection (SSTI) with a cra… |
CVE-2023-26782 | Medium | 6.5 | 2023-04-28 | An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache Configur… |
CVE-2023-30349 | Critical | 9.8 | 2023-04-27 | JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function. |
CVE-2023-30404 | Critical | 9.8 | 2023-04-26 | Aigital Wireless-N Repeater Mini_Router v0.131229 was discovered to contain a remote code execution (RCE) vulnerability via the sysCmd parameter in the formSys… |
CVE-2023-2259 | High | 7.2 | 2023-04-24 | Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304. |
CVE-2023-29566 | Critical | 9.8 | 2023-04-24 | huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_proces… |
CVE-2023-26060 | Medium | 6.8 | 2023-04-24 | An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that has a client-side te… |
CVE-2022-36963 | High | 7.2 | 2023-04-21 | The SolarWinds Platform was susceptible to the Command Injection Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform a… |
CVE-2023-25550 | High | 7.2 | 2023-04-18 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows remote code execution via the “hostname” paramete… |
CVE-2023-25549 | High | 7.2 | 2023-04-18 | A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows for remote code execution when using a parameter of… |
CVE-2023-2017 | High | 8.8 | 2023-04-17 | Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub rep… |
CVE-2023-30537 | Critical | 9.9 | 2023-04-16 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with the right to add an object on a page can… |
CVE-2023-29509 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents can execute… |
CVE-2023-29214 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Veloc… |
CVE-2023-29212 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Veloc… |
CVE-2023-29211 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrar… |
CVE-2020-29007 | Critical | 9.8 | 2023-04-15 | The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond executable. This allow… |
CVE-2023-29210 | Critical | 9.9 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including th… |
CVE-2023-29209 | Critical | 9.9 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including th… |
CVE-2023-2056 | Medium | 6.3 | 2023-04-14 | A vulnerability was found in DedeCMS up to 5.7.87 and classified as critical. This issue affects the function GetSystemFile of the file module_main.php. The ma… |
CVE-2023-30638 | High | 7.2 | 2023-04-14 | Atos Unify OpenScape SBC 10 before 10R3.1.3, OpenScape Branch 10 before 10R3.1.2, and OpenScape BCF 10 before 10R10.7.0 allow remote authenticated admins to in… |
CVE-2023-29492 | Critical | 9.8 | 2023-04-11 | Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide acces… |
CVE-2023-27897 | Medium | 6.0 | 2023-04-11 | In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can… |
CVE-2023-27650 | Critical | 9.8 | 2023-04-10 | An issue found in APUS Group Launcher v.3.10.73 and v.3.10.88 allows a remote attacker to execute arbitrary code via the FONT_FILE parameter. |
CVE-2023-1947 | Medium | 6.3 | 2023-04-07 | A vulnerability was found in taoCMS 3.0.2. It has been classified as critical. Affected is an unknown function of the file /admin/admin.php. The manipulation l… |
CVE-2023-28706 | Critical | 9.8 | 2023-04-07 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Ai… |
CVE-2023-26817 | High | 8.8 | 2023-04-07 | codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution (RCE) vulnerability via the component /controllers/api/user.php. |
CVE-2023-24538 | Critical | 9.8 | 2023-04-06 | Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS tem… |
CVE-2023-1708 | Medium | 5.7 | 2023-04-05 | An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable c… |
CVE-2023-27770 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Edraw-max v.12.0.4 allows a remote attacker to execute arbitrary commands via the edraw-max_setup_full5371.exe… |
CVE-2022-43938 | High | 8.8 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable script… |
CVE-2022-3960 | Medium | 6.3 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable script… |
CVE-2022-43769 | High | 8.8 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values whic… |
CVE-2023-26119 | Critical | 9.8 | 2023-04-03 | Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the att… |
CVE-2023-1773 | Medium | 6.3 | 2023-03-31 | A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the compo… |
CVE-2023-25261 | Critical | 9.8 | 2023-03-27 | Certain Stimulsoft GmbH products are affected by: Remote Code Execution. This affects Stimulsoft Designer (Desktop) 2023.1.4 and Stimulsoft Designer (Web) 2023… |
CVE-2023-24835 | High | 7.2 | 2023-03-27 | Softnext Technologies Corp.’s SPAM SQR has a vulnerability of Code Injection within its specific function. An authenticated remote attacker with administrator… |
CVE-2022-38745 | High | 7.8 | 2023-03-24 | Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the curr… |
CVE-2023-28333 | Critical | 9.8 | 2023-03-23 | The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anyw… |
CVE-2023-24709 | High | 7.5 | 2023-03-21 | An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters. |
CVE-2023-1306 | High | 8.8 | 2023-03-21 | An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code exe… |
CVE-2023-1304 | High | 8.8 | 2023-03-21 | An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expe… |
CVE-2023-1250 | High | 7.4 | 2023-03-20 | Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When cr… |
CVE-2023-1482 | Medium | 4.7 | 2023-03-18 | A vulnerability, which was classified as problematic, was found in HkCms 2.2.4.230206. This affects an unknown part of the file /admin.php/appcenter/local.html… |
CVE-2023-0598 | High | 7.8 | 2023-03-16 | GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to… |
CVE-2023-24795 | Critical | 9.8 | 2023-03-16 | Command execution vulnerability was discovered in JHR-N916R router firmware version<=21.11.1.1483. |
CVE-2023-25344 | Critical | 9.8 | 2023-03-15 | An issue was discovered in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to execute arbitrary code via crafted Object.prototype anonymous fun… |
CVE-2023-27893 | High | 8.8 | 2023-03-14 | An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems… |
CVE-2023-1367 | Low | 3.8 | 2023-03-13 | Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-0888 | Medium | 4.9 | 2023-03-13 | An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 ca… |
CVE-2023-1287 | Critical | 9.0 | 2023-03-09 | An XSL template vulnerability in ENOVIA Live Collaboration V6R2013xE allows Remote Code Execution. |
CVE-2023-27986 | High | 7.8 | 2023-03-09 | emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote chara… |
CVE-2023-1283 | Critical | 10.0 | 2023-03-08 | Code Injection in GitHub repository builderio/qwik prior to 0.21.0. |