CWE-94 · Code Injection (page 39)
Page 39 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-22889 | Critical | 9.8 | 2023-03-08 | SmartBear Zephyr Enterprise through 7.15.0 mishandles user-defined input during report generation. This could lead to remote code execution by unauthenticated… |
CVE-2023-0090 | Critical | 9.8 | 2023-03-08 | The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval in… |
CVE-2023-0089 | High | 8.8 | 2023-03-08 | The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval inje… |
CVE-2023-1003 | Medium | 5.3 | 2023-03-07 | A vulnerability, which was classified as critical, was found in Typora up to 1.5.5 on Windows. Affected is an unknown function of the component WSH JScript Han… |
CVE-2021-36394 | Critical | 9.8 | 2023-03-06 | In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. |
CVE-2023-24776 | Critical | 9.8 | 2023-03-06 | Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addon.php. |
CVE-2023-26107 | Medium | 6.9 | 2023-03-06 | All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concat… |
CVE-2022-45553 | Critical | 9.8 | 2023-03-03 | An issue discovered in Shenzhen Zhibotong Electronics WBT WE1626 Router v 21.06.18 allows attacker to execute arbitrary commands via serial connection to the U… |
CVE-2023-22381 | Medium | 4.1 | 2023-03-02 | A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single environment variab… |
CVE-2023-26477 | Critical | 10.0 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and… |
CVE-2023-1097 | Critical | 9.3 | 2023-03-01 | Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are exe… |
CVE-2023-23496 | High | 8.8 | 2023-02-27 | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.2, watchOS 9.3, iOS 15.7.2 and iPadOS 15.7.2, Safari 16.3, tvOS 16.3, iOS… |
CVE-2023-1030 | Low | 3.5 | 2023-02-24 | A vulnerability has been found in SourceCodester/code-projects Online Boat Reservation System 1.0 and classified as problematic. Affected by this vulnerability… |
CVE-2023-1005 | Medium | 5.3 | 2023-02-24 | A vulnerability was found in JP1016 Markdown-Electron and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads… |
CVE-2023-1004 | Medium | 5.3 | 2023-02-24 | A vulnerability has been found in MarkText up to 0.17.1 on Windows and classified as critical. Affected by this vulnerability is an unknown functionality of th… |
CVE-2023-24114 | Critical | 9.8 | 2023-02-22 | typecho 1.1/17.10.30 was discovered to contain a remote code execution (RCE) vulnerability via install.php. |
CVE-2023-24107 | Critical | 9.8 | 2023-02-22 | hour_of_code_python_2015 commit 520929797b9ca43bb818b2e8f963fb2025459fa3 was discovered to contain a code execution backdoor via the request package (requireme… |
CVE-2023-25657 | High | 7.5 | 2023-02-21 | Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions earlier than 1.5.7 are impacted by a remote code executio… |
CVE-2022-46836 | Critical | 9.1 | 2023-02-20 | PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker to in… |
CVE-2021-26277 | Medium | 5.6 | 2023-02-17 | The framework service handles pendingIntent incorrectly, allowing a malicious application with certain privileges to perform privileged actions. |
CVE-2021-33949 | Critical | 9.8 | 2023-02-17 | An issue in FeMiner WMS v1.1 allows attackers to execute arbitrary code via the filename parameter and the exec function. |
CVE-2023-24078 | High | 8.8 | 2023-02-17 | Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cmsdocs/. |
CVE-2023-0877 | High | 8.8 | 2023-02-17 | Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11. |
CVE-2023-22855 | Critical | 9.8 | 2023-02-15 | Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 8088. A user-controllable path is handed t… |
CVE-2023-21553 | High | 7.5 | 2023-02-14 | Azure DevOps Server Remote Code Execution Vulnerability |
CVE-2023-25717 | Critical | 9.8 | 2023-02-13 | Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=adm… |
CVE-2023-23551 | Critical | 9.1 | 2023-02-13 | Control By Web X-600M devices run Lua scripts and are vulnerable to code injection, which could allow an attacker to remotely execute arbitrary code. |
CVE-2023-0792 | Medium | 6.5 | 2023-02-12 | Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0788 | High | 8.1 | 2023-02-12 | Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2022-45699 | Critical | 9.8 | 2023-02-10 | Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as roo… |
CVE-2023-23912 | High | 8.8 | 2023-02-09 | A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix… |
CVE-2023-0575 | High | 7.2 | 2023-02-09 | External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linu… |
CVE-2023-0671 | High | 8.8 | 2023-02-04 | Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10. |
CVE-2023-24576 | High | 7.5 | 2023-02-03 | EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the NetWorker Client execution service (nsrexecd) i… |
CVE-2023-23477 | High | 8.1 | 2023-02-03 | IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequenc… |
CVE-2021-36424 | Critical | 9.8 | 2023-02-03 | An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation. |
CVE-2022-48093 | High | 7.2 | 2023-02-01 | Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php. |
CVE-2022-27537 | High | 7.8 | 2023-02-01 | Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privileg… |
CVE-2022-48175 | Critical | 9.8 | 2023-01-30 | Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request. |
CVE-2022-25967 | High | 8.1 | 2023-01-30 | Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options… |
CVE-2021-4315 | Medium | 5.5 | 2023-01-28 | A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment… |
CVE-2022-48116 | High | 7.2 | 2023-01-27 | AyaCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/tpl_edit.inc.php. |
CVE-2023-23619 | Critical | 9.9 | 2023-01-26 | Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.0 are vulnerable to… |
CVE-2022-25894 | Critical | 9.8 | 2023-01-26 | All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression… |
CVE-2022-25860 | High | 8.1 | 2023-01-26 | Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to… |
CVE-2023-24059 | High | 7.3 | 2023-01-22 | Grand Theft Auto V for PC allows attackers to achieve partial remote code execution or modify files on a PC, as exploited in the wild in January 2023. |
CVE-2020-36655 | High | 8.8 | 2023-01-21 | Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP c… |
CVE-2021-37774 | High | 8.0 | 2023-01-19 | An issue was discovered in function httpProcDataSrv in TL-WDR7660 2.0.30 that allows attackers to execute arbitrary code. |
CVE-2022-45928 | High | 8.8 | 2023-01-18 | A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). Multiple endpoints allow the user to pass the parameter… |
CVE-2022-34456 | High | 8.8 | 2023-01-18 | Dell EMC Metro node, Version(s) prior to 7.1, contain a Code Injection Vulnerability. An authenticated nonprivileged attacker could potentially exploit this v… |
CVE-2023-21890 | Critical | 9.8 | 2023-01-18 | Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core). Supported versions that are affect… |
CVE-2023-21886 | High | 8.1 | 2023-01-18 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.42 and pr… |
CVE-2023-22731 | Critical | 9.9 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment **without the Sandbox extension**, it is possible to… |
CVE-2022-47318 | High | 8.0 | 2023-01-17 | ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a… |
CVE-2022-46648 | High | 8.0 | 2023-01-17 | ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a… |
CVE-2023-0297 | Critical | 9.8 | 2023-01-14 | Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31. |
CVE-2023-22853 | High | 8.8 | 2023-01-14 | Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval. |
CVE-2022-42268 | High | 7.8 | 2023-01-13 | Omniverse Kit contains a vulnerability in the reference applications Create, Audio2Face, Isaac Sim, View, Code, and Machinima. These applications allow execut… |
CVE-2023-22952 | High | 8.8 | 2023-01-11 | In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. |
CVE-2023-0022 | Critical | 9.9 | 2023-01-10 | SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the appli… |
CVE-2022-25926 | High | 7.4 | 2023-01-04 | Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization. |
CVE-2023-0048 | High | 8.8 | 2023-01-04 | Code Injection in GitHub repository lirantal/daloradius prior to master-branch. |
CVE-2015-10009 | Medium | 5.5 | 2023-01-02 | A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file app/controllers/code… |
CVE-2022-46874 | High | 8.8 | 2022-12-22 | A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potenti… |
CVE-2022-22756 | High | 8.8 | 2022-12-22 | If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script whic… |
CVE-2022-46101 | High | 8.8 | 2022-12-22 | AyaCMS v3.1.2 was found to have a code flaw in the ust_sql.inc.php file, which allows attackers to cause command execution by inserting malicious code. |
CVE-2022-47896 | Medium | 5.0 | 2022-12-22 | In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks. |
CVE-2022-43486 | Medium | 6.8 | 2022-12-19 | Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functiona… |
CVE-2022-23474 | Medium | 6.1 | 2022-12-15 | Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method pa… |
CVE-2021-39426 | Critical | 9.8 | 2022-12-15 | An issue was discovered in /Upload/admin/admin_notify.php in Seacms 11.4 allows attackers to execute arbitrary php code via the notify1 parameter when the acti… |
CVE-2022-23503 | High | 7.5 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injectio… |
CVE-2022-37155 | High | 8.8 | 2022-12-14 | RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter. |
CVE-2022-44702 | High | 7.8 | 2022-12-13 | Windows Terminal Remote Code Execution Vulnerability |
CVE-2022-4455 | Low | 3.5 | 2022-12-13 | A vulnerability was identified in sproctor php-calendar up to 2.0.13. This impacts an unknown function of the file index.php. Such manipulation of the argument… |
CVE-2022-4223 | High | 8.8 | 2022-12-13 | The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg… |
CVE-2022-41264 | High | 8.8 | 2022-12-13 | Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, allows an authe… |
CVE-2022-44533 | High | 7.2 | 2022-12-12 | A vulnerability in the Aruba EdgeConnect Enterprise web management interface allows remote authenticated users to run arbitrary commands on the underlying host… |
CVE-2022-43542 | High | 7.2 | 2022-12-12 | Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A… |
CVE-2022-43541 | High | 7.2 | 2022-12-12 | Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A… |
CVE-2021-3661 | High | 8.4 | 2022-12-12 | A potential security vulnerability has been identified in certain HP Workstation BIOS (UEFI firmware) which may allow arbitrary code execution. HP is releasing… |
CVE-2022-46166 | High | 8.0 | 2022-12-09 | Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, havi… |
CVE-2022-46157 | High | 8.8 | 2022-12-09 | Akeneo PIM is an open source Product Information Management (PIM). Akeneo PIM Community Edition versions before v5.0.119 and v6.0.53 allows remote authenticate… |
CVE-2022-45550 | Critical | 9.8 | 2022-12-07 | AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE). |
CVE-2022-46742 | Critical | 10.0 | 2022-12-07 | Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution. |
CVE-2022-43660 | High | 7.2 | 2022-12-07 | Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage… |
CVE-2022-42699 | Critical | 9.1 | 2022-12-06 | Auth. Remote Code Execution vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress. |
CVE-2022-46333 | High | 7.2 | 2022-12-06 | The admin user interface in Proofpoint Enterprise Protection (PPS/PoD) contains a command injection vulnerability that enables an admin to execute commands bey… |
CVE-2022-46161 | Critical | 10.0 | 2022-12-06 | pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of us… |
CVE-2022-4300 | Medium | 6.3 | 2022-12-06 | A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit of the component Tem… |
CVE-2022-23465 | High | 7.1 | 2022-12-02 | SwiftTerm is a Xterm/VT100 Terminal emulator. Prior to commit a94e6b24d24ce9680ad79884992e1dff8e150a31, an attacker could modify the window title via a certain… |
CVE-2022-43333 | Critical | 9.8 | 2022-12-01 | Telenia Software s.r.l TVox before v22.0.17 was discovered to contain a remote code execution (RCE) vulnerability in the component action_export_control.php. |
CVE-2022-3713 | High | 8.8 | 2022-12-01 | A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA. |
CVE-2022-3696 | High | 7.2 | 2022-12-01 | A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA. |
CVE-2022-44262 | Critical | 9.8 | 2022-12-01 | ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE). |
CVE-2022-3384 | High | 7.2 | 2022-11-29 | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options funct… |
CVE-2022-3383 | High | 7.2 | 2022-11-29 | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback… |
CVE-2022-44038 | Critical | 9.8 | 2022-11-29 | Russound XSourcePlayer 777D v06.08.03 was discovered to contain a remote code execution vulnerability via the scriptRunner.cgi component. |
CVE-2022-45908 | Critical | 9.8 | 2022-11-26 | In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead t… |
CVE-2022-45907 | Critical | 9.8 | 2022-11-26 | In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely. |
CVE-2022-41158 | High | 7.2 | 2022-11-25 | Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vuln… |