CWE-94 · Code Injection (page 41)
Page 41 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41402 | High | 8.8 | 2022-06-16 | flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code. |
CVE-2022-0885 | Critical | 9.8 | 2022-06-13 | The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenti… |
CVE-2022-2054 | High | 8.4 | 2022-06-12 | Code Injection in GitHub repository nuitka/nuitka prior to 0.9. |
CVE-2021-41749 | Critical | 9.8 | 2022-06-12 | In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for rem… |
CVE-2022-24429 | High | 7.5 | 2022-06-10 | The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary fi… |
CVE-2022-2014 | Medium | 5.4 | 2022-06-09 | Code Injection in GitHub repository jgraph/drawio prior to 19.0.2. |
CVE-2022-21122 | Critical | 9.0 | 2022-06-08 | The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is ex… |
CVE-2022-21831 | Critical | 9.8 | 2022-05-26 | A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments. |
CVE-2022-29221 | High | 8.8 | 2022-05-24 | Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, templat… |
CVE-2022-29216 | High | 7.8 | 2022-05-21 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, TensorFlow's `saved_model_cli` tool is vulnerable… |
CVE-2021-27446 | Critical | 10.0 | 2022-05-16 | The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on th… |
CVE-2022-0578 | Medium | 6.5 | 2022-05-16 | Code Injection in GitHub repository publify/publify prior to 9.2.8. |
CVE-2022-29307 | Critical | 9.8 | 2022-05-12 | IonizeCMS v1.0.8.1 was discovered to contain a command injection vulnerability via the function copy_lang_content in application/models/lang_model.php. |
CVE-2021-42651 | High | 8.8 | 2022-05-11 | A Server Side Template Injection (SSTI) vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to execute arbitrary co… |
CVE-2022-23332 | High | 8.8 | 2022-05-09 | Command injection vulnerability in Manual Ping Form (Web UI) in Shenzhen Ejoin Information Technology Co., Ltd. ACOM508/ACOM516/ACOM532 609-915-041-100-020 all… |
CVE-2022-29171 | Medium | 6.6 | 2022-05-06 | Sourcegraph is a fast and featureful code search and navigation engine. Versions before 3.38.0 are vulnerable to Remote Code Execution in the gitserver service… |
CVE-2022-24817 | Critical | 9.9 | 2022-05-06 | Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kus… |
CVE-2022-1575 | Critical | 9.6 | 2022-05-05 | Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. -… |
CVE-2022-29821 | Medium | 6.9 | 2022-04-28 | In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible |
CVE-2022-29819 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible |
CVE-2022-29815 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible |
CVE-2022-29814 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible |
CVE-2022-29813 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible |
CVE-2022-24735 | Low | 3.9 | 2022-04-27 | Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior… |
CVE-2022-24881 | High | 8.8 | 2022-04-26 | Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code exec… |
CVE-2022-29078 | Critical | 9.8 | 2022-04-25 | The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This… |
CVE-2022-0661 | High | 7.2 | 2022-04-18 | The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user… |
CVE-2022-24816 | Critical | 10.0 | 2022-04-13 | JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request… |
CVE-2022-27837 | Medium | 4.4 | 2022-04-11 | A vulnerability using PendingIntent in Accessibility prior to version 12.5.3.2 in Android R(11.0) and 13.0.1.1 in Android S(12.0) allows attacker to access the… |
CVE-2022-22954 | Critical | 9.8 | 2022-04-11 | VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with ne… |
CVE-2021-40219 | High | 8.8 | 2022-04-11 | Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template in… |
CVE-2022-24780 | High | 8.8 | 2022-04-05 | Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by… |
CVE-2022-26982 | High | 7.2 | 2022-04-05 | SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the theme… |
CVE-2021-39114 | High | 8.8 | 2022-04-05 | Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Jav… |
CVE-2022-22965 | Critical | 9.8 | 2022-04-01 | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires t… |
CVE-2022-22963 | Critical | 9.8 | 2022-04-01 | In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a speciall… |
CVE-2022-1159 | High | 7.7 | 2022-04-01 | Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio… |
CVE-2021-39908 | Medium | 6.5 | 2022-04-01 | In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14… |
CVE-2021-43097 | High | 7.2 | 2022-03-28 | A Server-side Template Injection (SSTI) vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code. |
CVE-2021-26622 | Critical | 9.6 | 2022-03-25 | An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers… |
CVE-2021-38745 | Medium | 6.8 | 2022-03-21 | Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin… |
CVE-2021-39383 | Critical | 9.8 | 2022-03-20 | DWSurvey v3.2.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /sysuser/SysPropertyAction.java. |
CVE-2022-25578 | Critical | 9.8 | 2022-03-18 | taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file. |
CVE-2020-25197 | Critical | 9.8 | 2022-03-18 | A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that cou… |
CVE-2020-15591 | Critical | 9.8 | 2022-03-17 | fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution). |
CVE-2022-25760 | High | 7.1 | 2022-03-17 | All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attac… |
CVE-2022-0811 | High | 8.8 | 2022-03-16 | A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses th… |
CVE-2022-25498 | Critical | 9.8 | 2022-03-15 | CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the saveConfigData function in /classes/ajax/Functions.php. |
CVE-2022-0944 | High | 7.2 | 2022-03-15 | Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1. |
CVE-2021-25003 | Critical | 9.8 | 2022-03-14 | The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web ser… |
CVE-2022-0921 | Medium | 6.7 | 2022-03-11 | Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12. |
CVE-2021-44618 | Critical | 9.8 | 2022-03-11 | A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header. |
CVE-2022-24915 | High | 8.0 | 2022-03-10 | The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interp… |
CVE-2022-22985 | High | 8.8 | 2022-03-10 | The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interp… |
CVE-2022-24734 | High | 7.2 | 2022-03-09 | MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on inse… |
CVE-2022-24512 | Medium | 6.3 | 2022-03-09 | .NET and Visual Studio Remote Code Execution Vulnerability |
CVE-2022-0896 | High | 8.8 | 2022-03-09 | Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3. |
CVE-2021-43944 | High | 7.2 | 2022-03-08 | This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of… |
CVE-2022-0845 | Critical | 9.8 | 2022-03-05 | Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0. |
CVE-2022-22947 | Critical | 10.0 | 2022-03-03 | In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enab… |
CVE-2022-22909 | High | 8.8 | 2022-03-03 | HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the… |
CVE-2022-0819 | High | 8.8 | 2022-03-02 | Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1. |
CVE-2021-44238 | High | 7.2 | 2022-03-01 | AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE) via /aya/module/admin/ust_tab_e.inc.php, |
CVE-2022-25018 | High | 8.8 | 2022-03-01 | Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages. |
CVE-2022-24442 | Critical | 9.8 | 2022-02-25 | JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. |
CVE-2021-22395 | High | 7.5 | 2022-02-25 | There is a code injection vulnerability in smartphones. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2022-23810 | Medium | 6.5 | 2022-02-24 | Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2… |
CVE-2022-24295 | High | 8.8 | 2022-02-21 | Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL. |
CVE-2022-23642 | High | 8.8 | 2022-02-18 | Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The se… |
CVE-2021-46063 | Critical | 9.1 | 2022-02-18 | MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module. |
CVE-2022-24665 | Critical | 9.9 | 2022-02-16 | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts. |
CVE-2022-24664 | Critical | 9.9 | 2022-02-16 | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to edi… |
CVE-2022-24663 | Critical | 9.9 | 2022-02-16 | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated use… |
CVE-2021-46362 | Critical | 9.8 | 2022-02-11 | A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute… |
CVE-2022-23434 | Medium | 4.4 | 2022-02-11 | A vulnerability using PendingIntent in Bixby Vision prior to versions 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(11) and below allows attackers to execut… |
CVE-2022-23426 | Medium | 4.4 | 2022-02-11 | A vulnerability using PendingIntent in DeX Home and DeX for PC prior to SMR Feb-2022 Release 1 allows attackers to access files with system privilege. |
CVE-2021-44521 | Critical | 9.1 | 2022-02-11 | When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_de… |
CVE-2022-23631 | Critical | 9.0 | 2022-02-09 | superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitra… |
CVE-2022-23614 | High | 8.8 | 2022-02-04 | Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being… |
CVE-2021-44978 | Critical | 9.8 | 2022-02-04 | iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution. |
CVE-2022-21686 | Critical | 9.0 | 2022-01-26 | PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside… |
CVE-2021-46114 | High | 8.8 | 2022-01-26 | jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail. The admin panel provides a function through which attackers can… |
CVE-2021-46118 | High | 7.2 | 2022-01-26 | jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail. The admin panel provides a function through… |
CVE-2021-46117 | High | 7.2 | 2022-01-26 | jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail. The admin panel provides a function through which atta… |
CVE-2022-23008 | Medium | 5.4 | 2022-01-25 | On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undisclosed API endpoint… |
CVE-2021-45029 | Critical | 9.8 | 2022-01-25 | Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1. |
CVE-2022-0323 | High | 8.8 | 2022-01-21 | Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1. |
CVE-2022-23120 | High | 7.8 | 2022-01-20 | A code injection vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allow an attacker to e… |
CVE-2021-44734 | Critical | 9.8 | 2022-01-20 | Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device. |
CVE-2021-43269 | High | 8.8 | 2022-01-20 | In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to use a malicious proxy auto-config (PAC) file, leading… |
CVE-2021-32650 | High | 8.8 | 2022-01-14 | October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with… |
CVE-2021-32649 | High | 8.8 | 2022-01-14 | October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with… |
CVE-2021-34994 | High | 8.8 | 2022-01-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is requi… |
CVE-2021-45806 | High | 8.8 | 2022-01-13 | jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code. |
CVE-2021-23154 | Medium | 6.3 | 2022-01-10 | In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the us… |
CVE-2022-22286 | Medium | 4.4 | 2022-01-10 | A vulnerability using PendingIntent in Bixby Routines prior to version 3.1.21.8 in Android R(11.0) and 2.6.30.5 in Android Q(10.0) allows attackers to execute… |
CVE-2022-22285 | Medium | 4.4 | 2022-01-10 | A vulnerability using PendingIntent in Reminder prior to version 12.2.05.0 in Android R(11.0) and 12.3.02.1000 in Android S(12.0) allows attackers to execute p… |
CVE-2022-22270 | Medium | 4.4 | 2022-01-10 | An implicit Intent hijacking vulnerability in Dialer prior to SMR Jan-2022 Release 1 allows unprivileged applications to access contact information. |
CVE-2021-39979 | Critical | 9.8 | 2022-01-03 | HHEE system has a Code Injection vulnerability.Successful exploitation of this vulnerability may affect HHEE system integrity. |
CVE-2020-20601 | Critical | 9.8 | 2021-12-22 | An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet. |