CWE-94 · Code Injection (page 46)
Page 46 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-19011 | High | 8.8 | 2019-01-22 | CX-Supervisor (Versions 3.42 and prior) can execute code that has been injected into a project file. An attacker could exploit this to execute code under the p… |
CVE-2018-20717 | High | 8.8 | 2019-01-15 | In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the rights of at least a… |
CVE-2017-18356 | High | 8.8 | 2019-01-15 | In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at… |
CVE-2017-1002152 | Medium | 6.1 | 2019-01-10 | Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles. |
CVE-2018-0461 | Medium | 6.5 | 2019-01-10 | A vulnerability in the Cisco IP Phone 8800 Series Software could allow an unauthenticated, remote attacker to conduct an arbitrary script injection attack on a… |
CVE-2018-16168 | Critical | 9.8 | 2019-01-09 | LogonTracer 1.2.0 and earlier allows remote attackers to conduct Python code injection attacks via unspecified vectors. |
CVE-2016-9651 | High | 8.8 | 2019-01-09 | A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary co… |
CVE-2019-0542 | High | 8.8 | 2019-01-09 | A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." Thi… |
CVE-2019-0247 | Critical | 9.8 | 2019-01-08 | SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the be… |
CVE-2019-3575 | High | 7.8 | 2019-01-03 | Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load. |
CVE-2018-20605 | Critical | 9.8 | 2018-12-30 | imcat 4.4 allows remote attackers to execute arbitrary PHP code by using root/run/adm.php to modify the boot/bootskip.php file. |
CVE-2018-20599 | High | 8.8 | 2018-12-30 | UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin_fileedit action. |
CVE-2018-7801 | High | 8.8 | 2018-12-24 | A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable access with maximum privileges when a remote code executi… |
CVE-2018-20325 | Critical | 9.8 | 2018-12-21 | There is a vulnerability in load() method in definitions/parser.py in the Danijar Hafner definitions package for Python. It can execute arbitrary python comman… |
CVE-2018-1000881 | Critical | 9.8 | 2018-12-20 | Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in ComputedAttributes… |
CVE-2018-20300 | Critical | 9.8 | 2018-12-20 | Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected in… |
CVE-2018-20133 | Critical | 9.8 | 2018-12-17 | ymlref allows code injection. |
CVE-2018-20027 | Critical | 9.8 | 2018-12-17 | The yaml_parse.load method in Pylearn2 allows code injection. |
CVE-2018-18249 | Critical | 9.8 | 2018-12-17 | Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the att… |
CVE-2018-20129 | High | 8.8 | 2018-12-13 | An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/select_images_post.php allows remote attackers to upload and execute arbitrary PHP code via… |
CVE-2018-8540 | Critical | 9.8 | 2018-12-12 | A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vuln… |
CVE-2018-19595 | Critical | 9.8 | 2018-11-27 | PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by an index.php/list/5/?c… |
CVE-2018-19520 | High | 8.8 | 2018-11-25 | An issue was discovered in SDCMS 1.6 with PHP 5.x. app/admin/controller/themecontroller.php uses a check_bad function in an attempt to block certain PHP functi… |
CVE-2018-19463 | High | 8.8 | 2018-11-22 | zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an u… |
CVE-2018-19404 | High | 7.2 | 2018-11-21 | In YXcms 1.4.7, protected/apps/appmanage/controller/indexController.php allow remote authenticated Administrators to execute any PHP code by creating a ZIP arc… |
CVE-2018-8415 | High | 7.8 | 2018-11-14 | A tampering vulnerability exists in PowerShell that could allow an attacker to execute unlogged code, aka "Microsoft PowerShell Tampering Vulnerability." This… |
CVE-2018-2491 | High | 7.8 | 2018-11-13 | When opening a deep link URL in SAP Fiori Client with log level set to "Debug", the client application logs the URL to the log file. If this URL contains malic… |
CVE-2018-1808 | Medium | 4.3 | 2018-11-13 | IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. IBM X-Force ID: 149828. |
CVE-2018-1792 | High | 8.8 | 2018-11-13 | IBM WebSphere MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, 9.0.1 through 9.0.5, and 9.1.0.0 could allow a local user to inject code that could be exec… |
CVE-2018-19220 | Critical | 9.8 | 2018-11-12 | An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to execute arbitrary PHP code via the host parameter to the install/ URI. |
CVE-2018-19196 | Critical | 9.8 | 2018-11-12 | An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\cont… |
CVE-2018-19180 | Critical | 9.8 | 2018-11-11 | statics/app/index/controller/Install.php in YUNUCMS 1.1.5 (if install.lock is not present) allows remote attackers to execute arbitrary PHP code by placing thi… |
CVE-2018-19127 | Critical | 9.8 | 2018-11-09 | A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, le… |
CVE-2018-19053 | High | 7.2 | 2018-11-07 | PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL general_log_file" statement, followed by a… |
CVE-2018-14667 | Critical | 9.8 | 2018-11-06 | The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker… |
CVE-2018-18903 | Critical | 9.8 | 2018-11-03 | Vanilla 2.6.x before 2.6.4 allows remote code execution. |
CVE-2018-6012 | Critical | 9.8 | 2018-11-01 | The 'Weather Service' feature of the Green Electronics RainMachine Mini-8 (2nd generation) allows an attacker to inject arbitrary Python code via the 'Add new… |
CVE-2018-18892 | Critical | 9.8 | 2018-11-01 | MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php. |
CVE-2016-5402 | High | 8.8 | 2018-10-31 | A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the c… |
CVE-2018-18835 | Critical | 9.8 | 2018-10-30 | upload_template() in system/changeskin.php in DocCms 2016.5.12 allows remote attackers to execute arbitrary PHP code via a template file. |
CVE-2018-18461 | Critical | 9.8 | 2018-10-18 | The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code i… |
CVE-2018-18426 | High | 8.8 | 2018-10-17 | s-cms 3.0 allows remote attackers to execute arbitrary PHP code by placing this code in a crafted User-agent Disallow value in the robots.php txt parameter. |
CVE-2018-18319 | Critical | 9.8 | 2018-10-15 | An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval ca… |
CVE-2018-18258 | Critical | 9.8 | 2018-10-11 | An issue was discovered in BageCMS 3.1.3. The attacker can execute arbitrary PHP code on the web server and can read any file on the web server via an index.ph… |
CVE-2018-7633 | Critical | 9.8 | 2018-10-09 | Code injection in the /ui/login form Language parameter in Epicentro E_7.3.2+ allows attackers to execute JavaScript code by making a user issue a manipulated… |
CVE-2018-18083 | Critical | 9.8 | 2018-10-09 | An issue was discovered in DuomiCMS 3.0. Remote PHP code execution is possible via the search.php searchword parameter because "eval" is used during "if" proce… |
CVE-2015-9272 | Critical | 9.8 | 2018-10-05 | The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file sa… |
CVE-2018-14804 | Critical | 9.8 | 2018-10-01 | Emerson AMS Device Manager v12.0 to v13.5. A specially crafted script may be run that allows arbitrary remote code execution. |
CVE-2018-17827 | High | 7.2 | 2018-10-01 | HisiPHP 1.0.8 allows remote attackers to execute arbitrary PHP code by editing a plugin's name to contain that code. This name is then injected into app/admin/… |
CVE-2018-17364 | High | 8.1 | 2018-09-23 | OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter. |
CVE-2018-17173 | Critical | 9.8 | 2018-09-21 | LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail. |
CVE-2018-17207 | Critical | 9.8 | 2018-09-19 | An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can… |
CVE-2018-14630 | High | 8.8 | 2018-09-17 | moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing leg… |
CVE-2018-11781 | High | 7.8 | 2018-09-17 | Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax. |
CVE-2018-11780 | Critical | 9.8 | 2018-09-17 | A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2. |
CVE-2018-17134 | High | 7.2 | 2018-09-17 | admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the cfg_author field in conjunction with a crafted cfg_webpath field. |
CVE-2018-17133 | High | 7.2 | 2018-09-17 | admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting. |
CVE-2018-17132 | High | 7.2 | 2018-09-17 | admin/goods_update.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue[] array parameter. |
CVE-2018-17131 | High | 7.2 | 2018-09-17 | admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field. |
CVE-2018-17126 | Critical | 9.8 | 2018-09-17 | CScms 4.1 allows remote code execution, as demonstrated by 1');eval($_POST[cmd]);# in Web Name to upload\plugins\sys\Install.php. |
CVE-2018-17036 | Critical | 9.8 | 2018-09-14 | An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonst… |
CVE-2018-17030 | High | 7.5 | 2018-09-14 | BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/proce… |
CVE-2018-16975 | Critical | 9.8 | 2018-09-12 | An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in t… |
CVE-2018-3686 | Medium | 6.7 | 2018-09-12 | Code injection vulnerability in INTEL-SA-00086 Detection Tool before version 1.2.7.0 may allow a privileged user to potentially execute arbitrary code via loca… |
CVE-2018-15886 | High | 7.2 | 2018-09-10 | Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippets&action=edit_snippet&filename=google-a… |
CVE-2018-16771 | Critical | 9.8 | 2018-09-10 | Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php. |
CVE-2018-16604 | High | 7.2 | 2018-09-06 | An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username becaus… |
CVE-2018-0675 | High | 7.8 | 2018-09-04 | AttacheCase ver.3.3.0.0 and earlier allows an arbitrary script execution via unspecified vectors. |
CVE-2018-0674 | High | 7.8 | 2018-09-04 | AttacheCase ver.2.8.4.0 and earlier allows an arbitrary script execution via unspecified vectors. |
CVE-2018-16343 | High | 7.2 | 2018-09-02 | SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf() in include/main.class.php does not block use of $GLOBALS. |
CVE-2018-6499 | High | 7.1 | 2018-08-30 | Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized… |
CVE-2018-6498 | High | 8.8 | 2018-08-30 | Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized… |
CVE-2011-2767 | Critical | 9.8 | 2018-08-26 | mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentatio… |
CVE-2018-15728 | High | 8.8 | 2018-08-24 | Couchbase Server exposed the '/diag/eval' endpoint which by default is available on TCP/8091 and/or TCP/18091. Authenticated users that have 'Full Admin' role… |
CVE-2017-1753 | Medium | 5.4 | 2018-08-20 | Multiple IBM Rational products are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in th… |
CVE-2015-5243 | Critical | 9.8 | 2018-08-20 | phpWhois allows remote attackers to execute arbitrary code via a crafted whois record. |
CVE-2018-3784 | Critical | 9.8 | 2018-08-17 | A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization. |
CVE-2018-8346 | High | 8.8 | 2018-08-15 | A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "LNK Remote Code Exec… |
CVE-2018-8345 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed, aka "LNK Remote Code Exec… |
CVE-2018-8344 | High | 8.8 | 2018-08-15 | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote… |
CVE-2018-14716 | High | 7.5 | 2018-08-06 | A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorr… |
CVE-2016-4397 | High | 7.8 | 2018-08-06 | A local code execution security vulnerability was identified in HP Network Node Manager i (NNMi) v10.00, v10.10 and v10.20 Software. |
CVE-2016-4391 | Critical | 9.8 | 2018-08-06 | A remote code execution security vulnerability has been identified in all versions of the HP ArcSight WINC Connector prior to v7.3.0. |
CVE-2018-14910 | High | 8.8 | 2018-08-03 | SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address (aka ip) to /admin/admin_ip.php (aka /adm1n/admin_ip.php). The code is e… |
CVE-2018-7748 | High | 8.8 | 2018-08-03 | report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in… |
CVE-2018-14579 | Critical | 9.8 | 2018-07-24 | GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PHP code by inserting… |
CVE-2018-1999023 | High | 8.8 | 2018-07-23 | The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code executi… |
CVE-2018-1999022 | Critical | 9.8 | 2018-07-23 | PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate metho… |
CVE-2018-1999019 | Critical | 9.8 | 2018-07-23 | Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can… |
CVE-2018-14421 | High | 8.8 | 2018-07-20 | SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /backend/admin_video.ph… |
CVE-2018-7602 | Critical | 9.8 | 2018-07-19 | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vec… |
CVE-2014-2302 | Critical | 9.8 | 2018-07-19 | The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x before 6.3.8-s1 allows remote attackers to conduct PHP Object Injection attacks by interceptin… |
CVE-2018-14399 | Critical | 9.8 | 2018-07-19 | libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php#.jpg URI in the SRC attribut… |
CVE-2018-8284 | High | 8.1 | 2018-07-11 | A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vuln… |
CVE-2018-2427 | High | 8.8 | 2018-07-10 | SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 2010) allows an attac… |
CVE-2018-13818 | Critical | 9.8 | 2018-07-10 | Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web a… |
CVE-2018-3608 | Critical | 9.8 | 2018-07-06 | A vulnerability in Trend Micro Maximum Security's (Consumer) 2018 (versions 12.0.1191 and below) User-Mode Hooking (UMH) driver could allow an attacker to crea… |
CVE-2017-1329 | Medium | 5.4 | 2018-07-06 | IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed… |
CVE-2017-1248 | Medium | 5.4 | 2018-07-06 | IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed… |
CVE-2017-1242 | Medium | 5.4 | 2018-07-06 | IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed… |