CWE-95 · Eval Injection (page 2)
Page 2 of 2 — CVEs classified under CWE-95, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10633 | High | 7.3 | 2025-01-26 | The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.8.0… |
CVE-2024-8512 | Critical | 9.1 | 2024-10-30 | The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBe… |
CVE-2024-45858 | High | 7.8 | 2024-09-18 | An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML f… |
CVE-2024-45851 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45850 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45849 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is ins… |
CVE-2024-45848 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on th… |
CVE-2024-45847 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on… |
CVE-2024-45846 | High | 8.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on th… |
CVE-2024-27321 | High | 7.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification t… |
CVE-2024-27320 | High | 7.8 | 2024-09-12 | An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle… |
CVE-2023-26323 | High | 7.6 | 2024-08-28 | A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers t… |
CVE-2024-7954 | Critical | 9.8 | 2024-08-23 | The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthentic… |
CVE-2024-43404 | Critical | 9.8 | 2024-08-20 | MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execut… |
CVE-2024-6891 | High | 8.8 | 2024-08-08 | Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow. |
CVE-2024-37901 | Critical | 9.9 | 2024-07-31 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbit… |
CVE-2024-39173 | Critical | 9.8 | 2024-07-18 | calculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the eval function at /routes/calculator.js. This vulnerab… |
CVE-2024-36404 | Critical | 9.8 | 2024-07-02 | GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possibl… |
CVE-2024-36401 | Critical | 9.8 | 2024-07-01 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC requ… |
CVE-2024-3562 | High | 8.8 | 2024-06-20 | The Custom Field Suite plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.6.7 via the Loop custom field. This is… |
CVE-2024-32649 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `sqrt` builtin can result in double eval… |
CVE-2024-32647 | Medium | 5.3 | 2024-04-25 | Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can resul… |
CVE-2024-31996 | Critical | 10.0 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, the HTML escaping of escaping tool… |
CVE-2024-31986 | Critical | 9.0 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, by creating a document with a special… |
CVE-2024-31984 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a sp… |
CVE-2024-31982 | Critical | 10.0 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search a… |
CVE-2024-31465 | Critical | 9.9 | 2024-04-10 | XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any… |
CVE-2023-7245 | High | 7.8 | 2024-02-20 | The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary c… |
CVE-2023-50447 | High | 8.1 | 2024-01-19 | Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which wa… |
CVE-2023-6735 | High | 8.8 | 2024-01-12 | Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges |
CVE-2024-21650 | Critical | 10.0 | 2024-01-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) a… |
CVE-2023-7224 | High | 7.8 | 2024-01-08 | OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environ… |
CVE-2023-7101 | High | 7.8 | 2023-12-24 | Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE)… |
CVE-2023-50723 | Critical | 9.9 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in… |
CVE-2023-50721 | Critical | 9.9 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface does… |
CVE-2023-48699 | High | 8.4 | 2023-11-21 | fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design. Prior to version 0.1.5, an attacker could mod… |
CVE-2023-46731 | Critical | 10.0 | 2023-11-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki doesn't properly escape the section URL paramete… |
CVE-2023-37909 | Critical | 9.9 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14… |
CVE-2023-40177 | Critical | 9.9 | 2023-08-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their… |
CVE-2023-37462 | Critical | 9.9 | 2023-07-14 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkin… |
CVE-2023-35152 | Critical | 9.9 | 2023-06-23 | XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous… |
CVE-2023-35150 | Critical | 9.9 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4… |
CVE-2023-30537 | Critical | 9.9 | 2023-04-16 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with the right to add an object on a page can… |
CVE-2023-29511 | Critical | 9.9 | 2023-04-16 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own us… |
CVE-2023-29509 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents can execute… |
CVE-2023-29214 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Veloc… |
CVE-2023-29212 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Veloc… |
CVE-2023-29211 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrar… |
CVE-2023-29210 | Critical | 9.9 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including th… |
CVE-2023-29209 | Critical | 9.9 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including th… |
CVE-2023-0888 | Medium | 4.9 | 2023-03-13 | An improper neutralization of directives in dynamically evaluated code vulnerability in the WiFi Battery embedded web server in versions L90/U70 and L92/U92 ca… |
CVE-2023-0090 | Critical | 9.8 | 2023-03-08 | The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval in… |
CVE-2023-0089 | High | 8.8 | 2023-03-08 | The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval inje… |
CVE-2023-26477 | Critical | 10.0 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and… |
CVE-2022-41931 | Critical | 9.9 | 2022-11-23 | xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user with view rights on co… |
CVE-2022-41928 | Critical | 9.9 | 2022-11-23 | XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can al… |
CVE-2022-36100 | Critical | 9.9 | 2022-09-08 | XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform… |
CVE-2022-36099 | Critical | 9.9 | 2022-09-08 | XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior… |
CVE-2022-38193 | Medium | 6.1 | 2022-08-16 | There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings w… |
CVE-2022-36010 | Critical | 10.0 | 2022-08-15 | This library allows strings to be parsed as functions and stored as a specialized component, [`JsonFunctionValue`](https://github.com/oxyno-zeta/react-editable… |
CVE-2021-33678 | Medium | 6.5 | 2021-07-14 | A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75… |
CVE-2021-23277 | High | 8.3 | 2021-04-13 | Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax… |
CVE-2019-9507 | High | 8.3 | 2020-03-30 | The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to command injection because the application incorrectly neutralizes code synta… |
CVE-2020-6650 | High | 8.3 | 2020-03-23 | UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax bef… |
CVE-2020-5256 | High | 7.9 | 2020-03-09 | BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code… |
CVE-2020-5217 | Medium | 4.4 | 2020-01-23 | In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input w… |