An issue was discovered in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to execute arbitrary code via crafted Object.prototype anonymous function.

CVE-2023-25539HIGHCVSS 8.4EG 8.4

2023-05-31

Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the appl…

CVE-2023-25549HIGHCVSS 7.2EG 7.2

2023-04-18

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows for remote code execution when using a parameter of the DCE network settings endpoint. Affected products: StruxureWare …

CVE-2023-25550HIGHCVSS 7.2EG 7.2

2023-04-18

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows remote code execution via the “hostname” parameter when maliciously crafted hostname syntax is entered. Affecte…

CVE-2023-25657HIGHCVSS 7.5EG 7.5

2023-02-21

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions earlier than 1.5.7 are impacted by a remote code execution vulnerability. Nautobot did not properly sandbox Jinja2 template rendering. In…

CVE-2023-25717CRITICALCVSS 9.8EG 9.8⚠ KEV

2023-02-13

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

CVE-2023-2583CRITICALCVSS 10.0EG 10.0

2023-05-08

Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3.

CVE-2023-25910CRITICALCVSS 10.0EG 9.9

2023-06-13

A vulnerability has been identified in SIMATIC PCS 7 (All versions < V9.1 SP2 UC04), SIMATIC S7-PM (All versions < V5.7 SP1 HF1), SIMATIC S7-PM (All versions < V5.7 SP2 HF1), SIMATIC STEP 7 V5 (All versions < V5.7). The affected product co…

CVE-2023-25953CRITICALCVSS 9.8EG 9.8

2023-05-23

Code injection vulnerability in Drive Explorer for macOS versions 3.5.4 and earlier allows an attacker who can login to the client where the affected product is installed to inject arbitrary code while processing the product execution. Sin…

CVE-2023-26060MEDIUMCVSS 6.8EG 6.8

2023-04-24

An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that has a client-side template injection payload. Input validation is missing during creation of the wor…

CVE-2023-26107MEDIUMCVSS 6.9EG 7.8

2023-03-06

All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string.

CVE-2023-26119CRITICALCVSS 9.8EG 9.8

2023-04-03

Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.

CVE-2023-26145HIGHCVSS 7.4EG 7.4

2023-09-28

This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to …

CVE-2023-26155HIGHCVSS 7.3EG 7.3

2023-10-14

All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attacke…

CVE-2023-26322HIGHCVSS 8.8EG 8.8

2024-08-28

A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.

CVE-2023-26324HIGHCVSS 8.8EG 8.8

2024-08-28

A code execution vulnerability exists in the XiaomiGetApps application product. This vulnerability is caused by the verification logic being bypassed, and an attacker can exploit this vulnerability to execute malicious code.

CVE-2023-26436HIGHCVSS 7.1EG 7.1

2023-06-20

Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary co…

CVE-2023-26477CRITICALCVSS 10.0EG 10.0

2023-03-02

XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter),…

CVE-2023-26546HIGHCVSS 8.8EG 8.8

2023-05-02

European Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Side Template Injection (SSTI) with a crafted template file. The attacker must have template manager permission.

CVE-2023-26782MEDIUMCVSS 6.5EG 6.5

2023-04-28

An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache Configuration->Cache security characters.

CVE-2023-26785CRITICALCVSS 9.8EG 9.8

2024-10-17

MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a "create function" statement. NOTE: this is disputed by the MariaDB Foundation because no privilege boun…

CVE-2023-26817HIGHCVSS 8.8EG 8.8

2023-04-07

codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution (RCE) vulnerability via the component /controllers/api/user.php.

CVE-2023-26877MEDIUMCVSS 6.3EG 6.3

2024-06-26

File upload vulnerability found in Softexpert Excellence Suite v.2.1 allows attackers to execute arbitrary code via a .php file upload to the form/efms_exec_html/file_upload_parser.php endpoint.

CVE-2023-27650CRITICALCVSS 9.8EG 9.8

2023-04-10

An issue found in APUS Group Launcher v.3.10.73 and v.3.10.88 allows a remote attacker to execute arbitrary code via the FONT_FILE parameter.

CVE-2023-27744HIGHCVSS 7.8EG 7.8

2023-06-02

An issue was discovered in South River Technologies TitanFTP NextGen server that allows for a vertical privilege escalation leading to remote code execution.

CVE-2023-27770HIGHCVSS 7.8EG 7.8

2023-04-04

An issue found in Wondershare Technology Co.,Ltd Edraw-max v.12.0.4 allows a remote attacker to execute arbitrary commands via the edraw-max_setup_full5371.exe file.

CVE-2023-27866MEDIUMCVSS 6.3EG 6.3

2023-06-28

IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver do not verify supplied LDAP URL in Connect String. IBM X-Force ID: 249511.

CVE-2023-27867MEDIUMCVSS 6.3EG 6.3

2023-07-10

IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Injection. By sending a specially crafted request using the property clientRerouteS…

CVE-2023-27868MEDIUMCVSS 6.3EG 6.3

2023-07-10

IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By …

CVE-2023-27869MEDIUMCVSS 6.3EG 6.3

2023-07-10

IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked logger injection. By sending a specially crafted reque…

CVE-2023-27893HIGHCVSS 8.8EG 8.8

2023-03-14

An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems (ST-PI) - versions 2088_1_700, 2008_1_710, 740, can use a vulnerable interface …

CVE-2023-27897MEDIUMCVSS 6.0EG 6.3

2023-04-11

In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions…

CVE-2023-27986HIGHCVSS 7.8EG 9.8

2023-03-09

emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.

CVE-2023-28333CRITICALCVSS 9.8EG 9.8

2023-03-23

The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).

CVE-2023-28354CRITICALCVSS 9.8EG 9.8

2025-01-09

An issue was discovered in Opsview Monitor Agent 6.8. An unauthenticated remote attacker can call check_nrpe against affected targets, specifying known NRPE plugins, which in default installations are configured to accept command control c…

CVE-2023-2859HIGHCVSS 8.8EG 8.8

2023-05-24

Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9.

CVE-2023-28706CRITICALCVSS 9.8EG 9.8

2023-04-07

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 6.0.0.

CVE-2023-28793HIGHCVSS 7.8EG 7.8

2023-10-23

Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.

CVE-2023-28796HIGHCVSS 7.1EG 7.1

2023-10-23

Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.

CVE-2023-29209CRITICALCVSS 9.9EG 9.9

2023-04-15

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the legacy notification activity macro can execute arbitrary Groovy, Python or Vel…

CVE-2023-29210CRITICALCVSS 9.9EG 9.9

2023-04-15

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the notification preferences macros can execute arbitrary Groovy, Python or Veloci…

CVE-2023-29211CRITICALCVSS 9.9EG 9.9

2023-04-16

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki i…

CVE-2023-29212CRITICALCVSS 9.9EG 9.9

2023-04-16

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cau…

CVE-2023-29214CRITICALCVSS 9.9EG 9.9

2023-04-16

XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cau…

CVE-2023-2928MEDIUMCVSS 6.3EG 6.3

2023-05-27

A vulnerability was found in DedeCMS up to 5.7.106. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file uploads/dede/article_allowurl_edit.php. The manipulation of the argument allurls l…

CVE-2023-29374CRITICALCVSS 9.8EG 9.8

2023-04-05

In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method.

CVE-2023-29382CRITICALCVSS 9.8EG 9.8

2023-07-06

An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component.

CVE-2023-29400HIGHCVSS 7.3EG 7.3

2023-05-11

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attribut…

CVE-2023-29402CRITICALCVSS 9.8EG 9.8

2023-06-08

The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newl…

CVE-2023-29404CRITICALCVSS 9.8EG 9.8

2023-06-08

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, sp…

CWE-94— Improper Control of Generation of Code (Code Injection)

CVEs classified under CWE-94page 64 of 125

Map vulnerabilities like CWE-94 to your infrastructure