CWE-74

debmany in debian-goodies 0.88.1 allows attackers to execute arbitrary shell commands (because of an eval call) via a cr

CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via cr

An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the cus

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTM

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut

Ingress nginx annotation injection causes arbitrary command execution.

The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Inject

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF inje

Apache Sling JCR Base < 3.1.12 has a critical injection vulnerability when running on old JDK versions (JDK 1.8.191 or e

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is

Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malic

An injection issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.5. An app may b

Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-sear

Clone vulnerability in the huks ta module.Successful exploitation of this vulnerability may affect service confidentiali

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apac

In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrar

Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when c

A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnera

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multip

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in out

A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. Th

tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/chan

VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injectio

delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the lo

Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitra

A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of

A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This issue affects some unknown proce

A weakness has been identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. Impacted is an unknown function of the com

A security vulnerability has been detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The affected element is an unk

A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The impacted element is an unknown function

A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component W

Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension

Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar ima

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injection

Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability

Craft is a CMS for creating custom digital experiences on the web and beyond. Bypassing the validatePath function can le

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP

On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated syst

dtprintinfo in Common Desktop Environment 1.6 has a bug in the parser of lpstat (an invoked external command) during lis

Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf

Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38

Toyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate a

​A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to

CRLF vulnerability in Reprise License Manager (RLM) web interface through 14.2BL4 in the password parameter in View Lice

A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning i

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library do

IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, c

A HTTP response header injection vulnerability in Swoole v4.5.2 allows attackers to execute arbitrary code via supplying

All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build he