CWE-94

A vulnerability was determined in modelscope agentscope up to 1.0.18. Affected by this vulnerability is the function exe

A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the fi

A flaw has been found in AV Stumpfl Pixera Two Media Server up to 25.2 R2. Impacted is an unknown function of the compon

A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti befor

CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnera

The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an ins

An issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the js_mapped_arguments_mark function

An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in t

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled ou

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary

A weakness has been identified in antlr ANTLR4 up to 4.13.2. Affected is an unknown function of the file tool/src/org/an

A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impacts an unknown function of the file src/

A vulnerability was identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. Impacted is the fu

A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This affects an unknown function of the file so

A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an un

A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate

A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.exte

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider

A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component K

A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of th

A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the comp

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore i

OpenMetadata is a unified metadata platform. Versions prior to 1.11.4 are vulnerable to remote code execution via Server

4images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse

Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array a

GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator c

An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation

The Lucky Wheel Giveaway plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includin

The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Code Injec

A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly va

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

The Easy PHP Settings plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0

Code injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privil

Improper Control of Generation of Code ('Code Injection') vulnerability in ILLID Advanced Woo Labels advanced-woo-labels

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versi

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace env

XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users.

The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows logging to a PHP file, which could allow an at

Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_s

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vul

An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may all

Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Information and Consulting Trade and

WWBN AVideo is an open source video platform. In versions up to and including 29.0, the server-side mitigation for the Y

Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization

A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to bypass a

CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw <?php …