CWE-94

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text oper

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resour

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's protot

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lack

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup fun

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain s

Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 - The PHP

Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2.

Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUpdateCommen

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to e

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. Whil

Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without res

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnera

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe impor

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on

ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue c

Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthentic

Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Ark Theme Core ark-core allows Code

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to exec

Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to exec

Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework all

Improper Control of Generation of Code ('Code Injection') vulnerability in kellydiek DigiWidgets Image Editor digiwidget

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from vers

IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the at

Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The

Improper Control of Generation of Code ('Code Injection') vulnerability in Holest Engineering Spreadsheet Price Changer

Remote code execution that allows unauthorized users to execute arbitrary code on the server machine.

Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.jso

On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the

Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson Easy Stripe easy-stripe allows

A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the

Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare() function, which uses preg_replac

Improper Control of Generation of Code ('Code Injection') vulnerability in thehp Global DNS global-dns allows Remote Cod

Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-2329

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application shoul

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vu