CWE-94

A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitr

Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative privileges can achie

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulne

CubeCart is an ecommerce software solution. Prior to 6.7.0, an Authenticated Server-Side Template Injection (SSTI) vulne

Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12.0.0 to before 12.32

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a

OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptRe

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user

Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.

JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressi

An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php compon

Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.

Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter

Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs a

Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamica

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/

In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible

Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.

SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier version

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticat

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiv

Improper Control of Generation of Code ('Code Injection') vulnerability in Vollstart Event Tickets with Ticket Scanner e

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, a second-order expres

Improper Control of Generation of Code ('Code Injection') vulnerability in Marketing Fire Widget Options widget-options

SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in a

SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious note synced to another user can trigger re

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, Mermaid diagrams are rendere

Improper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesa

Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant admin

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security co

Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might a

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape the untrusted fields (

The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request hand

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, al

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authentic

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input o

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /ses

The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an impl

muffon is a cross-platform music streaming client for desktop. Versions prior to 2.3.0 have a one-click Remote Code Exec

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway

An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-up

The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scr

Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was

OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to

vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to versio

Open WebUI load_tool_module_by_id Command Injection Remote Code Execution Vulnerability. This vulnerability allows remot