CWE-94

The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not

acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.

vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for prod

RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauth

Unauthenticated remote code execution

BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.Calibration

Duke v1.2 and below was discovered to contain a code injection vulnerability via the component no.priv.garshol.duke.serv

webmagic-extension v0.9.0 and below was discovered to contain a code injection vulnerability via the component us.codecr

bboss-persistent v6.0.9 and below was discovered to contain a code injection vulnerability in the component com.framewor

quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee

FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg

stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.

wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.my

oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.

university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compas

Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204

Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in

An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter.

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username

Hidden functionality vulnerability in LAN-W300N/RS all versions, and LAN-W300N/PR5 all versions allows an unauthenticate

user_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (and on all versions of Vigor2925 devices) allows attackers t

An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a craft

An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This

Installer RCE on settings file write in MyBB before 1.8.22.

An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function

Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the

The Imou Life com.mm.android.smartlifeiot application through 6.8.0 for Android allows Remote Code Execution via a craft

The wave.ai.browser application through 1.0.35 for Android allows a remote attacker to execute arbitrary JavaScript code

Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a remote code exe

dst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the userId parameter at /h

xunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php. This vulnera

SeaCMS v12.8 has an arbitrary code writing vulnerability in the /jxz7g2/admin_ping.php file.

DedeBIZ v6.2.11 was discovered to contain multiple remote code execution (RCE) vulnerabilities at /admin/file_manage_con

An issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.m

cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adv

A vulnerability has been identified in Simcenter Amesim (All versions < V2021.1). The affected application contains a SO

Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Ba

eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the Gii code generato

An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinf

An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege,

An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component.

An issue in Contec SolarView Compact v.6.0 and before allows an attacker to execute arbitrary code via the texteditor.ph

When malicious images are pulled by isula pull, attackers can execute arbitrary code.

baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in

An issue in lmxcms v.1.41 allows a remote attacker to execute arbitrary code via a crafted script to the admin.php file.

An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privile

WeBid <=1.2.2 is vulnerable to code injection via admin/categoriestrans.php.