CWE-94

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, he

The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the

XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting

XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Start

HHEE system has a Code Injection vulnerability.Successful exploitation of this vulnerability may affect HHEE system inte

Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and

iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code

A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.

A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php

The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to w

CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the saveConfigData function in /

fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote c

A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware v

taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file.

DWSurvey v3.2.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /sysuser/SysP

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[

IonizeCMS v1.0.8.1 was discovered to contain a command injection vulnerability via the function copy_lang_content in app

A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via i

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Si

The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter

PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the function parserIfLabel at

The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted

EllieGrid Android Application version 3.4.1 is vulnerable to Code Injection. The application appears to evaluate user in

Windows Network File System Remote Code Execution Vulnerability

An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modify

DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php.

Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially craft

DIR845L A1 v1.00-v1.03 is vulnerable to command injection via /htdocs/upnpinc/gena.php.

TRENDnet TEW733GR v1.03B01 is vulnerable to Command injection via /htdocs/upnpinc/gena.php.

An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule

In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.

In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in un

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewa

This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 1

Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installat

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The s

GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file paramete

Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig tem

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/S

Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI

ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component UPFILE_PIC_ZOO

ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRI

ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component IS_GETCACHE.

In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-