CWE-506

Embedded Malicious Code

ClassIncomplete

Description

The product contains code that appears to be malicious in nature.

Malicious flaws have acquired colorful names, including Trojan horse, trapdoor, timebomb, and logic-bomb. A developer might insert malicious code with the intent to subvert the security of a product or its host system at some time in the future. It generally refers to a program that performs a useful service but exploits rights of the program's user in a way the user does not intend.

Hierarchy (View 1000)

Parents

CWE-912

Children

Related attack patterns (CAPEC)

CAPEC-442 · CAPEC-448 · CAPEC-636

CVEs mapped to this weakness (103)

page 6 of 6

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2021-22887	Pulsesecure PSA5000	Low	0.15	2.3	0.00	Mar 16, 2021	A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of an attack chain. Before an attacker can compromise the BIOS, they must exploit…
CVE-2026-67595	Webreinvent vaahcms	Hig	0.00	8.1	0.01	Jul 29, 2026	VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template…
CVE-2026-18072	WordPress Advanced Responsive Video Embedder	Cri	0.00	9.8	0.03	Jul 29, 2026	The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on…

CVE-2021-22887LowMar 16, 2021
Pulsesecure
PSA5000
risk 0.15cvss 2.3epss 0.00
A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of an attack chain. Before an attacker can compromise the BIOS, they must exploit…
CVE-2026-67595HigJul 29, 2026
Webreinvent
vaahcms
risk 0.00cvss 8.1epss 0.01
VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template…
CVE-2026-18072CriJul 29, 2026
WordPress
Advanced Responsive Video Embedder
risk 0.00cvss 9.8epss 0.03
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on…