VYPR

CWE-94

Improper Control of Generation of Code ('Code Injection')

BaseDraftLikelihood: Medium

Description

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Hierarchy (View 1000)

Related attack patterns (CAPEC)

CAPEC-242 · CAPEC-35 · CAPEC-77

CVEs mapped to this weakness (7,341)

page 285 of 368
  • CVE-2009-2637Jul 28, 2009
    Joomla
    BookLibrary
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in toolbar_ext.php in the BookLibrary (com_booklibrary) component 1.5.2.4 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2009-2635Jul 28, 2009
    Joomla
    RealEstateManager
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in toolbar_ext.php in the RealEstateManager (com_realestatemanager) component 1.0 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2009-2634Jul 28, 2009
    Joomla
    MediaLibrary
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in toolbar_ext.php in the MediaLibrary (com_media_library) component 1.5.3 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2009-2633Jul 28, 2009
    Joomla
    VehicleManager
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in toolbar_ext.php in the VehicleManager (com_vehiclemanager) component 1.0 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

  • CVE-2009-2399Jul 9, 2009
    Dutchmonkey
    Dm Filemanager
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in dm-albums/template/album.php in DM FileManager 3.9.4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter.

  • CVE-2009-2396Jul 9, 2009
    Dutchmonkey
    Dm Album
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter.

  • CVE-2009-2378Jul 8, 2009
    Jax
    FormMailer
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in formmailer.admin.inc.php in Jax FormMailer 3.0.0 allows remote attackers to execute arbitrary PHP code via a URL in the BASE_DIR[jax_formmailer] parameter.

  • CVE-2008-6849Jul 7, 2009
    phpGreetCards
    phpGreetCards
    risk 0.03cvss —epss 0.02

    Unrestricted file upload vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a via a link that is listed by userfiles/number_shell.php.

  • CVE-2009-2331Jul 5, 2009
    CMS Chainuk
    Chainuk
    risk 0.03cvss —epss 0.02

    Multiple static code injection vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to inject arbitrary PHP code (1) into settings.php via the menu parameter to admin_settings.php or (2) into a content/=NUMBER.php file via the title parameter to admin_new.php.

  • CVE-2008-6841Jul 1, 2009
    Joomla
    com_dbquery
    risk 0.03cvss —epss 0.06

    PHP remote file inclusion vulnerability in the Green Mountain Information Technology and Consulting Database Query (com_dbquery) component 1.4.1.1 and earlier for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to…

  • CVE-2008-6840Jul 1, 2009
    Christof Bruyland
    V Webmail
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in V-webmail 1.6.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) CONFIG[pear_dir] parameter to (a) Mail/RFC822.php, (b) Net/Socket.php, (c) XML/Parser.php, (d) XML/Tree.php, (e) Mail/mimeDecode.php,…

  • CVE-2009-2218Jun 25, 2009
    PhpCollegeExchange
    phpCollegeExchange
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in phpCollegeExchange 0.1.5c, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the home parameter to (1) i_head.php, (2) i_nav.php, (3) user_new_2.php, or (4) house/myrents.php;…

  • CVE-2009-2182Jun 23, 2009
    Sourcefabric
    Campsite
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in Campsite 3.3.0 RC1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[g_campsiteDir] parameter to (1) ad_popup.php, (2) camp_html.php, (3) init_content.php, (4) logout.php, (5) menu.php, and (6)…

  • CVE-2009-2169Jun 22, 2009
    Edraw
    PDF Viewer Component
    risk 0.03cvss —epss 0.04

    Insecure method vulnerability in the PDFVIEWER.PDFViewerCtrl.1 ActiveX control (pdfviewer.ocx) in Edraw PDF Viewer Component before 3.2.0.126 allows remote attackers to create and overwrite arbitrary files via a URL argument to the FtpConnect argument and a target filename…

  • CVE-2009-2111Jun 18, 2009
    DB Top Sites
    DB Top Sites
    risk 0.03cvss —epss 0.04

    Static code injection vulnerability in add_reg.php in DB Top Sites 1.0 allows remote attackers to inject arbitrary PHP code via a crafted (1) url and (2) location parameter.

  • CVE-2009-2095Jun 17, 2009
    Mundi Mail
    Mundi Mail
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in template/simpledefault/admin/_masterlayout.php in Mundi Mail 0.8.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the top parameter. NOTE: when allow_url_fopen is disabled,…

  • CVE-2009-1134Jun 10, 2009
    Microsoft
    Office
    risk 0.03cvss —epss 0.36

    Excel in 2007 Microsoft Office System SP1 and SP2; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a BIFF file with a malformed Qsir (0x806)…

  • CVE-2009-1946Jun 5, 2009
    Adaptcms
    Adaptbb
    risk 0.03cvss —epss 0.02

    PHP remote file inclusion vulnerability in latestposts.php in AdaptBB 1.0, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the forumspath parameter.

  • CVE-2009-1822May 29, 2009
    InterJoomla
    ArtForms
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) imgcaptcha.php or (2) mp3captcha.php in…

  • CVE-2009-1677May 18, 2009
    Bitweaver
    Bitweaver
    risk 0.03cvss —epss 0.02

    Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow (1) remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's "display name" setting and…