VYPR

CWE-94

Improper Control of Generation of Code ('Code Injection')

BaseDraftLikelihood: Medium

Description

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Hierarchy (View 1000)

Related attack patterns (CAPEC)

CAPEC-242 · CAPEC-35 · CAPEC-77

CVEs mapped to this weakness (7,568)

page 373 of 379
  • CVE-2007-5696Oct 29, 2007
    Phpbasic
    Phpbasic
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in includes.php in phpBasic allows remote attackers to execute arbitrary PHP code via a URL in the root parameter, possibly related to the Music module.

  • CVE-2007-5599Oct 19, 2007
    Awrate
    Awrate
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in awrate 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the toroot parameter to (1) 404.php or (2) topbar.php, different vectors than CVE-2006-6368.

  • CVE-2007-5593Oct 19, 2007
    Drupal
    Drupal
    risk 0.00cvss —epss 0.04

    install.php in Drupal 5.x before 5.3, when the configured database server is not reachable, allows remote attackers to execute arbitrary code via vectors that cause settings.php to be modified.

  • CVE-2007-5566Oct 18, 2007
    Phpblog
    Phpblog
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in PHPBlog 0.1 Alpha allow remote attackers to execute arbitrary PHP code via a URL in the blog_localpath parameter to (1) includes/functions.php or (2) includes/email.php. NOTE: this issue is disputed by CVE because the…

  • CVE-2007-5492Oct 17, 2007
    Sitebar
    Sitebar
    risk 0.00cvss —epss 0.01

    Static code injection vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to execute arbitrary PHP code via the value parameter.

  • CVE-2007-5425Oct 12, 2007
    Interspire
    Activekb
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in admin/index.php in Interspire ActiveKB 1.5 allows remote attackers to execute arbitrary SQL commands via the questId parameter in a hideQuestion ToDo action. NOTE: the catId vector is already covered by CVE-2007-5131.

  • CVE-2007-5418Oct 12, 2007
    Care2x
    2g
    risk 0.00cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in CARE2X 2G 2.2 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) en_copyrite.php, (2) vi_copyrite.php, and (3) ar_copyrite.php in language/ directories; (4) class_access.php, (5)…

  • CVE-2007-5389Oct 12, 2007
    Joomla
    Joomla!
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in preview.php in the swMenuFree (com_swmenufree) 4.6 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: a reliable third party disputes this issue because…

  • CVE-2007-5295Oct 9, 2007
    Wikepage
    Opus
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in (a) Wikepage Opus 13 2007.2 and (b) TipiWiki 2 allow remote attackers to inject arbitrary web script or HTML via the (1) PageContent and (2) PageName parameters.

  • CVE-2007-5224Oct 5, 2007
    Jimmac
    Original Photo Gallery
    risk 0.00cvss —epss 0.02

    inc/exif.inc.php in Original Photo Gallery 0.11.2 and earlier allows remote attackers to execute arbitrary programs via the exif_prog parameter, which is specified in an exec function call.

  • CVE-2007-5215Oct 4, 2007
    Jacob Hinkle
    Godsend
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in Jacob Hinkle GodSend 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the SCRIPT_DIR parameter to (1) gtk/main.inc.php or (2) cmdline.inc.php. NOTE: vector 2 is disputed by CVE because it is contained in…

  • CVE-2007-5216Oct 4, 2007
    E Ark
    E Ark
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in eArk (e-Ark) 1.0 allow remote attackers to execute arbitrary PHP code via a URL in (1) the cfg_vcard_path parameter to src/vcard_inc.php or (2) the cfg_phpmailer_path parameter to src/email_inc.php. NOTE: the ark_inc.php…

  • CVE-2007-5147Oct 1, 2007
    Puzzle Apps CMS
    Puzzle Apps CMS
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in Puzzle Apps CMS 2.2.1 allow remote attackers to execute arbitrary PHP code via a URL in the MODULEDIR parameter to (1) core/modules/my/my.module.php or (2) core/modules/xml/xml.module.php; the COREROOT parameter to (3)…

  • CVE-2007-5146Oct 1, 2007
    Der Dirigent
    Der Dirigent
    risk 0.00cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in dedi-group Der Dirigent 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the dedi_path parameter to (1) inc.generate_code.php, (2) fnc.type_forms.php, or (3) fnc.type.php in backend/inc/, or (4)…

  • CVE-2007-5167Oct 1, 2007
    Phplister
    Phplister
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in .systeme/fonctions.php in phpLister 0.5-pre2 allows remote attackers to execute arbitrary PHP code via a URL in the nom_rep_systeme parameter.

  • CVE-2007-5166Oct 1, 2007
    Sitesys
    Sitesys
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in SiteSys 1.0a allow remote attackers to execute arbitrary PHP code via a URL in the doc_root parameter to (1) inc/pagehead.inc.php or (2) inc/pageinit.inc.php.

  • CVE-2007-5165Oct 1, 2007
    Myipacng Stats
    Myipacng Stats
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in init.php in Jens Tkotz myIpacNG-stats (MINGS) 0.05 allows remote attackers to execute arbitrary PHP code via a URL in the MINGS_BASE parameter. NOTE: this issue is disputed by CVE because MINGS_BASE is defined before use

  • CVE-2007-5164Oct 1, 2007
    Universibo
    Universibo
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in htmls/forum/includes/topic_review.php in UniversiBO 1.3.4 allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter. NOTE: this issue is disputed by CVE because the applicable include is in a…

  • CVE-2007-5163Oct 1, 2007
    Nexty
    Nexty
    risk 0.00cvss —epss 0.01

    PHP remote file inclusion vulnerability in includes/functions/layout.php in Nexty 1.01.A Beta allows remote attackers to execute arbitrary PHP code via a URL in the rel parameter. NOTE: this issue is disputed by CVE because the applicable include is in a function that is not…

  • CVE-2007-5160Oct 1, 2007
    Restaurant Management System
    Restaurant Management System
    risk 0.00cvss —epss 0.01

    Multiple PHP remote file inclusion vulnerabilities in Thierry Leriche Restaurant Management System (ReMaSys) 0.5 allow remote attackers to execute arbitrary PHP code via a URL in (1) the DIR_ROOT parameter to (a) global.php, or the (2) DIR_PAGE parameter to (b)…