CWE-94
Improper Control of Generation of Code ('Code Injection')
Description
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-242 · CAPEC-35 · CAPEC-77
CVEs mapped to this weakness (7,295)
page 83 of 365| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-38896 | Cri | 0.57 | 9.8 | 0.02 | Aug 15, 2023 | An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions. | ||
| CVE-2023-38860 | Cri | 0.57 | 9.8 | 0.01 | Aug 15, 2023 | An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. | ||
| CVE-2023-36095 | Cri | 0.57 | 9.8 | 0.01 | Aug 5, 2023 | An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt. | ||
| CVE-2023-38943 | Hig | 0.57 | 8.8 | 0.02 | Aug 5, 2023 | ShuiZe_0x727 v1.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /iniFile/config.ini. | ||
| CVE-2023-39020 | Cri | 0.57 | 9.8 | 0.01 | Jul 28, 2023 | stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument. | ||
| CVE-2023-39010 | Cri | 0.57 | 9.8 | 0.01 | Jul 28, 2023 | BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load. This vulnerability is exploited by loading a crafted camera calibration file. | ||
| CVE-2023-22506 | Hig | 0.57 | 8.8 | 0.02 | Jul 19, 2023 | This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center. This Injection and RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.5, allows an authenticated attacker… | ||
| CVE-2023-37466 | Cri | 0.57 | 9.8 | 0.04 | Jul 14, 2023 | vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the… | ||
| CVE-2023-35333 | Hig | 0.57 | 8.8 | 0.01 | Jul 11, 2023 | MediaWiki PandocUpload Extension Remote Code Execution Vulnerability | ||
| CVE-2023-37659 | Cri | 0.57 | 9.8 | 0.02 | Jul 11, 2023 | xalpha v0.11.4 is vulnerable to Remote Command Execution (RCE). | ||
| CVE-2023-36859 | Hig | 0.57 | 8.8 | 0.01 | Jul 6, 2023 | PiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands. | ||
| CVE-2023-36258 | Cri | 0.57 | 9.8 | 0.01 | Jul 3, 2023 | An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used. | ||
| CVE-2023-33570 | Hig | 0.57 | 8.8 | 0.01 | Jun 28, 2023 | Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI). | ||
| CVE-2023-32528 | Hig | 0.57 | 8.8 | 0.03 | Jun 26, 2023 | Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system… | ||
| CVE-2023-32527 | Hig | 0.57 | 8.8 | 0.03 | Jun 26, 2023 | Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system… | ||
| CVE-2023-35152 | Cri | 0.57 | 9.9 | 0.01 | Jun 23, 2023 | XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The… | ||
| CVE-2023-2359 | Hig | 0.57 | 8.8 | 0.03 | Jun 19, 2023 | The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations. | ||
| CVE-2023-35809 | Hig | 0.57 | 8.8 | 0.01 | Jun 17, 2023 | An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By using a crafted request, custom PHP code can be injected through the REST API because of missing input validation.… | ||
| CVE-2023-32692 | Cri | 0.57 | 9.8 | 0.01 | May 30, 2023 | CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also… | ||
| CVE-2023-30130 | Hig | 0.57 | 8.8 | 0.01 | May 12, 2023 | An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter. |
- risk 0.57cvss 9.8epss 0.02
An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions.
- risk 0.57cvss 9.8epss 0.01
An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter.
- risk 0.57cvss 9.8epss 0.01
An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.
- risk 0.57cvss 8.8epss 0.02
ShuiZe_0x727 v1.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /iniFile/config.ini.
- risk 0.57cvss 9.8epss 0.01
stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument.
- risk 0.57cvss 9.8epss 0.01
BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load. This vulnerability is exploited by loading a crafted camera calibration file.
- risk 0.57cvss 8.8epss 0.02
This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center. This Injection and RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.5, allows an authenticated attacker…
- risk 0.57cvss 9.8epss 0.04
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the…
- risk 0.57cvss 8.8epss 0.01
MediaWiki PandocUpload Extension Remote Code Execution Vulnerability
- risk 0.57cvss 9.8epss 0.02
xalpha v0.11.4 is vulnerable to Remote Command Execution (RCE).
- risk 0.57cvss 8.8epss 0.01
PiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands.
- risk 0.57cvss 9.8epss 0.01
An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used.
- risk 0.57cvss 8.8epss 0.01
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).
- risk 0.57cvss 8.8epss 0.03
Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system…
- risk 0.57cvss 8.8epss 0.03
Trend Micro Mobile Security (Enterprise) 9.8 SP5 contains vulnerable .php files that could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system…
- risk 0.57cvss 9.9epss 0.01
XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The…
- risk 0.57cvss 8.8epss 0.03
The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations.
- risk 0.57cvss 8.8epss 0.01
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By using a crafted request, custom PHP code can be injected through the REST API because of missing input validation.…
- risk 0.57cvss 9.8epss 0.01
CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also…
- risk 0.57cvss 8.8epss 0.01
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.