CWE-94: Improper Control of Generation of Code (Code Injection), page 99

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

What the weakness is: CWE-94 at MITRE

1. 8.3CVE-2021-42574EPSS 13%2021-11-01

   An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic tha…

2. 7.5CVE-2021-36985EPSS 0.7%2021-10-28

   There is a Code injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may exhaust system resources and cause the system to restart.

3. 7.2CVE-2021-41619EPSS 2.7%2021-10-27

   An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configuration. The installation configuration user interface (available to administrators) allows specifying…

4. 8.8CVE-2021-38450EPSS 1.0%2021-10-27

   The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

5. 9.8CVE-2020-23037EPSS 1.5%2021-10-22

   Portable Ltd Playable v9.18 contains a code injection vulnerability in the filename parameter, which allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.

6. 9.8CVE-2021-22961EPSS 1.7%2021-10-18

   A code injection vulnerability exists within the firewall software of GlassWire v2.1.167 that could lead to arbitrary code execution from a file in the user path on first execution.

7. 8.8CVE-2021-29679EPSS 2.0%2021-10-15

   IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a a server-side include (SSI) directive. IBM X-Force ID: 1999…

8. 8.1CVE-2021-40487EPSS 48%2021-10-13

   Microsoft SharePoint Server Remote Code Execution Vulnerability

9. 7.8CVE-2021-40485EPSS 2.7%2021-10-13

   Microsoft Excel Remote Code Execution Vulnerability

10. 9.8CVE-2021-40499EPSS 1.2%2021-10-12

    Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, 7.70 BYD, allow an attacker to inject code that can be executed by the application. An attacker cou…

11. 8.8CVE-2021-24546EPSS 1.8%2021-10-11

    The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP c…

12. 9.8CVE-2021-40889EPSS 1.8%2021-10-11

    CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. sauvePass action in {webroot}/uno/central.php file calls to file_put_contents() function to write username in password.php file when a user successfully changed their …

13. 9.8CVE-2021-42139EPSS 2.1%2021-10-11

    Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations.

14. 9.8CVE-2020-21652EPSS 2.8%2021-10-06

    Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\Config.php, which can be exploited via the addqq() method.

15. 9.8CVE-2020-21651EPSS 3.3%2021-10-06

    Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\point.php, which can be exploited via the add() method.

16. 8.8CVE-2020-21650EPSS 3.2%2021-10-06

    Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\Config.php, which can be exploited via the add() method.

17. 7.9CVE-2021-25470EPSS 0.1%2021-10-06

    An improper caller check logic of SMC call in TEEGRIS secure OS prior to SMR Oct-2021 Release 1 can be used to compromise TEE.

18. 7.8CVE-2021-22557ExploitEPSS 1.6%2021-10-04

    SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pul…

19. 9.8CVE-2021-40323ExploitEPSS 87%2021-10-04

    Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.

20. 8.8CVE-2020-20124EPSS 2.9%2021-09-28

    Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php.

21. 8.8CVE-2021-22952EPSS 1.0%2021-09-23

    A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk device(s) assigned to said network if they are not yet adopted. This vuln…

22. 7.1CVE-2021-3583EPSS 0.9%2021-09-22

    A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handl…

23. 7.2CVE-2021-39402EPSS 1.3%2021-09-20

    MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page for all authenticated and unauthenticated visitors.

24. 7.2CVE-2021-39128EPSS 2.6%2021-09-16

    Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in t…

25. 6.8CVE-2021-33693EPSS 0.5%2021-09-15

    SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malicious codes that could potentially lead to OS command execution.

26. 9.8CVE-2021-40373EPSS 4.7%2021-09-10

    playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then executing that code via the index.php?app=main&inc=core_welcome URI.

27. 8.1CVE-2021-32836EPSS 2.0%2021-09-09

    ZStack is open source IaaS(infrastructure as a service) software. In ZStack before versions 3.10.12 and 4.1.6 there is a pre-auth unsafe deserialization vulnerability in the REST API. An attacker in control of the request body will be able…

28. 9.9CVE-2021-32834EPSS 0.9%2021-09-09

    Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can run arbitrary code by sending malicious Groovy scripts which will escape the con…

29. 7.2CVE-2021-39503EPSS 2.8%2021-09-07

    PHPMyWind 5.6 is vulnerable to Remote Code Execution. Becase input is filtered without "<, >, ?, =, `,...." In WriteConfig() function, an attacker can inject php code to /include/config.cache.php file.

30. 7.2CVE-2021-39115EPSS 4.5%2021-09-01

    Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vul…

31. 7.2CVE-2021-32831EPSS 1.5%2021-08-30

    Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework before version 3.4.9, calling the utils.set function…

32. 9.8CVE-2021-29772EPSS 0.9%2021-08-26

    IBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code due to unsanitized user input. IBM X-Force ID: 202774.

33. 7.2CVE-2020-19822EPSS 2.8%2021-08-26

    A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title" parameters.

34. 9.8CVE-2021-39159EPSS 1.9%2021-08-25

    BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, w…

35. 8.8CVE-2021-39160EPSS 1.7%2021-08-25

    nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolv…

36. 9.8CVE-2021-40084EPSS 2.9%2021-08-25

    opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specificat…

37. 8.5CVE-2021-39144KEVExploitEPSS 98%2021-08-23

    XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stre…

38. 8.8CVE-2020-22120EPSS 2.5%2021-08-18

    A remote code execution (RCE) vulnerability in /root/run/adm.php?admin-ediy&part=exdiy of imcat v5.1 allows authenticated attackers to execute arbitrary code.

39. 9.8CVE-2020-22937EPSS 2.8%2021-08-17

    A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious code to the install file.

40. 6.8CVE-2021-3615EPSS 0.3%2021-08-17

    A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attached SD card. This vulnerability is the same as CNVD-2021-45262.

41. 9.9CVE-2021-32829EPSS 2.9%2021-08-17

    ZStack is open source IaaS(infrastructure as a service) software aiming to automate datacenters, managing resources of compute, storage, and networking all by APIs. Affected versions of ZStack REST API are vulnerable to post-authentication…

42. 5.3CVE-2021-32822EPSS 1.0%2021-08-16

    The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data w…

43. 5.4CVE-2021-32809EPSS 1.2%2021-08-12

    ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste …

44. 7.2CVE-2021-37626EPSS 1.3%2021-08-11

    Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they ha…

45. 7.8CVE-2021-37694EPSS 0.9%2021-08-11

    @asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream (SCSt) microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GH…

46. 9.8CVE-2021-38196EPSS 2.6%2021-08-08

    An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose.

47. 9.1CVE-2021-36800EPSS 1.5%2021-08-04

    Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application. A POST sent to /{company_id}/sales/invoices/{invoice_id} with an items[0][price] that includes a PHP callable function …

48. 8.8CVE-2021-32706ExploitEPSS 60%2021-08-04

    Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character thro…

49. 8.8CVE-2021-31630EPSS 27%2021-08-03

    Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the "Hardware Layer Code Box" component on the "/hardware" page of the application.

50. 7.2CVE-2021-24430EPSS 1.7%2021-08-02

    The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its caching_exclude_urls and caching_include_query_strings settings before outputting them in a PHP file, which could lead to RCE