Code Injection
Monthly
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites.". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 42.1%.
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 89.2%.
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 87.0%.
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.6%.
The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.5%.
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9, 8.1, 9.0, and 9.1 allows remote attackers to execute arbitrary commands via a crafted request to TCP port 3465. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 88.3%.
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 68.3%.
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter, which might allow remote attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.6%.
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.9%.
project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 52.4%.
lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to index.php, which is processed by the preg_replace. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 66.0%.
displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.2%.
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 49.7%.
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 84.2%.
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.2%.
The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the edit[content] parameter to index.php/HeIp. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.6%.
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) update_system_info_debian_package, (2) ossec_task, (3). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.3%.
DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a preg_replace function call with an e modifier. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.1%.
The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function or (2) sourcemap parameter to the sourcemap. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 80.5%.
GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 71.0%.
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.3%.
An unspecified ActiveX control in WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 allows remote attackers to download arbitrary DLL code onto a client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 60.5%.
op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 90.0%.
license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the timestamp parameter for. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 87.2%.
Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.5%.
Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.
Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 70.9%.
Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.0%.
admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parameter during a ping operation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 71.9%.
The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 69.5%.
GDI+ in Microsoft Windows and Office fails to properly handle TIFF images, allowing remote code execution through crafted documents, actively exploited in targeted attacks against Pakistani and Middle Eastern organizations.
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 49.4%.
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.5%.
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 83.6%.
HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary code via a crafted screensaver in a theme file,. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 82.2%.
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 60.9%.
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 87.6%.
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2). Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 91.1%.
VMware vCenter Chargeback Manager (aka CBM) before 2.5.1 does not proper handle uploads, which allows remote attackers to execute arbitrary code via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.9%.
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.3%.
An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310, R410.1, and R410.2; ComfortPoint Open Manager (aka CPO-M). Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 61.4%.
An ActiveX control in gwcls1.dll in the client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code via (1) a pointer argument to the. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 68.3%.
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.0%.
Eval injection vulnerability in the ldapagnt_eval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote attackers to execute arbitrary Perl code. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 49.8%.
The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.6%.
phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 87.9%.
Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 64.8%.
The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.7%.
The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.6%.
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.3%.
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Same ID Property Remote Code. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 82.2%.
Remote code execution in Microsoft MSCOMCTL.OCX ActiveX controls allows unauthenticated attackers to execute arbitrary code via maliciously crafted Office documents, RTF files, or web pages. Actively exploited since April 2012 and confirmed in CISA KEV catalog. Despite being patched in 2012, EPSS score of 94.32% (100th percentile) indicates continued exploitation attempts against unpatched systems. Affects broad Microsoft product ecosystem including Office 2003-2010, SQL Server 2000-2008 R2, BizTalk, Commerce Server, Visual FoxPro, and Visual Basic 6.0 Runtime.
The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 92.6%.
Code injection in Vim enables local arbitrary code execution when a user opens a specially crafted file, affecting versions prior to the fix packaged as 9.2.0481-r0 on Alpine Linux and addressed separately under Ubuntu USN-8415-1. The vulnerability (CWE-94) arises from improper control over code generation within Vim's scripting or modeline processing, allowing an attacker who can deliver a malicious file to achieve full compromise of confidentiality, integrity, and availability on the target system. No public exploit has been identified at time of analysis, and the EPSS score of 0.01% (3rd percentile) suggests negligible current exploitation activity despite the High CVSS rating.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbitrary code on the server, with the issue fixed in Gitea 1.27.1 (Alpine package 1.27.1-r0). The vulnerability is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, including a Nuclei detection template and a proof-of-concept repository. With a CVSS 9.8 network/no-auth vector, any internet-exposed unpatched Gitea instance is at immediate, high risk of full compromise.
In the Linux kernel, the following vulnerability has been resolved: arm64: Don't read GMID_EL1 when MTE is disabled __cpuinfo_store_cpu() gates the GMID_EL1 read on the raw ID_AA64PFR1_EL1, so it reads the register even when the kernel has disabled MTE (CONFIG_ARM64_MTE=n or arm64.nomte). KVM sets HCR_EL2.TID5 in that case, and pKVM injects an UNDEF the host cannot handle: Internal error: Oops - Undefined instruction: 0000000002000000 [#1] SMP pc : __cpuinfo_store_cpu+0xf4/0x264 Kernel panic - not syncing: Attempted to kill the idle task! Only pKVM reaches it, and only after a CPU is offlined and brought back online: its CPU_ON relay sets the host HCR before the CPU enters EL1, while plain nVHE sets it at CPUHP_AP_KVM_ONLINE. Gate the read on the CPU's own ID_AA64PFR1_EL1 with the command-line override applied, and on CONFIG_ARM64_MTE, which no register reflects. The boot CPU stores its registers before init_cpu_features() strips an unsafe override, so clamp against the hardware value here too.
The Xpro Addons - 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.
CSS injection in the A2UI Angular Renderer (a2ui-project/a2ui through 0.10.6) lets a party who controls server-to-client messages embed arbitrary strings in the theme.primaryColor field, which the renderer writes unvalidated into the host element's --a2ui-color-primary CSS custom property. Because the theme is declared with z.any() in renderers/web_core/src/v0_9/schema/server-to-client.ts, values such as url(https://attacker.example/beacon) bypass validation and reach the DOM style layer, enabling UI spoofing, outbound request beacons and potential data exfiltration from affected Angular applications. Exploitation requires the ability to inject or manipulate the message stream consumed by the renderer (PR:L) plus a passive user action (UI:P); the vendor has published fix commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b (PR #2367). There is no CISA KEV listing and no public exploit identified at time of analysis.
Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Cookie attribute injection in http4s's ResponseCookie.render allows any application that builds a response cookie from unvalidated input to emit attacker-controlled Domain, Path, or SameSite attributes — widening cookie scope or stripping protections — while embedded control characters can enable HTTP header splitting on permissive backends. All applications using http4s versions before 0.23.35 or 1.0.0-M47 that feed untrusted data into the name, content, domain, path, or extension fields of a ResponseCookie are in scope. No public exploit code and no active exploitation were identified at time of analysis, and the moderate CVSS base of 4.8 reflects the high-complexity precondition that the consuming application must itself pass unsanitized input into the cookie constructor.
Parameter smuggling into the PayPal notify redirect of the J2Store extension for Joomla (versions 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7) lets an attacker-chosen query string ride along with the redirect that the notify endpoint issues to com_j2store's checkout controller, instead of the intended fixed parameter set. A victim must load the crafted link (UI:P in the CVSS 4.0 vector), after which the follow-up request to the checkout controller is processed with the injected view/task/paction parameters, giving a limited integrity impact (VI:L) with no confidentiality or availability loss. The vendor's own description concedes this does not grant an unauthenticated attacker anything they could not obtain by calling the same com_j2store URL directly; no public exploit code and no CISA KEV listing were identified in the supplied intelligence.
IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services.
Control-character injection in gitoxide's gix-transport crate before version 0.59.2 lets crafted git-daemon URLs smuggle NUL, CR and LF bytes into connect requests, enabling spoofing of virtual hosts and injection of forged newlines into daemon requests and logs. The flaw affects any Rust application or tool that uses gix-transport to open a git:// connection to a URL whose host or path components are attacker-influenced, and requires the victim to initiate that connection (UI:P). Impact is limited to low confidentiality and integrity effects (5.3 Medium), no public exploit code or CISA KEV entry is present in the supplied intelligence, and a vendor advisory with a fixed release is available.
IBM WebSphere Application Server 9.0 and 8.5 fail to neutralize CRLF and other control characters coming from remote input before writing them into the server's administrative log, letting an unauthenticated network attacker insert forged log entries (CWE-117, improper output neutralization for logs). The CVSS 3.1 score of 5.3 reflects low integrity impact only - confidentiality and availability are unaffected and no code execution is possible - but falsified administrative logs can mask real activity and mislead incident responders. IBM has published a fix (support page node 7286610); there is no CISA KEV listing and no public exploit identified at time of analysis, though CISA's SSVC assessment marks the issue as automatable.
Log injection in IBM WebSphere Application Server 8.5 and 9.0 lets a remote attacker forge entries in the server's administrative log, undermining the integrity of audit records used for monitoring and forensics. The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N) and stems from improper neutralization of log output (CWE-117). IBM has published a vendor fix, and no public exploit code or CISA KEV listing was identified at time of analysis.
Argument injection in HKUDS nanobot's ExecTool shell execution guard allows remote unauthenticated attackers to bypass the command allowlist/denylist filter by embedding newline or carriage-return characters in a command string, causing injected shell segments to execute without inspection. Affected versions are nanobot 0.2.0 and 0.2.1; the root cause is that `_split_shell_segments()` recognized `;` and `|` as command-chain delimiters but not `\n` or `\r`, so a payload on its own line was never checked against allow/deny patterns. No public exploit or CISA KEV listing is identified; patch commit af582246 is available.
Comment-injection in the OpenZeppelin Contracts Wizard code generators lets a newline character embedded in the `info.securityContact` or `info.license` option break out of the single-line `//` comment and be emitted as live source declarations in generated Solidity, Cairo, Stellar/Soroban, and Stylus contracts. Only integrations that populate those two fields from untrusted input and then hand the generated source to a downstream consumer are affected — the self-service web app, AI assistant, CLI, and self-hosted API all use user-supplied values and never cross that trust boundary, and shared links cannot set the fields. The flaw is integrity-only (CVSS 3.3, CWE-94): no code executes on any Wizard service, no public exploit is identified in the supplied data, and patched packages are available as @openzeppelin/wizard 0.10.11, wizard-cairo 3.0.1, wizard-stellar 0.6.2, and wizard-stylus 0.3.1.
Apache Syncope contains a Groovy sandbox bypass (CWE-94 code injection) that lets an administrator holding entitlements over the Implementations console register a malicious Groovy Command class whose untrusted code executes in a static CommandArgs initializer, escaping the intended script sandbox. Affected releases span 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; exploitation requires a privileged, already-authenticated administrator account (CVSS 3.1 vector PR:H, score 6.5) rather than an anonymous attacker. There is no public exploit identified and the vulnerability is not in CISA KEV, but because Syncope is an identity governance and provisioning platform, successful abuse yields high confidentiality and integrity impact over managed identity data - CISA's SSVC assessment rates technical impact as 'total' while noting exploitation has not been observed and the attack is not automatable.
Remote code execution in Yot CMS 3.3.0 and 3.3.1 is achievable by an authenticated administrator through the Admin Console's unsanitized use of PHP's eval() function in modsys/console/admin.php, where the text POST parameter is passed directly to eval() without validation. A publicly available proof-of-concept on GitHub demonstrates the attack. Despite the technically accurate RCE classification, exploitation is gated behind high-privilege (administrator) authentication, substantially reducing practical risk compared to the tag alone suggests.
Remote code execution in cym1102 nginxWebUI up to 4.4.2 is achievable by any authenticated user via the `autoUpdate` endpoint, which accepts an arbitrary `url` parameter and downloads and executes the resulting JAR file on the host OS without domain validation. A public proof-of-concept is disclosed in GitHub issue #213, and a fix exists only as an unmerged PR (#215) - no released patched version has been confirmed. The CVSS 4.0 low-impact metrics (VC:L/VI:L/VA:L) conflict materially with the actual RCE capability.
Code injection in sanjevirau gsubs (Electron application) up to version 1.0.3 allows remote attackers to execute arbitrary code by manipulating the filename argument passed to the showQuerySuccessPage function in renderer/index.js. The vulnerability exists in the Electron renderer process and requires passive user interaction to trigger. A public proof-of-concept exploit has been published on GitHub; no patch has been released and the vendor was unresponsive during coordinated disclosure.
Remote code execution in Xuxueli xxl-job up to version 3.4.2 allows authenticated low-privileged users to execute arbitrary code on the executor host via the GLUE mode Groovy script handler in GlueFactory.java. The root cause is that GroovyClassLoader.parseClass processes attacker-supplied Groovy source directly, compiling and running it without a restrictive sandbox. A public proof-of-concept exploit targeting v3.4.2 has been released on GitHub, and the vendor did not respond to the coordinated disclosure.
In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, each fs root gets a reference to its relocation root. If loading or adding a later root fails, or if the first transaction commit fails, btrfs_recover_relocation() jumps to out_unset before merge_reloc_roots() and clean_dirty_subvols(). put_reloc_control() drops the list-owned relocation root references, but it does not clear fs_root->reloc_root or drop the references owned by those pointers. Mount cleanup only drops them when BTRFS_FS_ERROR is set, so an error such as -ENOMEM while processing a later root can leave references behind. Keep temporary references to the fs roots associated during recovery. On failure, clear their reloc_root pointers and drop the corresponding references. Once the first transaction commit succeeds, drop only the temporary fs root references and let the normal merge and cleanup paths handle the relocation roots. Fault injection on a pending-relocation image confirmed the cleanup gap. With an injected first-commit failure, 25 fs roots had reloc_root set with fs_error=0. With this fix, the same failure path drops that count to 0 before mount fails.
Server-side template injection (SSTI) in Arma Digital Media Inc.'s Website Template product enables remote unauthenticated attackers to inject template engine expressions that are evaluated server-side, achieving code injection. All versions through build 11092026 are affected, and the vendor did not respond to TR-CERT's responsible disclosure, leaving no vendor-released patch available. No public exploit or CISA KEV listing has been identified at time of analysis.
Argument injection in Pardus Pen before version 4.2.1 allows a local, low-privileged user to inject unsanitized argument delimiters into an underlying command invocation, yielding limited integrity impact. The flaw (CWE-88) is strictly local in scope-CVSS AV:L/PR:L-and carries no confidentiality or availability consequence per the published vector. No public exploit code and no active exploitation have been identified; vendor-released patch 4.2.1 is available via the TR-CERT advisory.
Email header injection in MetForm WordPress plugin before 4.1.9 allows unauthenticated attackers to inject arbitrary SMTP headers - such as Bcc - into notification emails dispatched by the site, by embedding newline characters in form field submissions that are configured to populate those headers. This enables silent exfiltration of form submission content to attacker-controlled addresses and potential abuse of the site as a spam relay. No public exploit code or CISA KEV listing exists; the CVSS 4.8 with AC:H correctly reflects the configuration prerequisite that limits the exploitable surface.
CSV formula injection in WWBN AVideo (through commit c3edcc274) enables authenticated users to embed spreadsheet formula payloads in comments that execute when administrators or video owners open exported CSV files from the myComments.download.php endpoint. The unsanitized comment text containing =, +, -, or @ prefixes is written directly into the CSV output, which spreadsheet applications interpret as executable expressions. Depending on the victim's application and security settings, this can chain to OS command execution via DDE or similar mechanisms, elevating a low-privilege user's impact to the admin's local session. No public exploit has been identified and it is not listed in CISA KEV.
Unauthenticated content injection in the Simple Cloudflare Turnstile WordPress plugin (versions <= 1.42.1) allows remote attackers without any credentials to inject arbitrary content into affected WordPress sites. Reported by Patchstack and classified under CWE-94 (Code Injection), the flaw exposes sites to partial confidentiality and integrity compromise (CVSS C:L/I:L) via a network-accessible attack requiring no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Set-Cookie attribute injection in the `cookies` Node.js library (versions before 0.9.2) enables an attacker to override cookie security attributes - SameSite, Secure, HttpOnly, or Domain - by embedding semicolons in the `domain` or `path` option when those options are populated from untrusted or request-derived data. Applications built on Koa (which delegates cookie handling to this library via `ctx.cookies`) represent the primary at-risk population. No public exploit or active exploitation has been identified; real-world impact is gated on an application-level antipattern of passing user-controlled data to these options.
Code injection in AppFlowy 0.11.8 allows arbitrary code execution through insufficient URI and local path validation in the application's file-launch and URL-handling subsystems. The vulnerability exists in the Flutter-based desktop/mobile productivity app's afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, and localPathRegex (common_patterns.dart) components, where inadequate sanitization of URI schemes or local file paths enables an attacker to trigger execution of arbitrary code. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CWE-94 classification confirms the root cause as a code injection pattern rather than a memory-safety issue.
CSV formula injection in Snipe-IT through 8.6.3 allows authenticated low-privilege users to plant spreadsheet formulas in the unaccepted assets acceptance report export, which execute in the spreadsheet client of any privileged user who downloads and opens the file. The ReportsController::postAssetAcceptanceReport method builds its CSV output by hand without applying the League\Csv\EscapeFormula sanitizer already wired into the six sibling exports in the same controller, permitting injection of =, +, -, @, tab, or CR-prefixed values into free-text fields such as asset name, company name, category, model, or assignee. When a reports.view-privileged user opens the resulting file in Excel, LibreOffice Calc, or Google Sheets, injected functions such as HYPERLINK or WEBSERVICE can exfiltrate spreadsheet context to an attacker-controlled server; on legacy Windows Excel configurations with DDE enabled, arbitrary command execution on the victim's workstation is also achievable. Fixed in version 8.7.0; no public exploit identified at time of analysis.
Script injection via improper sanitization of special characters in Dell Secure Connect Gateway 5.0 allows unauthenticated remote attackers to inject script content, resulting in limited confidentiality exposure. Both the Appliance form factor (versions prior to 5.36.00.16) and the Application form factor (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has issued a vendor-confirmed patch under advisory DSA-2026-382.
LDAP injection in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) allows attackers to inject malicious LDAP query elements, leading to script injection against the underlying directory service. The CPE data confirms two distinct deployment forms are affected: the virtual Appliance (fixed at 5.36.00.16) and the Application (fixed at 5.36.00.00), both covered under Dell advisory DSA-2026-382. Critically, the description characterizes the attacker as unauthenticated, but the provided CVSS vector specifies PR:H - a direct contradiction that must be clarified with Dell before this vulnerability is triaged or deprioritized.
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites.". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 42.1%.
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 89.2%.
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 87.0%.
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.6%.
The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.5%.
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9, 8.1, 9.0, and 9.1 allows remote attackers to execute arbitrary commands via a crafted request to TCP port 3465. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 88.3%.
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 68.3%.
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter, which might allow remote attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.6%.
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.9%.
project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 52.4%.
lib/message.php in X7 Chat 2.0.0 through 2.0.5.1 allows remote authenticated users to execute arbitrary PHP code via a crafted HTTP header to index.php, which is processed by the preg_replace. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 66.0%.
displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.2%.
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 49.7%.
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 84.2%.
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.2%.
The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the edit[content] parameter to index.php/HeIp. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.6%.
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) update_system_info_debian_package, (2) ossec_task, (3). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.3%.
DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a preg_replace function call with an e modifier. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.1%.
The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function or (2) sourcemap parameter to the sourcemap. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 80.5%.
GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 71.0%.
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.3%.
An unspecified ActiveX control in WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 allows remote attackers to download arbitrary DLL code onto a client. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 60.5%.
op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 90.0%.
license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the timestamp parameter for. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 87.2%.
Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.5%.
Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.
Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 70.9%.
Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.0%.
admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parameter during a ping operation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 71.9%.
The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 69.5%.
GDI+ in Microsoft Windows and Office fails to properly handle TIFF images, allowing remote code execution through crafted documents, actively exploited in targeted attacks against Pakistani and Middle Eastern organizations.
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 49.4%.
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.5%.
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 83.6%.
HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary code via a crafted screensaver in a theme file,. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 82.2%.
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 60.9%.
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 87.6%.
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2). Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 91.1%.
VMware vCenter Chargeback Manager (aka CBM) before 2.5.1 does not proper handle uploads, which allows remote attackers to execute arbitrary code via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.9%.
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.3%.
An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310, R410.1, and R410.2; ComfortPoint Open Manager (aka CPO-M). Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 61.4%.
An ActiveX control in gwcls1.dll in the client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code via (1) a pointer argument to the. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 68.3%.
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.0%.
Eval injection vulnerability in the ldapagnt_eval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote attackers to execute arbitrary Perl code. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 49.8%.
The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.6%.
phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 87.9%.
Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 64.8%.
The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.7%.
The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.6%.
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.3%.
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Same ID Property Remote Code. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 82.2%.
Remote code execution in Microsoft MSCOMCTL.OCX ActiveX controls allows unauthenticated attackers to execute arbitrary code via maliciously crafted Office documents, RTF files, or web pages. Actively exploited since April 2012 and confirmed in CISA KEV catalog. Despite being patched in 2012, EPSS score of 94.32% (100th percentile) indicates continued exploitation attempts against unpatched systems. Affects broad Microsoft product ecosystem including Office 2003-2010, SQL Server 2000-2008 R2, BizTalk, Commerce Server, Visual FoxPro, and Visual Basic 6.0 Runtime.
The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 92.6%.
Code injection in Vim enables local arbitrary code execution when a user opens a specially crafted file, affecting versions prior to the fix packaged as 9.2.0481-r0 on Alpine Linux and addressed separately under Ubuntu USN-8415-1. The vulnerability (CWE-94) arises from improper control over code generation within Vim's scripting or modeline processing, allowing an attacker who can deliver a malicious file to achieve full compromise of confidentiality, integrity, and availability on the target system. No public exploit has been identified at time of analysis, and the EPSS score of 0.01% (3rd percentile) suggests negligible current exploitation activity despite the High CVSS rating.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbitrary code on the server, with the issue fixed in Gitea 1.27.1 (Alpine package 1.27.1-r0). The vulnerability is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, including a Nuclei detection template and a proof-of-concept repository. With a CVSS 9.8 network/no-auth vector, any internet-exposed unpatched Gitea instance is at immediate, high risk of full compromise.
In the Linux kernel, the following vulnerability has been resolved: arm64: Don't read GMID_EL1 when MTE is disabled __cpuinfo_store_cpu() gates the GMID_EL1 read on the raw ID_AA64PFR1_EL1, so it reads the register even when the kernel has disabled MTE (CONFIG_ARM64_MTE=n or arm64.nomte). KVM sets HCR_EL2.TID5 in that case, and pKVM injects an UNDEF the host cannot handle: Internal error: Oops - Undefined instruction: 0000000002000000 [#1] SMP pc : __cpuinfo_store_cpu+0xf4/0x264 Kernel panic - not syncing: Attempted to kill the idle task! Only pKVM reaches it, and only after a CPU is offlined and brought back online: its CPU_ON relay sets the host HCR before the CPU enters EL1, while plain nVHE sets it at CPUHP_AP_KVM_ONLINE. Gate the read on the CPU's own ID_AA64PFR1_EL1 with the command-line override applied, and on CONFIG_ARM64_MTE, which no register reflects. The boot CPU stores its registers before init_cpu_features() strips an unsafe override, so clamp against the hardware value here too.
The Xpro Addons - 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.
CSS injection in the A2UI Angular Renderer (a2ui-project/a2ui through 0.10.6) lets a party who controls server-to-client messages embed arbitrary strings in the theme.primaryColor field, which the renderer writes unvalidated into the host element's --a2ui-color-primary CSS custom property. Because the theme is declared with z.any() in renderers/web_core/src/v0_9/schema/server-to-client.ts, values such as url(https://attacker.example/beacon) bypass validation and reach the DOM style layer, enabling UI spoofing, outbound request beacons and potential data exfiltration from affected Angular applications. Exploitation requires the ability to inject or manipulate the message stream consumed by the renderer (PR:L) plus a passive user action (UI:P); the vendor has published fix commit fb8e85aec78d04e81feb9992a57638ca1ec4dc1b (PR #2367). There is no CISA KEV listing and no public exploit identified at time of analysis.
Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Cookie attribute injection in http4s's ResponseCookie.render allows any application that builds a response cookie from unvalidated input to emit attacker-controlled Domain, Path, or SameSite attributes — widening cookie scope or stripping protections — while embedded control characters can enable HTTP header splitting on permissive backends. All applications using http4s versions before 0.23.35 or 1.0.0-M47 that feed untrusted data into the name, content, domain, path, or extension fields of a ResponseCookie are in scope. No public exploit code and no active exploitation were identified at time of analysis, and the moderate CVSS base of 4.8 reflects the high-complexity precondition that the consuming application must itself pass unsanitized input into the cookie constructor.
Parameter smuggling into the PayPal notify redirect of the J2Store extension for Joomla (versions 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7) lets an attacker-chosen query string ride along with the redirect that the notify endpoint issues to com_j2store's checkout controller, instead of the intended fixed parameter set. A victim must load the crafted link (UI:P in the CVSS 4.0 vector), after which the follow-up request to the checkout controller is processed with the injected view/task/paction parameters, giving a limited integrity impact (VI:L) with no confidentiality or availability loss. The vendor's own description concedes this does not grant an unauthenticated attacker anything they could not obtain by calling the same com_j2store URL directly; no public exploit code and no CISA KEV listing were identified in the supplied intelligence.
IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services.
Control-character injection in gitoxide's gix-transport crate before version 0.59.2 lets crafted git-daemon URLs smuggle NUL, CR and LF bytes into connect requests, enabling spoofing of virtual hosts and injection of forged newlines into daemon requests and logs. The flaw affects any Rust application or tool that uses gix-transport to open a git:// connection to a URL whose host or path components are attacker-influenced, and requires the victim to initiate that connection (UI:P). Impact is limited to low confidentiality and integrity effects (5.3 Medium), no public exploit code or CISA KEV entry is present in the supplied intelligence, and a vendor advisory with a fixed release is available.
IBM WebSphere Application Server 9.0 and 8.5 fail to neutralize CRLF and other control characters coming from remote input before writing them into the server's administrative log, letting an unauthenticated network attacker insert forged log entries (CWE-117, improper output neutralization for logs). The CVSS 3.1 score of 5.3 reflects low integrity impact only - confidentiality and availability are unaffected and no code execution is possible - but falsified administrative logs can mask real activity and mislead incident responders. IBM has published a fix (support page node 7286610); there is no CISA KEV listing and no public exploit identified at time of analysis, though CISA's SSVC assessment marks the issue as automatable.
Log injection in IBM WebSphere Application Server 8.5 and 9.0 lets a remote attacker forge entries in the server's administrative log, undermining the integrity of audit records used for monitoring and forensics. The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N) and stems from improper neutralization of log output (CWE-117). IBM has published a vendor fix, and no public exploit code or CISA KEV listing was identified at time of analysis.
Argument injection in HKUDS nanobot's ExecTool shell execution guard allows remote unauthenticated attackers to bypass the command allowlist/denylist filter by embedding newline or carriage-return characters in a command string, causing injected shell segments to execute without inspection. Affected versions are nanobot 0.2.0 and 0.2.1; the root cause is that `_split_shell_segments()` recognized `;` and `|` as command-chain delimiters but not `\n` or `\r`, so a payload on its own line was never checked against allow/deny patterns. No public exploit or CISA KEV listing is identified; patch commit af582246 is available.
Comment-injection in the OpenZeppelin Contracts Wizard code generators lets a newline character embedded in the `info.securityContact` or `info.license` option break out of the single-line `//` comment and be emitted as live source declarations in generated Solidity, Cairo, Stellar/Soroban, and Stylus contracts. Only integrations that populate those two fields from untrusted input and then hand the generated source to a downstream consumer are affected — the self-service web app, AI assistant, CLI, and self-hosted API all use user-supplied values and never cross that trust boundary, and shared links cannot set the fields. The flaw is integrity-only (CVSS 3.3, CWE-94): no code executes on any Wizard service, no public exploit is identified in the supplied data, and patched packages are available as @openzeppelin/wizard 0.10.11, wizard-cairo 3.0.1, wizard-stellar 0.6.2, and wizard-stylus 0.3.1.
Apache Syncope contains a Groovy sandbox bypass (CWE-94 code injection) that lets an administrator holding entitlements over the Implementations console register a malicious Groovy Command class whose untrusted code executes in a static CommandArgs initializer, escaping the intended script sandbox. Affected releases span 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; exploitation requires a privileged, already-authenticated administrator account (CVSS 3.1 vector PR:H, score 6.5) rather than an anonymous attacker. There is no public exploit identified and the vulnerability is not in CISA KEV, but because Syncope is an identity governance and provisioning platform, successful abuse yields high confidentiality and integrity impact over managed identity data - CISA's SSVC assessment rates technical impact as 'total' while noting exploitation has not been observed and the attack is not automatable.
Remote code execution in Yot CMS 3.3.0 and 3.3.1 is achievable by an authenticated administrator through the Admin Console's unsanitized use of PHP's eval() function in modsys/console/admin.php, where the text POST parameter is passed directly to eval() without validation. A publicly available proof-of-concept on GitHub demonstrates the attack. Despite the technically accurate RCE classification, exploitation is gated behind high-privilege (administrator) authentication, substantially reducing practical risk compared to the tag alone suggests.
Remote code execution in cym1102 nginxWebUI up to 4.4.2 is achievable by any authenticated user via the `autoUpdate` endpoint, which accepts an arbitrary `url` parameter and downloads and executes the resulting JAR file on the host OS without domain validation. A public proof-of-concept is disclosed in GitHub issue #213, and a fix exists only as an unmerged PR (#215) - no released patched version has been confirmed. The CVSS 4.0 low-impact metrics (VC:L/VI:L/VA:L) conflict materially with the actual RCE capability.
Code injection in sanjevirau gsubs (Electron application) up to version 1.0.3 allows remote attackers to execute arbitrary code by manipulating the filename argument passed to the showQuerySuccessPage function in renderer/index.js. The vulnerability exists in the Electron renderer process and requires passive user interaction to trigger. A public proof-of-concept exploit has been published on GitHub; no patch has been released and the vendor was unresponsive during coordinated disclosure.
Remote code execution in Xuxueli xxl-job up to version 3.4.2 allows authenticated low-privileged users to execute arbitrary code on the executor host via the GLUE mode Groovy script handler in GlueFactory.java. The root cause is that GroovyClassLoader.parseClass processes attacker-supplied Groovy source directly, compiling and running it without a restrictive sandbox. A public proof-of-concept exploit targeting v3.4.2 has been released on GitHub, and the vendor did not respond to the coordinated disclosure.
In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, each fs root gets a reference to its relocation root. If loading or adding a later root fails, or if the first transaction commit fails, btrfs_recover_relocation() jumps to out_unset before merge_reloc_roots() and clean_dirty_subvols(). put_reloc_control() drops the list-owned relocation root references, but it does not clear fs_root->reloc_root or drop the references owned by those pointers. Mount cleanup only drops them when BTRFS_FS_ERROR is set, so an error such as -ENOMEM while processing a later root can leave references behind. Keep temporary references to the fs roots associated during recovery. On failure, clear their reloc_root pointers and drop the corresponding references. Once the first transaction commit succeeds, drop only the temporary fs root references and let the normal merge and cleanup paths handle the relocation roots. Fault injection on a pending-relocation image confirmed the cleanup gap. With an injected first-commit failure, 25 fs roots had reloc_root set with fs_error=0. With this fix, the same failure path drops that count to 0 before mount fails.
Server-side template injection (SSTI) in Arma Digital Media Inc.'s Website Template product enables remote unauthenticated attackers to inject template engine expressions that are evaluated server-side, achieving code injection. All versions through build 11092026 are affected, and the vendor did not respond to TR-CERT's responsible disclosure, leaving no vendor-released patch available. No public exploit or CISA KEV listing has been identified at time of analysis.
Argument injection in Pardus Pen before version 4.2.1 allows a local, low-privileged user to inject unsanitized argument delimiters into an underlying command invocation, yielding limited integrity impact. The flaw (CWE-88) is strictly local in scope-CVSS AV:L/PR:L-and carries no confidentiality or availability consequence per the published vector. No public exploit code and no active exploitation have been identified; vendor-released patch 4.2.1 is available via the TR-CERT advisory.
Email header injection in MetForm WordPress plugin before 4.1.9 allows unauthenticated attackers to inject arbitrary SMTP headers - such as Bcc - into notification emails dispatched by the site, by embedding newline characters in form field submissions that are configured to populate those headers. This enables silent exfiltration of form submission content to attacker-controlled addresses and potential abuse of the site as a spam relay. No public exploit code or CISA KEV listing exists; the CVSS 4.8 with AC:H correctly reflects the configuration prerequisite that limits the exploitable surface.
CSV formula injection in WWBN AVideo (through commit c3edcc274) enables authenticated users to embed spreadsheet formula payloads in comments that execute when administrators or video owners open exported CSV files from the myComments.download.php endpoint. The unsanitized comment text containing =, +, -, or @ prefixes is written directly into the CSV output, which spreadsheet applications interpret as executable expressions. Depending on the victim's application and security settings, this can chain to OS command execution via DDE or similar mechanisms, elevating a low-privilege user's impact to the admin's local session. No public exploit has been identified and it is not listed in CISA KEV.
Unauthenticated content injection in the Simple Cloudflare Turnstile WordPress plugin (versions <= 1.42.1) allows remote attackers without any credentials to inject arbitrary content into affected WordPress sites. Reported by Patchstack and classified under CWE-94 (Code Injection), the flaw exposes sites to partial confidentiality and integrity compromise (CVSS C:L/I:L) via a network-accessible attack requiring no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Set-Cookie attribute injection in the `cookies` Node.js library (versions before 0.9.2) enables an attacker to override cookie security attributes - SameSite, Secure, HttpOnly, or Domain - by embedding semicolons in the `domain` or `path` option when those options are populated from untrusted or request-derived data. Applications built on Koa (which delegates cookie handling to this library via `ctx.cookies`) represent the primary at-risk population. No public exploit or active exploitation has been identified; real-world impact is gated on an application-level antipattern of passing user-controlled data to these options.
Code injection in AppFlowy 0.11.8 allows arbitrary code execution through insufficient URI and local path validation in the application's file-launch and URL-handling subsystems. The vulnerability exists in the Flutter-based desktop/mobile productivity app's afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, and localPathRegex (common_patterns.dart) components, where inadequate sanitization of URI schemes or local file paths enables an attacker to trigger execution of arbitrary code. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CWE-94 classification confirms the root cause as a code injection pattern rather than a memory-safety issue.
CSV formula injection in Snipe-IT through 8.6.3 allows authenticated low-privilege users to plant spreadsheet formulas in the unaccepted assets acceptance report export, which execute in the spreadsheet client of any privileged user who downloads and opens the file. The ReportsController::postAssetAcceptanceReport method builds its CSV output by hand without applying the League\Csv\EscapeFormula sanitizer already wired into the six sibling exports in the same controller, permitting injection of =, +, -, @, tab, or CR-prefixed values into free-text fields such as asset name, company name, category, model, or assignee. When a reports.view-privileged user opens the resulting file in Excel, LibreOffice Calc, or Google Sheets, injected functions such as HYPERLINK or WEBSERVICE can exfiltrate spreadsheet context to an attacker-controlled server; on legacy Windows Excel configurations with DDE enabled, arbitrary command execution on the victim's workstation is also achievable. Fixed in version 8.7.0; no public exploit identified at time of analysis.
Script injection via improper sanitization of special characters in Dell Secure Connect Gateway 5.0 allows unauthenticated remote attackers to inject script content, resulting in limited confidentiality exposure. Both the Appliance form factor (versions prior to 5.36.00.16) and the Application form factor (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has issued a vendor-confirmed patch under advisory DSA-2026-382.
LDAP injection in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) allows attackers to inject malicious LDAP query elements, leading to script injection against the underlying directory service. The CPE data confirms two distinct deployment forms are affected: the virtual Appliance (fixed at 5.36.00.16) and the Application (fixed at 5.36.00.00), both covered under Dell advisory DSA-2026-382. Critically, the description characterizes the attacker as unauthenticated, but the provided CVSS vector specifies PR:H - a direct contradiction that must be clarified with Dell before this vulnerability is triaged or deprioritized.