Filtered by CWE-94
Filtered by vendor Subscriptions
Total 4006 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-0004 1 Purestorage 2 Flasharray, Purity\/\/fa 2024-09-27 9.1 Critical
A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.
CVE-2024-6386 1 Wpml 1 Wpml 2024-09-27 9.9 Critical
The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via the Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
CVE-2024-8623 1 Pluginus 1 Wordpress Meta Data And Taxonomies Filter 2024-09-26 7.3 High
The The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.3.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVE-2024-8268 1 Buffercode 1 Frontend Dashboard 2024-09-26 8.8 High
The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the ajax_request() function in all versions up to, and including, 2.2.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to call arbitrary functions that can be leverage for privilege escalation by changing user's passwords.
CVE-2024-8478 1 Ifeelweb 1 Affiliate Super Assistent 2024-09-26 7.3 High
The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.5.3. This is due to the software allowing users to supply arbitrary shortcodes in comments when the 'Parse comments' option is enabled. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVE-2024-46103 1 Sem-cms 1 Semcms 2024-09-26 9.8 Critical
SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php.
CVE-2024-47219 1 Vesoft 1 Nebulagraph Studio 2024-09-26 N/A
An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows shell command injection.
CVE-2024-46640 1 Seacms 1 Seacms 2024-09-26 9.8 Critical
SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp. Although the system has a check function, the check function is not executed during execution, allowing remote code execution by writing to the file through the MySQL slow query method.
CVE-2024-40442 1 Doccano 2 Auto Labeling Pipeline, Doccano 2024-09-26 7.2 High
An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via a crafted REST Request.
CVE-2024-46639 1 Evolutionscript 1 Helpdeskz 2024-09-26 7.6 High
A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box.
CVE-2024-9006 1 Jeanmarc77 1 123solar 2024-09-25 6.3 Medium
A vulnerability was found in jeanmarc77 123solar 1.8.4.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file config/config_invt1.php. The manipulation of the argument PASSOx leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as f4a8c748ec436e5a79f91ccb6a6f73752b336aa5. It is recommended to apply a patch to fix this issue.
CVE-2024-44623 2 Spx, Tuomoku 2 Spx Graphics Controller, Spx Gc 2024-09-25 7.3 High
An issue in TuomoKu SPx-GC v.1.3.0 and before allows a remote attacker to execute arbitrary code via the child_process.js function.
CVE-2024-8880 1 Playsms 1 Playsms 2024-09-20 5.6 Medium
A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /playsms/index.php?app=main&inc=core_auth&route=forgot&op=forgot of the component Template Handler. The manipulation of the argument username/email/captcha leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The project maintainer was informed early about the issue. Investigation shows that playSMS up to 1.4.3 contained a fix but later versions re-introduced the flaw. As long as the latest version of the playsms/tpl package is used, the software is not affected. Version >=1.4.4 shall fix this issue for sure.
CVE-2024-7104 2 Sfs, Sfs Consulting 2 Winsure, Wwwinsure 2024-09-20 9.8 Critical
Improper Control of Generation of Code ('Code Injection') vulnerability in SFS Consulting ww.Winsure allows Code Injection.This issue affects ww.Winsure: before 4.6.2.
CVE-2024-45798 1 Arduino 1 Arduino Core 2024-09-20 10 Critical
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The `arduino-esp32` CI is vulnerable to multiple Poisoned Pipeline Execution (PPE) vulnerabilities. Code injection in `tests_results.yml` workflow (`GHSL-2024-169`) and environment Variable injection (`GHSL-2024-170`). These issue have been addressed but users are advised to verify the contents of the downloaded artifacts.
CVE-2024-35515 1 Sqlitedict 1 Sqlitedict 2024-09-20 9.8 Critical
Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code.
CVE-2024-43922 1 Nitropack 1 Nitropack 2024-09-20 4.8 Medium
Improper Control of Generation of Code ('Code Injection') vulnerability in NitroPack Inc. NitroPack allows Code Injection.This issue affects NitroPack: from n/a through 1.16.7.
CVE-2024-34344 1 Nuxt 1 Nuxt 2024-09-19 8.8 High
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the `path` parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrary commands. Users who open a malicious web page in the browser while running the test locally are affected by this vulnerability, which results in the remote code execution from the malicious web page. Since web pages can send requests to arbitrary addresses, a malicious web page can repeatedly try to exploit this vulnerability, which then triggers the exploit when the test server starts.
CVE-2024-44430 2 Best Free Law Office Management Software, Mayurik 2 Best Free Law Office Management Software, Best Free Law Office Management 2024-09-19 9.8 Critical
SQL Injection vulnerability in Best Free Law Office Management Software-v1.0 allows an attacker to execute arbitrary code and obtain sensitive information via a crafted payload to the kortex_lite/control/register_case.php interface
CVE-2024-3958 1 Gitlab 1 Gitlab 2024-09-17 5.3 Medium
An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.