Filtered by CWE-94
Filtered by vendor Subscriptions
Total 4108 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-21831 2 Debian, Rubyonrails 2 Debian Linux, Active Storage 2024-11-21 9.8 Critical
A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.
CVE-2022-21797 3 Debian, Fedoraproject, Joblib Project 3 Debian Linux, Fedora, Joblib 2024-11-21 7.3 High
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
CVE-2022-21686 1 Prestashop 1 Prestashop 2024-11-21 9 Critical
PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.
CVE-2022-21122 1 Metarhia 1 Metacalc 2024-11-21 9 Critical
The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.
CVE-2022-1609 1 Weblizar 1 School Management 2024-11-21 9.8 Critical
The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.
CVE-2022-1575 1 Diagrams 1 Drawio 2024-11-21 9.6 Critical
Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app.
CVE-2022-1159 1 Rockwellautomation 10 Compact Guardlogix 5380, Compact Guardlogix 5380 Firmware, Compactlogix 5380 and 7 more 2024-11-21 7.7 High
Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio 5000 Logix Designer could inject controller code undetectable to a user.
CVE-2022-0944 1 Sqlpad 1 Sqlpad 2024-11-21 7.2 High
Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.
CVE-2022-0921 1 Microweber 1 Microweber 2024-11-21 6.7 Medium
Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.
CVE-2022-0896 1 Microweber 1 Microweber 2024-11-21 8.8 High
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.
CVE-2022-0885 1 Memberhero 1 Member Hero 2024-11-21 9.8 Critical
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.
CVE-2022-0845 1 Lightningai 1 Pytorch Lightning 2024-11-21 9.8 Critical
Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.
CVE-2022-0819 1 Dolibarr 1 Dolibarr Erp\/crm 2024-11-21 8.8 High
Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.
CVE-2022-0811 2 Kubernetes, Redhat 2 Cri-o, Openshift 2024-11-21 8.8 High
A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.
CVE-2022-0661 1 Ad Injection Project 1 Ad Injection 2024-11-21 7.2 High
The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.
CVE-2022-0578 1 Publify Project 1 Publify 2024-11-21 6.5 Medium
Code Injection in GitHub repository publify/publify prior to 9.2.8.
CVE-2022-0323 1 Mustache Project 1 Mustache 2024-11-21 8.8 High
Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.
CVE-2021-4434 1 Warfareplugins 1 Social Warfare 2024-11-21 10 Critical
The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.5.2 via the 'swp_url' parameter. This allows attackers to execute code on the server.
CVE-2021-4315 1 Psiturk 1 Psiturk 2024-11-21 5.5 Medium
A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment.py. The manipulation of the argument mode leads to improper neutralization of special elements used in a template engine. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.1 is able to address this issue. The name of the patch is 47787e15cecd66f2aa87687bf852ae0194a4335f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-219676.
CVE-2021-46362 1 Magnolia-cms 1 Magnolia Cms 2024-11-21 9.8 Critical
A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter.