CVE-2024-50498

Improper Control of Generation of Code 'Code Injection' vulnerability in LUBUS WP Query Console allows Code Injection.This issue affects WP Query Console: from n/a through 1.0...

CVE-2024-50492

Improper Control of Generation of Code 'Code Injection' vulnerability in Scott Paterson ScottCart allows Code Injection.This issue affects ScottCart: from n/a through 1.1...

CVE-2024-50435: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in themehorse Meta News meta-news.This issue affects Meta News: from n/a through = 1.1.7...

PT-2024-34270

Name of the Vulnerable Software and Affected Versions: ScottCart versions n/a through 1.1 Description: The issue is related to improper control of generation of code, also known as 'Code Injection'. This allows for code injection in ScottCart. Recommendations: For versions n/a through 1.1, consid...

CVE-2024-37846: Improper Control of Generation of Code

MangoOS before 5.2.0 was discovered to contain a Client-Side Template Injection CSTI vulnerability via the Platform Management Edit page...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2024-6345 DESCRIPTION: pypa/setuptools could allow a...

CVE-2024-49690: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Qode Qi Blocks qi-blocks.This issue affects Qi Blocks: from n/a through = 1.3.2...

CVE-2024-49251

CVE-2024-49251 corresponds to a Local File Inclusion in the WordPress plugin Maan Addons For Elementor (

PT-2024-33392 · Sunjianle · Ajax-Extend

Name of the Vulnerable Software and Affected Versions: Sunjianle ajax-extend versions n/a through 1.0 Description: The issue is related to improper control of code generation, allowing code injection. This vulnerability exists in Sunjianle and affects the ajax-extend component. Recommendations: F...

CVE-2024-9981: Improper Control of Filename for Include/Require Statement in PHP Program

The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to upload a malicious PHP file first and then exploit this vulnerability to include the file, resulting in arbitrary code execution on the server...

CVE-2024-46076: Improper Control of Generation of Code

RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of malicious code...

CVE-2024-41925: Improper Control of Filename for Include/Require Statement in PHP Program

The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code...

Optigo Networks ONS-S8 - Spectra Aggregation Switch

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Optigo Networks Equipment: ONS-S8 - Spectra Aggregation Switch Vulnerabilities: Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion', Weak...

CVE-2024-7104

Improper Control of Generation of Code 'Code Injection' vulnerability in SFS Consulting ww.Winsure allows Code Injection. This issue affects ww.Winsure: before 4.6.2...

Citrix Workspace App for Windows Multiple Vulnerabilities (CTX691485)

The version of Citrix Workspace installed on the remote host is prior 2402 LTSR CU1 or 2405. It is, therefore, affected by multiple vulnerabilities: - Local privilege escalation allows a low-privileged user to gain SYSTEM privileges Improper Control of a Resource Through its Lifetime CVE-2024-788...

CVE-2024-43391: Improper Control of Generation of Code

A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FWPORTFORWARDING.SRCIP environment variable which can lead to a DoS...

CVE-2024-6596: Improper Control of Generation of Code

An unauthenticated remote attacker can run malicious c code included in curve files and execute commands in the users context...

CVE-2024-43392: Improper Control of Generation of Code

A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FWINCOMING.FROMIP FWINCOMING.INIP FWOUTGOING.FROMIP FWOUTGOING.INIP environment variable which can lead to a DoS...

CVE-2023-39333: Improper Control of Generation of Code

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability...

CVE-2024-45390: Improper Control of Generation of Code

@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or...