CVE-2025-3114: Improper Control of Generation of Code

Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise. Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandb...

CVE-2025-23186: Improper Control of Generation of Code

In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call RFC request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely...

CVE-2025-31330: Improper Control of Generation of Code

SAP Landscape Transformation SLT allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as...

CVE-2025-3405: Improper Control of Resource Identifiers

A vulnerability was found in FCJ Venture Builder appclientefiel 3.0.27. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /rest/cliente/ObterPedido/ of the component HTTP GET Request Handler. The manipulation of the argument ORDERID leads ...

CVE-2025-32156 WordPress Just Post Preview Widget plugin <= 1.1.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Alex Prokopenko / JustCoded Just Post Preview Widget just-post-preview allows PHP Local File Inclusion.This issue affects Just Post Preview Widget: from n/a through = 1.1.1...

CVE-2025-3164: Improper Control of Generation of Code

A vulnerability was found in Tencent Music Entertainment SuperSonic up to 0.9.8. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/semantic/database/testConnect of the component H2 Database Connection Handler. The manipulation leads to code...

PT-2025-13129

Name of the Vulnerable Software and Affected Versions WP Travel Engine versions through 6.3.5 Description The issue is related to Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion'. This allows PHP Local File Inclusion...

CVE-2025-30829: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Arraytics WPCafe wp-cafe allows PHP Local File Inclusion.This issue affects WPCafe: from n/a through = 2.2.31...

CVE-2025-2867: Improper Control of Generation of Code

An issue has been discovered in the GitLab Duo with Amazon Q affecting all versions from 17.8 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. A specifically crafted issue could manipulate AI-assisted development features to potentially expose sensitive project data to unauthorized...

PT-2025-13142

Name of the Vulnerable Software and Affected Versions WpTravelly versions 1.8.7 and earlier Description The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

PT-2025-13112

Name of the Vulnerable Software and Affected Versions The Pack Elementor addons versions n/a through 2.1.1 Description The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Loc...

CVE-2025-2787: Improper Control of Generation of Code

KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 a.k.a IngressNightmare vulnerability which affects the ingress-nginx component. In the worst case a complete takeover of the Kubernetes cluster is possible. Since the affected component is only reachable from within the cluster, i....

PT-2025-12955

Name of the Vulnerable Software and Affected Versions NotFound Visual Text Editor versions 1.2.1 and earlier Description The issue is related to improper control of code generation, allowing remote code inclusion. This can lead to remote code injection due to the improper control of code...

CVE-2024-48818: Improper Control of Generation of Code

An issue in IIT Bombay, Mumbai, India Bodhitree of cs101 version allows a remote attacker to execute arbitrary code...

PT-2025-11362

Name of the Vulnerable Software and Affected Versions: Ohio Extra versions n/a through 3.4.7 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which allows for code injection in Ohio Extra. Recommendations: For versions n/a through...

CVE-2025-29998: Improper Control of Interaction Frequency

This vulnerability exists in the CAP back office application due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP...

CVE-2025-26933

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Nitin Prakash WC Place Order Without Payment wc-place-order-without-payment allows PHP Local File Inclusion.This issue affects WC Place Order Without Payment: from n/a through =...

PT-2025-10594

Name of the Vulnerable Software and Affected Versions WC Place Order Without Payment versions 2.6.7 and earlier Description The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PH...

PT-2025-10453

Name of the Vulnerable Software and Affected Versions Control iD RH iD version 25.2.25.0 Description A vulnerability has been found in the PDF Document Handler component of Control iD RH iD, affecting unknown code of the file "/v2/report.svc/comprovante marcacao/?companyId=1". The manipulation of...

CVE-2025-2125: Improper Control of Resource Identifiers

A vulnerability has been found in Control iD RH iD 25.2.25.0 and classified as problematic. This vulnerability affects unknown code of the file /v2/report.svc/comprovantemarcacao/?companyId=1 of the component PDF Document Handler. The manipulation of the argument nsr leads to improper control of...