CVE-2025-2787: Improper Control of Generation of Code

KNIME Business Hub is affected by the Ingress-nginx CVE-2025-1974 a.k.a IngressNightmare vulnerability which affects the ingress-nginx component. In the worst case a complete takeover of the Kubernetes cluster is possible. Since the affected component is only reachable from within the cluster, i....

CVE-2024-48818: Improper Control of Generation of Code

An issue in IIT Bombay, Mumbai, India Bodhitree of cs101 version allows a remote attacker to execute arbitrary code...

CVE-2025-22204: Improper Control of Generation of Code

Improper control of generation of code in the sourcerer extension for Joomla in versions before 11.0.0 lead to a remote code execution vulnerability...

CVE-2025-24959: Improper Control of Generation of Code

zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into process.env. This can lead to arbitrary command execution or unexpected behavior in applications that rely on environment variables for...

CVE-2025-21187: Improper Control of Generation of Code

Microsoft Power Automate Remote Code Execution Vulnerability...

CVE-2025-0060: Improper Control of Generation of Code

SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate as a high privileged...

CVE-2024-57487: Improper Control of Generation of Code

In Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker to upload a PHP shell without any restrictions and execute commands on the server...

CVE-2024-9132: Improper Control of Generation of Code

The administrator is able to configure an insecure captive portal script...

CVE-2025-22133: Improper Control of Generation of Code

WeGIA is a web manager for charitable institutions. Prior to 3.2.8, a critical vulnerability was identified in the /WeGIA/html/socio/sistema/controller/controlaxlsx.php endpoint. The endpoint accepts file uploads without proper validation, allowing the upload of malicious files, such as .phar,...

CVE-2024-12908: Improper Control of Generation of Code

Delinea addressed a reported case on Secret Server v11.7.31 protocol handler version 6.0.3.26 where, within the protocol handler function, URI's were compared before normalization and canonicalization, potentially leading to over matching against the approved list. If this attack were successfull...

CVE-2024-56327: Improper Control of Generation of Code

pyrage is a set of Python bindings for the rage file encryption library age in Rust. pyrage uses the Rust age crate for its underlying operations, and age is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to pyrage for the versions specified in this advisory. S...

CVE-2024-54152: Improper Control of Generation of Code

Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex undisclosed payload, one can get full access...

CVE-2024-48840: Improper Control of Generation of Code

Unauthorized Access vulnerabilities allow Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02...

CVE-2024-10094: Improper Control of Generation of Code

Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code...

CVE-2024-43425: Improper Control of Generation of Code

A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions...

CVE-2024-51424: Improper Control of Generation of Code

An issue in the PepeGxng smart contract which can be run on the Ethereum blockchain allows remote attackers to have an unspecified impact via the Owned.setOwner function. NOTE: this is disputed by third parties because the impact is limited to function calls...

CVE-2024-51427: Improper Control of Generation of Code

An issue in the PepeGxng smart contract which can be run on the Ethereum blockchain allows remote attackers to have an unspecified impact via the mint function. NOTE: this is disputed by third parties because the impact is limited to function calls...

CVE-2024-51298: Improper Control of Generation of Code

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function...

CVE-2024-37846: Improper Control of Generation of Code

MangoOS before 5.2.0 was discovered to contain a Client-Side Template Injection CSTI vulnerability via the Platform Management Edit page...

CVE-2024-49254

Improper Control of Generation of Code 'Code Injection' vulnerability in sunjianle ajax-extend ajax-extend allows Code Injection.This issue affects ajax-extend: from n/a through = 1.0...