CVE-2019-4000: Improper Control of Generation of Code

Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitrary Python expressions with root privileges...

CVE-2020-8644: Improper Control of Generation of Code

PlaySMS before 1.4.3 does not sanitize inputs from a malicious string...

CVE-2019-17309: Improper Control of Generation of Code

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user...

CVE-2019-16645: Improper Control of Generation of Code

An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages such as goform/login and config/logoffpage.htm create links containing a hostname obtained from an arbitrary HTTP Host header sent by an attacker. This could potentially be used in a phishing attack...

CVE-2019-2390: Improper Control of Generation of Code

An unprivileged user or program on Microsoft Windows which can create OpenSSL configuration files in a fixed location may cause utility programs shipped with MongoDB server to run attacker defined code as the user running the utility. This issue MongoDB Server v4.0 versions prior to 4.0.11; Mongo...

CVE-2019-0343: Improper Control of Generation of Code

SAP Commerce Cloud Mediaconversion Extension, versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated Backoffice/HMC user to inject code that can be executed by the application, leading to Code Injection. An attacker could thereby control the behavior of the application...

CVE-2019-12844: Improper Control of Generation of Code

A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3...

CVE-2019-5443: Improper Control of Generation of Code

A non-privileged user or program can put code and a config file in a known non-privileged path under C:/usr/local/ that will make curl = 7.65.1 automatically run the code as an openssl "engine" on invocation. If that curl is invoked by a privileged user it can do anything it wants...

CVE-2019-8324: Improper Control of Generation of Code

An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensureloadablespec during the preinstall check...

CVE-2011-1830: Improper Control of Generation of Code

Ekiga versions before 3.3.0 attempted to load a module from /tmp/ekigatest.so...

CVE-2018-20773: Improper Control of Generation of Code

Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional...

CVE-2018-1000881

Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability in ComputedAttributesHandler.java that can result in Remote Command Execution. This attack appear to be exploitable via Remote: web application request by a...

CVE-2018-18258: Improper Control of Generation of Code

An issue was discovered in BageCMS 3.1.3. The attacker can execute arbitrary PHP code on the web server and can read any file on the web server via an index.php?r=admini/template/updateTpl&filename= URI...

CVE-2016-4397: Improper Control of Generation of Code

A local code execution security vulnerability was identified in HP Network Node Manager i NNMi v10.00, v10.10 and v10.20 Software...

CVE-2016-5713: Improper Control of Generation of Code

Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol PXP agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0...

CVE-2014-8872: Improper Control of Generation of Code

Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and other models with firmware 5.50...

CVE-2017-6782: Improper Control of Generation of Code

A vulnerability in the administrative web interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to modify a page in the web interface of the affected application. The vulnerability is due to improper sanitization of parameter values by the affected application. An...

CVE-2017-11675: Improper Control of Generation of Code

The traverseStrictSanitize function in admindir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the adminname array parameter to...

CVE-2016-7787: Improper Control of Generation of Code

A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user...

CVE-2016-7968: Improper Control of Generation of Code

KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed...