Skip to content
Noroxi

CWE-95 · 159 records

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

CVEs in this class

159 records

  • CVE-2025-24893
    99Now

    Remote code execution as guest via SolrSearchMacros request in xwiki

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    xwiki · xwikiFeb 20, 2025

  • CVE-2024-36401
    99Now

    Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    geoserver · geoserverJul 1, 2024

  • CVE-2024-21650
    67This week

    XWiki Remote Code Execution vulnerability via user registration

    CriticalCVSS 9.8Proof of conceptEPSS 93%

    xwiki · xwikiJan 8, 2024

  • CVE-2023-7101
    67This week

    Arbitrary Code Execution (ACE) Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 19%

    jmcnamara · spreadsheet\Dec 24, 2023

  • CVE-2024-7954
    66This week

    SPIP porte_plume Plugin Arbitrary PHP Execution

    CriticalCVSS 9.8WeaponizedEPSS 90%

    spip · spipAug 23, 2024

  • CVE-2024-36404
    62This week

    GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions

    CriticalCVSS 9.8Proof of conceptEPSS 76%

    geotools · geotoolsJul 2, 2024

  • CVE-2023-26477
    61This week

    org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 75%

    xwiki · xwikiMar 2, 2023

  • CVE-2024-31984
    60This week

    XWiki Platform: Remote code execution through space title and Solr space facet

    HighCVSS 8.8No exploitEPSS 83%

    xwiki · xwikiApr 10, 2024

  • CVE-2023-29509
    58Plan

    org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

    HighCVSS 8.8No exploitEPSS 76%

    xwiki · xwikiApr 16, 2023

  • CVE-2024-31465
    58Plan

    XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet

    HighCVSS 8.8No exploitEPSS 76%

    xwiki · xwikiApr 10, 2024

  • CVE-2023-35150
    55Plan

    XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application

    HighCVSS 8.0No exploitEPSS 78%

    xwiki · xwikiJun 23, 2023

  • CVE-2024-31982
    49Plan

    XWiki Platform: Remote code execution as guest via DatabaseSearch

    CriticalCVSS 9.8Proof of conceptEPSS 35%

    xwiki · xwikiApr 10, 2024

  • CVE-2026-0769
    49Plan

    Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 32%

    langflow · langflowJan 23, 2026

  • CVE-2026-1470
    45Plan

    Authenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.

    CriticalCVSS 9.9No exploitEPSS 21%

    n8n · n8nJan 27, 2026

  • CVE-2025-54322
    44Plan

    Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py.

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    xspeeder · sxzosDec 27, 2025

  • CVE-2025-0868
    42Plan

    Remote Code Execution in DocsGPT

    CriticalCVSS 9.3Proof of conceptEPSS 17%

    arc53 · docsgptFeb 20, 2025

  • CVE-2026-0863
    42Plan

    Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.

    CriticalCVSS 9.9No exploitEPSS 9%

    n8n · n8nJan 18, 2026

  • CVE-2013-10070
    41Plan

    PHP-Charts v1.0 PHP Code Execution

    CriticalCVSS 10.0WeaponizedEPSS 2%

    php-charts · php-chartsAug 5, 2025

  • CVE-2026-19295
    40Plan

    Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

    CriticalCVSS 9.9WeaponizedEPSS 3%

    langflow · langflowAug 28, 2026

  • CVE-2024-31996
    40Plan

    XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution

    CriticalCVSS 9.8No exploitEPSS 2%

    xwiki · xwikiApr 10, 2024

  • CVE-2026-100741
    40Plan

    Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer

    CriticalCVSS 9.8No exploitEPSS 2%

    progressive robot ltd · hmailserver3 days ago

  • CVE-2026-61539
    40Plan

    Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

    CriticalCVSS 10.0No exploitEPSS 1%

    xorbitsai · inferenceAug 21, 2026

  • CVE-2021-23277
    40Plan

    Improper Neutralization of Directives in Dynamically Evaluated Code

    CriticalCVSS 10.0No exploitEPSS 1%

    eaton · intelligent power managerApr 13, 2021

  • CVE-2025-68271
    40Plan

    Unauthenticated Remote Code Execution in openc3-api

    CriticalCVSS 10.0No exploitEPSS 1%

    openc3 · cosmosJan 13, 2026

  • CVE-2026-22666
    39Monitor

    Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()

    HighCVSS 8.6Proof of conceptEPSS 16%

    dolibarr · dolibarr erp\/crmApr 7, 2026

All vulnerability classes