CWE-15 · 81 kayıt
External Control of System or Configuration Setting
Bu sınıftaki CVE’ler
81 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
46Planlayın | CVE-2024-39280İstismar yok | An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505.wavlink · wl-wn533a8 firmware · CWE-15 | Kritik9,1 | — | %34,2 | 14 Oca 2025 |
46Planlayın | CVE-2023-50252İstismar yok | php-svg-lib unsafe attributes merge when parsing `use` tagdompdf · php-svg-lib · CWE-15 | Kritik9,8 | — | %23,9 | 12 Ara 2023 |
42Planlayın | CVE-2024-38666İstismar yok | An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505wavlink · wl-wn533a8 firmware · CWE-15 | Kritik9,1 | — | %18,9 | 14 Oca 2025 |
40Planlayın | CVE-2026-45087Silahlaştırılmış | Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Modehahwul · dalfox · CWE-15 | Kritik10,0 | — | %1,4 | 27 May 2026 |
40Planlayın | CVE-2026-87987İstismar yok | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable mistralai · mistral-vibe · CWE-15 | Kritik10,0 | — | %0,6 | 11 Eyl 2026 |
39İzleyin | CVE-2024-51544İstismar yok | Service Control vulnerabilities allow access to service restart requests and vm configuration settings.abb · aspect-ent-12 firmware · CWE-15 | Yüksek8,8 | — | %13,2 | 5 Ara 2024 |
39İzleyin | CVE-2024-4326İstismar yok | Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webuilollms · lollms web ui · CWE-15 | Kritik9,8 | — | %1,0 | 16 May 2024 |
39İzleyin | CVE-2026-19593İstismar yok | OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace.openai · codex desktop · CWE-15 | Kritik9,8 | — | %0,4 | 1 Eyl 2026 |
37İzleyin | CVE-2024-39602İstismar yok | An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505.wavlink · wl-wn533a8 firmware · CWE-15 | Kritik9,1 | — | %2,3 | 14 Oca 2025 |
37İzleyin | CVE-2026-46399İstismar yok | Authenticated Remote Code Execution via File Overwritehaxtheweb · haxcms-nodejs · CWE-15 | Kritik9,4 | — | %0,5 | 5 Haz 2026 |
36İzleyin | CVE-2024-10979İstismar yok | PostgreSQL PL/Perl environment variable changes execute arbitrary codepostgresql · postgresql · CWE-15 | Yüksek8,8 | — | %4,4 | 14 Kas 2024 |
36İzleyin | CVE-2021-38453İstismar yok | Some API functions allow interaction with the registry, which includes reading values as well as data modification.auvesy · versiondog · CWE-15 | Kritik9,1 | — | %1,1 | 22 Eki 2021 |
35İzleyin | CVE-2023-46248İstismar yok | Overwrite of builtin Cody commands facilitates RCEsourcegraph · cody · CWE-15 | Yüksek8,8 | — | %1,1 | 31 Eki 2023 |
35İzleyin | CVE-2023-32349İstismar yok | Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter pateltonika-networks · rut200 firmware · CWE-15 | Yüksek8,8 | — | %1,1 | 22 May 2023 |
35İzleyin | CVE-2021-27406İstismar yok | PerFact OpenVPN-Clientperfact · openvpn-client · CWE-15 | Yüksek8,8 | — | %1,0 | 14 Eki 2022 |
35İzleyin | CVE-2025-27889İstismar yok | Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injectionwftpserver · wing ftp server · CWE-15 | Yüksek8,8 | — | %0,4 | 10 Tem 2025 |
35İzleyin | CVE-2023-3321İstismar yok | Code Execution through Writable Mosquitto Configuration Fileabb · zenon · CWE-15 | Yüksek8,8 | — | %0,4 | 24 Tem 2023 |
35İzleyin | CVE-2024-51543İstismar yok | Information Disclosureabb · aspect-ent-12 firmware · CWE-15 | Yüksek8,8 | — | %0,3 | 5 Ara 2024 |
35İzleyin | CVE-2026-1784İstismar yok | Ose-cluster-ingress-operator: remote code execution through haproxy configuration injectionredhat · openshift container platform · CWE-15 | Yüksek8,8 | — | %0,2 | 2 Haz 2026 |
35İzleyin | CVE-2026-41489İstismar yok | Pi-hole: Local privilege escalation via config-controlled path in root-executed service hookspi-hole · pi-hole · CWE-15 | Yüksek8,8 | — | %0,2 | 11 May 2026 |
34İzleyin | CVE-2026-73661İstismar yok | FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backupfreepbx · framework · CWE-15 | Yüksek8,6 | — | %0,6 | 13 Ağu 2026 |
34İzleyin | CVE-2026-41384İstismar yok | OpenClaw < 2026.3.24 - Environment Variable Injection via Workspace Config in CLI Backendopenclaw · openclaw · CWE-15 | Yüksek8,5 | — | %0,2 | 28 Nis 2026 |
34İzleyin | CVE-2026-41294İstismar yok | OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env Fileopenclaw · openclaw · CWE-15 | Yüksek8,5 | — | %0,2 | 20 Nis 2026 |
34İzleyin | CVE-2026-85217İstismar yok | Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktopautodesk · fusion · CWE-15 | Yüksek8,6 | — | %0,2 | 10 Eyl 2026 |
34İzleyin | CVE-2025-0425İstismar yok | Local Privilege Escalation via Config Manipulationcordaware · bestinformed infoclient · CWE-15 | Yüksek8,5 | — | %0,2 | 18 Şub 2025 |
- CVE-2024-3928046Planlayın
An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505.
KritikCVSS 9,1İstismar yokEPSS %34wavlink · wl-wn533a8 firmware14 Oca 2025
- CVE-2023-5025246Planlayın
php-svg-lib unsafe attributes merge when parsing `use` tag
KritikCVSS 9,8İstismar yokEPSS %24dompdf · php-svg-lib12 Ara 2023
- CVE-2024-3866642Planlayın
An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505
KritikCVSS 9,1İstismar yokEPSS %19wavlink · wl-wn533a8 firmware14 Oca 2025
- CVE-2026-4508740Planlayın
Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode
KritikCVSS 10,0SilahlaştırılmışEPSS %1hahwul · dalfox27 May 2026
- CVE-2026-8798740Planlayın
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable
KritikCVSS 10,0İstismar yokEPSS %1mistralai · mistral-vibe11 Eyl 2026
- CVE-2024-5154439İzleyin
Service Control vulnerabilities allow access to service restart requests and vm configuration settings.
YüksekCVSS 8,8İstismar yokEPSS %13abb · aspect-ent-12 firmware5 Ara 2024
- CVE-2024-432639İzleyin
Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui
KritikCVSS 9,8İstismar yokEPSS %1lollms · lollms web ui16 May 2024
- CVE-2026-1959339İzleyin
OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace.
KritikCVSS 9,8İstismar yokEPSS %0openai · codex desktop1 Eyl 2026
- CVE-2024-3960237İzleyin
An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505.
KritikCVSS 9,1İstismar yokEPSS %2wavlink · wl-wn533a8 firmware14 Oca 2025
- CVE-2026-4639937İzleyin
Authenticated Remote Code Execution via File Overwrite
KritikCVSS 9,4İstismar yokEPSS %0haxtheweb · haxcms-nodejs5 Haz 2026
- CVE-2024-1097936İzleyin
PostgreSQL PL/Perl environment variable changes execute arbitrary code
YüksekCVSS 8,8İstismar yokEPSS %4postgresql · postgresql14 Kas 2024
- CVE-2021-3845336İzleyin
Some API functions allow interaction with the registry, which includes reading values as well as data modification.
KritikCVSS 9,1İstismar yokEPSS %1auvesy · versiondog22 Eki 2021
- CVE-2023-4624835İzleyin
Overwrite of builtin Cody commands facilitates RCE
YüksekCVSS 8,8İstismar yokEPSS %1sourcegraph · cody31 Eki 2023
- CVE-2023-3234935İzleyin
Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter pa
YüksekCVSS 8,8İstismar yokEPSS %1teltonika-networks · rut200 firmware22 May 2023
- CVE-2021-2740635İzleyin
PerFact OpenVPN-Client
YüksekCVSS 8,8İstismar yokEPSS %1perfact · openvpn-client14 Eki 2022
- CVE-2025-2788935İzleyin
Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection
YüksekCVSS 8,8İstismar yokEPSS %0wftpserver · wing ftp server10 Tem 2025
- CVE-2023-332135İzleyin
Code Execution through Writable Mosquitto Configuration File
YüksekCVSS 8,8İstismar yokEPSS %0abb · zenon24 Tem 2023
- CVE-2024-5154335İzleyin
Information Disclosure
YüksekCVSS 8,8İstismar yokEPSS %0abb · aspect-ent-12 firmware5 Ara 2024
- CVE-2026-178435İzleyin
Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection
YüksekCVSS 8,8İstismar yokEPSS %0redhat · openshift container platform2 Haz 2026
- CVE-2026-4148935İzleyin
Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks
YüksekCVSS 8,8İstismar yokEPSS %0pi-hole · pi-hole11 May 2026
- CVE-2026-7366134İzleyin
FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup
YüksekCVSS 8,6İstismar yokEPSS %1freepbx · framework13 Ağu 2026
- CVE-2026-4138434İzleyin
OpenClaw < 2026.3.24 - Environment Variable Injection via Workspace Config in CLI Backend
YüksekCVSS 8,5İstismar yokEPSS %0openclaw · openclaw28 Nis 2026
- CVE-2026-4129434İzleyin
OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File
YüksekCVSS 8,5İstismar yokEPSS %0openclaw · openclaw20 Nis 2026
- CVE-2026-8521734İzleyin
Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop
YüksekCVSS 8,6İstismar yokEPSS %0autodesk · fusion10 Eyl 2026
- CVE-2025-042534İzleyin
Local Privilege Escalation via Config Manipulation
YüksekCVSS 8,5İstismar yokEPSS %0cordaware · bestinformed infoclient18 Şub 2025