CWE-94 · 5.483 kayıt
Improper Control of Generation of Code ('Code Injection')
Bu sınıftaki CVE’ler
5.486 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
100Hemen | CVE-2022-24816Silahlaştırılmış | Improper Control of Generation of Code in jai-extgeosolutionsgroup · jai-ext · CWE-94 | Kritik10,0 | KEV | %99,9 | 13 Nis 2022 |
100Hemen | CVE-2025-32432Silahlaştırılmış | Craft CMS Allows Remote Code Executioncraftcms · craft cms · CWE-94 | Kritik10,0 | KEV | %99,8 | 25 Nis 2025 |
100Hemen | CVE-2021-22205Silahlaştırılmış | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9.gitlab · gitlab · CWE-94 | Kritik10,0 | KEV | %99,7 | 23 Nis 2021 |
99Hemen | CVE-2015-1635Silahlaştırılmış | HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote amicrosoft · windows 7 · CWE-94 | Kritik9,8 | KEV | %100,0 | 14 Nis 2015 |
99Hemen | CVE-2017-9841Silahlaştırılmış | Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST daphpunit project · phpunit · CWE-94 | Kritik9,8 | KEV | %100,0 | 27 Haz 2017 |
99Hemen | CVE-2022-22954Silahlaştırılmış | VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.vmware · identity manager · CWE-94 | Kritik9,8 | KEV | %100,0 | 11 Nis 2022 |
99Hemen | CVE-2022-22963Silahlaştırılmış | In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user tovmware · spring cloud function · CWE-94 | Kritik9,8 | KEV | %99,9 | 1 Nis 2022 |
99Hemen | CVE-2023-3519Silahlaştırılmış | Unauthenticated remote code executioncitrix · netscaler application delivery controller · CWE-94 | Kritik9,8 | KEV | %99,7 | 19 Tem 2023 |
99Hemen | CVE-2019-16759Silahlaştırılmış | vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring revbulletin · vbulletin · CWE-94 | Kritik9,8 | KEV | %99,7 | 24 Eyl 2019 |
99Hemen | CVE-2022-22965Silahlaştırılmış | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.vmware · spring framework · CWE-94 | Kritik9,8 | KEV | %99,6 | 1 Nis 2022 |
99Hemen | CVE-2017-7494Silahlaştırılmış | Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious clisamba · samba · CWE-94 | Kritik9,8 | KEV | %99,4 | 30 May 2017 |
99Hemen | CVE-2014-6287Silahlaştırılmış | The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackerejetto · http file server · CWE-94 | Kritik9,8 | KEV | %99,3 | 7 Eki 2014 |
99Hemen | CVE-2018-7602Silahlaştırılmış | Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004drupal · drupal · CWE-94 | Kritik9,8 | KEV | %99,2 | 19 Tem 2018 |
99Hemen | CVE-2021-44529Silahlaştırılmış | A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code witivanti · endpoint manager cloud services appliance · CWE-94 | Kritik9,8 | KEV | %99,1 | 8 Ara 2021 |
99Hemen | CVE-2022-3236Silahlaştırılmış | A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1sophos · firewall · CWE-94 | Kritik9,8 | KEV | %98,9 | 23 Eyl 2022 |
99Hemen | CVE-2008-4250Silahlaştırılmış | The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta amicrosoft · windows 2000 · CWE-94 | Kritik9,8 | KEV | %98,8 | 23 Eki 2008 |
99Hemen | CVE-2026-1281Silahlaştırılmış | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.ivanti · endpoint manager mobile · CWE-94 | Kritik9,8 | KEV | %98,7 | 29 Oca 2026 |
99Hemen | CVE-2026-1340Silahlaştırılmış | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.ivanti · endpoint manager mobile · CWE-94 | Kritik9,8 | KEV | %98,6 | 29 Oca 2026 |
99Hemen | CVE-2022-22947Silahlaştırılmış | In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuatvmware · spring cloud gateway · CWE-94 | Kritik10,0 | KEV | %98,3 | 3 Mar 2022 |
99Hemen | CVE-2019-7609Silahlaştırılmış | Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer.elastic · kibana · CWE-94 | Kritik10,0 | KEV | %95,3 | 25 Mar 2019 |
98Hemen | CVE-2023-25717Silahlaştırılmış | Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLoginruckuswireless · ruckus wireless admin · CWE-94 | Kritik9,8 | KEV | %98,1 | 13 Şub 2023 |
98Hemen | CVE-2018-1273Silahlaştırılmış | Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilitbroadcom · spring data commons · CWE-94 | Kritik9,8 | KEV | %97,0 | 11 Nis 2018 |
98Hemen | CVE-2023-33246Silahlaştırılmış | Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration functionapache · rocketmq · CWE-94 | Kritik9,8 | KEV | %96,6 | 24 May 2023 |
98Hemen | CVE-2009-1151Silahlaştırılmış | Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to injephpmyadmin · phpmyadmin · CWE-94 | Kritik9,8 | KEV | %96,6 | 26 Mar 2009 |
96Hemen | CVE-2024-56145Silahlaştırılmış | RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cmscraftcms · craft cms · CWE-94 | Kritik9,3 | KEV | %97,4 | 18 Ara 2024 |
- CVE-2022-24816100Hemen
Improper Control of Generation of Code in jai-ext
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %100geosolutionsgroup · jai-ext13 Nis 2022
- CVE-2025-32432100Hemen
Craft CMS Allows Remote Code Execution
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %100craftcms · craft cms25 Nis 2025
- CVE-2021-22205100Hemen
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9.
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %100gitlab · gitlab23 Nis 2021
- CVE-2015-163599Hemen
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote a
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100microsoft · windows 714 Nis 2015
- CVE-2017-984199Hemen
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST da
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100phpunit project · phpunit27 Haz 2017
- CVE-2022-2295499Hemen
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100vmware · identity manager11 Nis 2022
- CVE-2022-2296399Hemen
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100vmware · spring cloud function1 Nis 2022
- CVE-2023-351999Hemen
Unauthenticated remote code execution
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100citrix · netscaler application delivery controller19 Tem 2023
- CVE-2019-1675999Hemen
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring re
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100vbulletin · vbulletin24 Eyl 2019
- CVE-2022-2296599Hemen
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100vmware · spring framework1 Nis 2022
- CVE-2017-749499Hemen
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious cli
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99samba · samba30 May 2017
- CVE-2014-628799Hemen
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attacke
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99rejetto · http file server7 Eki 2014
- CVE-2018-760299Hemen
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99drupal · drupal19 Tem 2018
- CVE-2021-4452999Hemen
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code wit
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99ivanti · endpoint manager cloud services appliance8 Ara 2021
- CVE-2022-323699Hemen
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99sophos · firewall23 Eyl 2022
- CVE-2008-425099Hemen
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta a
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99microsoft · windows 200023 Eki 2008
- CVE-2026-128199Hemen
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99ivanti · endpoint manager mobile29 Oca 2026
- CVE-2026-134099Hemen
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99ivanti · endpoint manager mobile29 Oca 2026
- CVE-2022-2294799Hemen
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuat
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %98vmware · spring cloud gateway3 Mar 2022
- CVE-2019-760999Hemen
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer.
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %95elastic · kibana25 Mar 2019
- CVE-2023-2571798Hemen
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98ruckuswireless · ruckus wireless admin13 Şub 2023
- CVE-2018-127398Hemen
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilit
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97broadcom · spring data commons11 Nis 2018
- CVE-2023-3324698Hemen
Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97apache · rocketmq24 May 2023
- CVE-2009-115198Hemen
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inje
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97phpmyadmin · phpmyadmin26 Mar 2009
- CVE-2024-5614596Hemen
RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
KritikCVSS 9,3KEVSilahlaştırılmışEPSS %97craftcms · craft cms18 Ara 2024