CWE-95 · 159 kayıt

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Bu sınıftaki CVE’ler

159 kayıt

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
99Hemen	CVE-2025-24893Silahlaştırılmış	Remote code execution as guest via SolrSearchMacros request in xwikixwiki · xwiki · CWE-95 pre-auth RCE	Kritik9,8	KEV	%99,9	20 Şub 2025
99Hemen	CVE-2024-36401Silahlaştırılmış	Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoservergeoserver · geoserver · CWE-95 pre-auth RCE	Kritik9,8	KEV	%99,8	1 Tem 2024
67Bu hafta	CVE-2024-21650Kavram kanıtı	XWiki Remote Code Execution vulnerability via user registrationxwiki · xwiki · CWE-95 pre-auth RCE	Kritik9,8	—	%93,5	8 Oca 2024
67Bu hafta	CVE-2023-7101Silahlaştırılmış	Arbitrary Code Execution (ACE) Vulnerabilityjmcnamara · spreadsheet\ · CWE-95 RCE	Yüksek7,8	KEV	%19,1	24 Ara 2023
66Bu hafta	CVE-2024-7954Silahlaştırılmış	SPIP porte_plume Plugin Arbitrary PHP Executionspip · spip · CWE-95 pre-auth RCE	Kritik9,8	—	%90,1	23 Ağu 2024
62Bu hafta	CVE-2024-36404Kavram kanıtı	GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressionsgeotools · geotools · CWE-95 pre-auth RCE	Kritik9,8	—	%76,1	2 Tem 2024
61Bu hafta	CVE-2023-26477İstismar yok	org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityxwiki · xwiki · CWE-95 pre-auth RCE	Kritik9,8	—	%74,8	2 Mar 2023
60Bu hafta	CVE-2024-31984İstismar yok	XWiki Platform: Remote code execution through space title and Solr space facetxwiki · xwiki · CWE-95 RCE	Yüksek8,8	—	%83,0	10 Nis 2024
58Planlayın	CVE-2023-29509İstismar yok	org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityxwiki · xwiki · CWE-95 RCE	Yüksek8,8	—	%75,7	16 Nis 2023
58Planlayın	CVE-2024-31465İstismar yok	XWiki Platform: Remote code execution from account via SearchSuggestSourceSheetxwiki · xwiki · CWE-95 RCE	Yüksek8,8	—	%75,6	10 Nis 2024
55Planlayın	CVE-2023-35150İstismar yok	XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation applicationxwiki · xwiki · CWE-95 RCE	Yüksek8,0	—	%77,7	23 Haz 2023
49Planlayın	CVE-2024-31982Kavram kanıtı	XWiki Platform: Remote code execution as guest via DatabaseSearchxwiki · xwiki · CWE-95 pre-auth RCE	Kritik9,8	—	%34,5	10 Nis 2024
49Planlayın	CVE-2026-0769Kavram kanıtı	Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerabilitylangflow · langflow · CWE-95 pre-auth RCE	Kritik9,8	—	%32,3	23 Oca 2026
45Planlayın	CVE-2026-1470İstismar yok	Authenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.n8n · n8n · CWE-95 RCE	Kritik9,9	—	%20,7	27 Oca 2026
44Planlayın	CVE-2025-54322Kavram kanıtı	Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py.xspeeder · sxzos · CWE-95 pre-auth RCE	Kritik9,8	—	%15,1	27 Ara 2025
42Planlayın	CVE-2025-0868Kavram kanıtı	Remote Code Execution in DocsGPTarc53 · docsgpt · CWE-95 pre-auth RCE	Kritik9,3	—	%17,1	20 Şub 2025
42Planlayın	CVE-2026-0863İstismar yok	Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.n8n · n8n · CWE-95 RCE	Kritik9,9	—	%9,4	18 Oca 2026
41Planlayın	CVE-2013-10070Silahlaştırılmış	PHP-Charts v1.0 PHP Code Executionphp-charts · php-charts · CWE-95 pre-auth RCE	Kritik10,0	—	%2,1	5 Ağu 2025
40Planlayın	CVE-2026-19295Silahlaştırılmış	Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcementlangflow · langflow · CWE-95 RCE	Kritik9,9	—	%3,3	28 Ağu 2026
40Planlayın	CVE-2024-31996İstismar yok	XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code executionxwiki · xwiki · CWE-95 pre-auth RCE	Kritik9,8	—	%2,1	10 Nis 2024
40Planlayın	CVE-2026-100741İstismar yok	Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServerprogressive robot ltd · hmailserver · CWE-95 pre-auth RCE	Kritik9,8	—	%1,7	3 gün önce
40Planlayın	CVE-2026-61539İstismar yok	Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsingxorbitsai · inference · CWE-95 pre-auth RCE	Kritik10,0	—	%1,2	21 Ağu 2026
40Planlayın	CVE-2021-23277İstismar yok	Improper Neutralization of Directives in Dynamically Evaluated Codeeaton · intelligent power manager · CWE-95 pre-auth RCE	Kritik10,0	—	%1,0	13 Nis 2021
40Planlayın	CVE-2025-68271İstismar yok	Unauthenticated Remote Code Execution in openc3-apiopenc3 · cosmos · CWE-95 pre-auth RCE	Kritik10,0	—	%0,6	13 Oca 2026
39İzleyin	CVE-2026-22666Kavram kanıtı	Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()dolibarr · dolibarr erp\/crm · CWE-95 RCE	Yüksek8,6	—	%15,5	7 Nis 2026

CVE-2025-24893
99Hemen
Remote code execution as guest via SolrSearchMacros request in xwiki
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100
- pre-auth RCE
xwiki · xwiki20 Şub 2025
CVE-2024-36401
99Hemen
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100
- pre-auth RCE
geoserver · geoserver1 Tem 2024
CVE-2024-21650
67Bu hafta
XWiki Remote Code Execution vulnerability via user registration
KritikCVSS 9,8Kavram kanıtıEPSS %93
- pre-auth RCE
xwiki · xwiki8 Oca 2024
CVE-2023-7101
67Bu hafta
Arbitrary Code Execution (ACE) Vulnerability
YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %19
- RCE
jmcnamara · spreadsheet\24 Ara 2023
CVE-2024-7954
66Bu hafta
SPIP porte_plume Plugin Arbitrary PHP Execution
KritikCVSS 9,8SilahlaştırılmışEPSS %90
- pre-auth RCE
spip · spip23 Ağu 2024
CVE-2024-36404
62Bu hafta
GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
KritikCVSS 9,8Kavram kanıtıEPSS %76
- pre-auth RCE
geotools · geotools2 Tem 2024
CVE-2023-26477
61Bu hafta
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
KritikCVSS 9,8İstismar yokEPSS %75
- pre-auth RCE
xwiki · xwiki2 Mar 2023
CVE-2024-31984
60Bu hafta
XWiki Platform: Remote code execution through space title and Solr space facet
YüksekCVSS 8,8İstismar yokEPSS %83
- RCE
xwiki · xwiki10 Nis 2024
CVE-2023-29509
58Planlayın
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
YüksekCVSS 8,8İstismar yokEPSS %76
- RCE
xwiki · xwiki16 Nis 2023
CVE-2024-31465
58Planlayın
XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet
YüksekCVSS 8,8İstismar yokEPSS %76
- RCE
xwiki · xwiki10 Nis 2024
CVE-2023-35150
55Planlayın
XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
YüksekCVSS 8,0İstismar yokEPSS %78
- RCE
xwiki · xwiki23 Haz 2023
CVE-2024-31982
49Planlayın
XWiki Platform: Remote code execution as guest via DatabaseSearch
KritikCVSS 9,8Kavram kanıtıEPSS %35
- pre-auth RCE
xwiki · xwiki10 Nis 2024
CVE-2026-0769
49Planlayın
Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability
KritikCVSS 9,8Kavram kanıtıEPSS %32
- pre-auth RCE
langflow · langflow23 Oca 2026
CVE-2026-1470
45Planlayın
Authenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.
KritikCVSS 9,9İstismar yokEPSS %21
- RCE
n8n · n8n27 Oca 2026
CVE-2025-54322
44Planlayın
Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py.
KritikCVSS 9,8Kavram kanıtıEPSS %15
- pre-auth RCE
xspeeder · sxzos27 Ara 2025
CVE-2025-0868
42Planlayın
Remote Code Execution in DocsGPT
KritikCVSS 9,3Kavram kanıtıEPSS %17
- pre-auth RCE
arc53 · docsgpt20 Şub 2025
CVE-2026-0863
42Planlayın
Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.
KritikCVSS 9,9İstismar yokEPSS %9
- RCE
n8n · n8n18 Oca 2026
CVE-2013-10070
41Planlayın
PHP-Charts v1.0 PHP Code Execution
KritikCVSS 10,0SilahlaştırılmışEPSS %2
- pre-auth RCE
php-charts · php-charts5 Ağu 2025
CVE-2026-19295
40Planlayın
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
KritikCVSS 9,9SilahlaştırılmışEPSS %3
- RCE
langflow · langflow28 Ağu 2026
CVE-2024-31996
40Planlayın
XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution
KritikCVSS 9,8İstismar yokEPSS %2
- pre-auth RCE
xwiki · xwiki10 Nis 2024
CVE-2026-100741
40Planlayın
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer
KritikCVSS 9,8İstismar yokEPSS %2
- pre-auth RCE
progressive robot ltd · hmailserver3 gün önce
CVE-2026-61539
40Planlayın
Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing
KritikCVSS 10,0İstismar yokEPSS %1
- pre-auth RCE
xorbitsai · inference21 Ağu 2026
CVE-2021-23277
40Planlayın
Improper Neutralization of Directives in Dynamically Evaluated Code
KritikCVSS 10,0İstismar yokEPSS %1
- pre-auth RCE
eaton · intelligent power manager13 Nis 2021
CVE-2025-68271
40Planlayın
Unauthenticated Remote Code Execution in openc3-api
KritikCVSS 10,0İstismar yokEPSS %1
- pre-auth RCE
openc3 · cosmos13 Oca 2026
CVE-2026-22666
39İzleyin
Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()
YüksekCVSS 8,6Kavram kanıtıEPSS %16
- RCE
dolibarr · dolibarr erp\/crm7 Nis 2026

Tüm zafiyet sınıfları