CWE-95

Medium likelihood

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Parent: CWE-94 - Improper Control of Generation of Code ('Code Injection')

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

152 vulnerabilities with CWE-95
CVE-2025-50187 CRITICAL
Chamilo < 1.11.28 - Remote Code Execution via SOAP Request Parameter
CVSS 9.8
CVE-2025-15551 MEDIUM
TP-Link Archer MR200 v5.2, C20 v6, TL-WR850N v3, TL-WR845N v4 - RCE
CVSS 5.6
CVE-2025-68271 CRITICAL
OpenC3 COSMOS 5.0.0-6.10.1 - Unauthenticated Remote Code Execution via JSON-RPC API String Parameter
CVSS 10.0
CVE-2025-54322 CRITICAL
Xspeeder SXZOS < 2025-12-26 - Unauthenticated Remote Code Execution via Base64-Encoded Python Code in chkid Parameter
CVSS 10.0
CVE-2025-43466 MEDIUM
macOS < 26.1 - Unprotected User Data Exposure via Injection Issue
CVSS 5.5
CVE-2025-43388 MEDIUM
macOS < 26.1 - Unprotected User Data Exposure via Code Injection
CVSS 5.5
CVE-2025-65530 HIGH
CloudLinux ai-bolit <v32.7.4 - Code Injection
CVSS 8.8
CVE-2025-66474 HIGH
XWiki Rendering < 16.10.10, 17.0.0-rc-1-17.4.2, 17.5.0-rc-1-17.5.0 - Remote Code Execution via HTML Macro Injection
CVSS 8.8
CVE-2025-12140 CRITICAL
Wirtualna Uczelnia - redirectUrlParameter Java Expression Code Execution
CVE-2025-64496 HIGH
Open WebUI < 0.6.35 - Remote Code Execution via Direct Connections SSE Event Injection
CVSS 7.3
CVE-2025-61955 HIGH
F5OS-A F5OS-C - Privilege Escalation
CVSS 8.8
CVE-2025-48868 HIGH
Horilla 1.3.0 - Authenticated Remote Code Execution via Eval Injection in project_bulk_archive
CVSS 7.2
CVE-2025-55728 CRITICAL
XWiki Remote Macros 1.0-1.26.4 - Remote Code Execution via Panel Macro Classes Parameter
CVSS 10.0
CVE-2025-55727 CRITICAL
XWiki Remote Macros 1.0-1.26.4 - Remote Code Execution via Column Macro Width Parameter
CVSS 10.0
CVE-2025-58365 HIGH
XWiki <9.14 - Remote Code Execution
CVE-2025-55585 MEDIUM
TOTOLINK A3002R v4.0.0-B20230531.1404 - Command Injection
CVSS 6.5
CVE-2025-8420 HIGH
emarket-design WordPress Plugins - Unauthenticated Remote Code Execution via emd_form_builder_lite_pagenum Function
CVSS 8.1
CVE-2025-3753 HIGH
ROS rosbag filter - Arbitrary Python Code Execution
CVSS 7.8
CVE-2025-6101 MEDIUM
Letta-ai <0.4.1 - Improper Neutralization
CVSS 5.5
CVE-2025-49598 MEDIUM
conda-forge-ci-setup < 4.15.0 - meta.yaml eval Code Execution
CVE-2025-49013 CRITICAL
WilderForge - Remote Code Execution via GitHub Actions Workflow Injection
CVSS 9.9
CVE-2025-47271 MEDIUM
OZI-Project/publish 1.13.2-1.13.5 - Remote Code Execution via Branch Name Injection
CVE-2025-26845 CRITICAL
Znuny 6.0.31-6.0.47 and 7.0.1-7.1.3 - Authenticated Eval Injection via Configuration File
CVSS 9.8
CVE-2025-4318 CRITICAL
AWS Amplify Studio - Code Injection
CVE-2025-32435 LOW
Hydra < 2025-04-11 - Unauthenticated Eval Injection via Untrusted Nix Code Evaluation
CVSS 2.6
Details
Vulnerabilities 152
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits