CWE-95
Medium likelihoodImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
152 vulnerabilities with CWE-95
CVE-2025-27603
CRITICAL
XWiki Confluence Migrator Pro <1.2.0 - Code Injection
CVSS 9.1
CVE-2025-24893
CRITICAL
KEV
XWiki Platform - Remote Code Execution
CVSS 9.8
CVE-2025-0868
CRITICAL
DocsGPT 0.8.1-0.12.0 - Remote Code Execution via /api/remote Endpoint
CVE-2024-41921
HIGH
Robot Operating System Noetic Ninjemys and earlier - Code Injection via rostopic echo --filter Option
CVSS 7.8
CVE-2024-41148
HIGH
Robot Operating System Noetic Ninjemys and earlier - Code Injection via rostopic hz --filter Option
CVSS 7.8
CVE-2024-39835
HIGH
Robot Operating System Noetic Ninjemys and earlier - Remote Code Execution via roslaunch Substitution Args
CVSS 7.8
CVE-2024-39289
HIGH
Robot Operating System Noetic Ninjemys and earlier - Remote Code Execution via rosparam Angle Converter Eval Injection
CVSS 7.8
CVE-2024-10633
HIGH
Quiz Maker Business <= 8.8.0, Developer <= 21.8.0, Agency <= 31.8.0 - Unauthenticated Arbitrary Shortcode Execution
CVSS 7.3
CVE-2024-8512
CRITICAL
W3SPEEDSTER < 7.26 - Authenticated Remote Code Execution via script Parameter in hookBeforeStartOptimization()
CVSS 9.1
CVE-2024-45858
HIGH
Guardrails AI Guardrails <0.5.10 - RCE
CVSS 7.8
CVE-2024-45851
HIGH
MindsDB 23.10.5.0-24.7.4.1 - Remote Code Execution via SharePoint INSERT Query
CVSS 8.8
CVE-2024-45850
HIGH
MindsDB 23.10.5.0-24.7.4.1 - Remote Code Execution via SharePoint Integration INSERT Query
CVSS 8.8
CVE-2024-45849
HIGH
MindsDB 23.10.5.0-24.7.4.1 - Remote Code Execution via SharePoint INSERT Query
CVSS 8.8
CVE-2024-45848
HIGH
MindsDB 23.12.4.0-24.7.4.1 - Remote Code Execution via ChromaDB INSERT Query
CVSS 8.8
CVE-2024-45847
HIGH
MindsDB 23.11.4.2-24.7.4.1 - Remote Code Execution via UPDATE Query Eval Injection
CVSS 8.8
CVE-2024-45846
HIGH
MindsDB 23.10.3.0-24.7.4.1 - Remote Code Execution via Weaviate SELECT WHERE Clause
CVSS 8.8
CVE-2024-27321
HIGH
Refuel Autolabel >= 0.0.8 - Remote Code Execution via Malicious CSV File in Multilabel Classification Task
CVSS 7.8
CVE-2024-27320
HIGH
Refuel Autolabel >= 0.0.8 - Remote Code Execution via Malicious CSV File
CVSS 7.8
CVE-2024-7954
CRITICAL
SPIP porte_plume - Unauthenticated PHP Code Execution
CVSS 9.8
CVE-2024-43404
CRITICAL
Megabot < 1.5.0 - Remote Code Execution via /math Command Expression Parameter
CVSS 9.8
CVE-2024-6891
HIGH
journyx - Authenticated Python Code Injection during Login
CVSS 8.8
CVE-2024-37901
CRITICAL
XWiki 9.2-14.10.20 - Authenticated Remote Code Execution via SearchSuggestClass Instances
CVSS 9.9
CVE-2024-39173
CRITICAL
calculator-boilerplate v1.0 - Remote Code Execution via Eval Injection in Calculator Route
CVSS 9.8
CVE-2024-36404
CRITICAL
GeoTools < 29.6, 30.0-30.4, 31.0-31.2 - Remote Code Execution via XPath Expression Evaluation
CVSS 9.8
CVE-2024-36401
CRITICAL
KEV
Geoserver unauthenticated Remote Code Execution
CVSS 9.8
Details
Vulnerabilities
152
Exploit Likelihood
Medium