CWE-95
Medium likelihoodImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
152 vulnerabilities with CWE-95
CVE-2024-3562
HIGH
Custom Field Suite <2.6.7 - Code Injection
CVSS 8.8
CVE-2024-32649
MEDIUM
vyperlang/vyper < 0.4.0 - Double Eval Vulnerability via sqrt Builtin
CVSS 5.3
CVE-2024-32647
MEDIUM
vyperlang/vyper < 0.4.0 - Eval Injection via create_from_blueprint raw_args Parameter
CVSS 5.3
CVE-2024-31996
CRITICAL
XWiki Platform <4.10.19, <15.5.4, <15.10-rc-1 - RCE
CVSS 10.0
CVE-2024-31986
CRITICAL
XWiki Platform <4.10.19-15.10-rc-1 - RCE
CVSS 9.0
CVE-2024-31984
CRITICAL
XWiki Platform <4.10.20, 15.5.4, 15.10-rc-1 - RCE
CVSS 9.9
CVE-2024-31982
CRITICAL
XWiki Platform <4.10.20,15.5.4,15.10-rc-1 - RCE
CVSS 10.0
CVE-2024-31465
CRITICAL
XWiki 5.0-rc-1-14.10.19 - Authenticated Remote Code Execution via XWiki.SearchSuggestSourceClass Object Injection
CVSS 9.9
CVE-2024-21650
CRITICAL
XWiki < 4.10.20 - Remote code execution
CVSS 10.0
CVE-2023-26323
HIGH
Xiaomi App Market 4.57.4-4.58.2 - Remote Code Execution via Unsafe Configuration
CVSS 7.6
CVE-2023-7245
HIGH
OpenVPN Connect 3.0-3.4.3 (Windows)/3.0-3.4.7 (macOS) - Local Code Execution via ELECTRON_RUN_AS_NODE
CVSS 7.8
CVE-2023-50447
HIGH
Pillow < 10.1.0 - Remote Code Execution via PIL.ImageMath.eval Environment Parameter
CVSS 8.1
CVE-2023-6735
HIGH
Checkmk < 2.2.0p18, 2.1.0p38, 2.0.0p39 - Privilege Escalation via mk_tsm Agent Plugin
CVSS 8.8
CVE-2023-7224
HIGH
OpenVPN Connect 3.0-3.4.6 - Local Code Execution via DYLD_INSERT_LIBRARIES
CVSS 7.8
CVE-2023-7101
HIGH
KEV
Spreadsheet::ParseExcel < 0.65 - Remote Code Execution via Number Format String Eval
CVSS 7.8
CVE-2023-50723
CRITICAL
XWiki Platform 2.3-14.10.5 - Authenticated Remote Code Execution via Administration Interface
CVSS 9.9
CVE-2023-50721
CRITICAL
XWiki Platform 4.5-14.10.5 - Remote Code Execution via Search UI Extension Injection
CVSS 9.9
CVE-2023-48699
HIGH
fastbots < 0.1.5 - Remote Code Execution via Locators.ini File Injection
CVSS 8.4
CVE-2023-46731
CRITICAL
XWiki Platform < 14.10.14 - Unauthenticated Remote Code Execution via Section URL Parameter
CVSS 10.0
CVE-2023-37909
CRITICAL
XWiki 5.1-14.10.7 - Authenticated Remote Code Execution via User Profile Script Macro Injection
CVSS 9.9
CVE-2023-40177
CRITICAL
XWiki 4.3.1-14.10.4 - Authenticated Eval Injection via User Profile Content Field
CVSS 9.9
CVE-2023-37462
CRITICAL
XWiki 7.0-14.4.8 - Remote Code Execution via SkinsCode.XWikiSkinsSheet Injection
CVSS 9.9
CVE-2023-35152
CRITICAL
XWiki Platform 12.9-14.4.8 - Authenticated Eval Injection via First Name Field
CVSS 9.9
CVE-2023-35150
CRITICAL
XWiki Platform 2.40m-2-14.4.8, 14.10.4, 15.0 - Remote Code Execution via Crafted URL Payload
CVSS 9.9
CVE-2023-30537
CRITICAL
XWiki 12.6.6-13.10.10 - Authenticated Remote Code Execution via FlamingoThemesCode.WebHome Style Property
CVSS 9.9
Details
Vulnerabilities
152
Exploit Likelihood
Medium