CWE-95

Medium likelihood

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Parent: CWE-94 - Improper Control of Generation of Code ('Code Injection')

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

152 vulnerabilities with CWE-95
CVE-2023-29511 CRITICAL
XWiki 1.7-13.10.10 - Authenticated Remote Code Execution via Section ID Injection in AdminFieldsDisplaySheet
CVSS 9.9
CVE-2023-29509 CRITICAL
XWiki < 13.10.11 - Authenticated Remote Code Execution via DocumentTree Macro Parameter Injection
CVSS 9.9
CVE-2023-29214 CRITICAL
XWiki < 13.10.11 - Authenticated Remote Code Execution via IncludedDocuments Panel
CVSS 9.9
CVE-2023-29212 CRITICAL
XWiki 14.0-14.4.7 - Authenticated Remote Code Execution via Insufficient Escaping in Included Documents Edit Panel
CVSS 9.9
CVE-2023-29211 CRITICAL
XWiki < 13.10.11 - Authenticated Remote Code Execution via Improper WikiId Parameter Escaping
CVSS 9.9
CVE-2023-29210 CRITICAL
XWiki < 13.10.11 - Authenticated Remote Code Execution via Notification Preferences Macro
CVSS 9.9
CVE-2023-29209 CRITICAL
XWiki <13.10.11 - Code Execution via Legacy Notification Activity Macro
CVSS 9.9
CVE-2023-0888 MEDIUM
B.Braun Battery Pack SP with WiFi Firmware L90/U70 and L92/U92 - Authenticated Eval Injection in Embedded Web Server
CVSS 4.9
CVE-2023-0090 CRITICAL
Proofpoint Enterprise Protection <8.20.0 - RCE
CVSS 9.8
CVE-2023-0089 HIGH
Proofpoint Enterprise Protection <8.20.0 - Authenticated RCE
CVSS 8.8
CVE-2023-26477 CRITICAL
XWiki Platform <13.10.10, <14.9-rc-1, <14.4.6 - Code Injection
CVSS 10.0
CVE-2022-41931 CRITICAL
xwiki-platform-icon-ui - Eval Injection
CVSS 9.9
CVE-2022-41928 CRITICAL
XWiki 5.0-13.10.6 - Eval Injection in AttachmentSelector.xml
CVSS 9.9
CVE-2022-36100 CRITICAL
XWiki Platform <14.4 - Code Injection
CVSS 9.9
CVE-2022-36099 CRITICAL
XWiki Platform Wiki UI Main Wiki <13.10.6-14.4 - Code Injection
CVSS 9.9
CVE-2022-38193 MEDIUM
Esri Portal for ArcGIS <10.8.1 - Code Injection
CVSS 6.1
CVE-2022-36010 CRITICAL
react-editable-json-tree < 2.2.2 - Remote Code Execution via JsonFunctionValue Eval Injection
CVSS 10.0
CVE-2021-33678 MEDIUM
SAP NetWeaver AS ABAP - Code Injection
CVSS 6.5
CVE-2021-23277 HIGH
Eaton Intelligent Power Manager < 1.69 - Unauthenticated Eval Injection in loadUserFile Function
CVSS 8.3
CVE-2020-37137 MEDIUM
PHP-Fusion 9.03.50 - Remote Code Execution via panels.php Panel Content Parameter
CVSS 6.1
CVE-2020-6650 HIGH
Eaton UPS Companion < 1.05 - Remote Code Execution via Update Manager Eval Injection
CVSS 8.3
CVE-2020-5256 HIGH
BookStack < 0.25.5 - Remote Code Execution via PHP File Upload
CVSS 7.9
CVE-2020-5217 MEDIUM
Secure Headers < 3.8.0, 5.1.0, 6.2.0 - Directive Injection via Semicolon in CSP Directives
CVSS 4.4
CVE-2019-9507 HIGH
Vertiv Avocent UMG-4000 <4.2.1.19 - Command Injection
CVSS 8.3
CVE-2013-10070 CRITICAL
PHP-Charts 1.0 - Unauthenticated Remote Code Execution via GET Parameter Eval Injection
Details
Vulnerabilities 152
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits