admin/index.php in Longino Jacome php-Revista 1.1.2 allows remote attackers to bypass authentication controls by setting the ID_ADMIN and SUPER_ADMIN parameters to 1.


admin/index.php in V3 Chat Live Support 3.0.4 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1.


admin/index.php in Maian Weblog 4.0 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary weblog_cookie cookie.


admin/index.php in Maian Uploader 4.0 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary uploader_cookie cookie.


admin/index.php in Maian Guestbook 3.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary gbook_cookie cookie.


admin/index.php in Maian Links 3.1 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary links_cookie cookie.


admin/index.php in Maian Recipe 1.2 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary recipe_cookie cookie.


admin/index.php in Maian Search 1.1 and earlier allows remote attackers to bypass authentication and gain administrative access by sending an arbitrary search_cookie cookie.


SQL Injection in the login page in Online Bus Ticket Reservation 1.0 allows attackers to execute arbitrary SQL commands and bypass authentication via the username and password fields.


SQL injection vulnerability in login.asp of Brooky eStore 1.0.1 through 1.0.2b allows remote attackers to bypass authentication and execute arbitrary SQL code via the (1) user or (2) pass parameters.


SQL injection vulnerability in bttlxeForum 2.0 beta 3 and earlier allows remote attackers to bypass authentication via the (1) username and (2) password fields and possibly other fields.


SQL injection vulnerability in global.php3 of AttilaPHP 3.0 and possibly earlier versions allows remote attackers to bypass authentication via a modified cook_id parameter.


SQL injection vulnerability in session.php in LinPHA 0.9.4 allows remote attackers to execute arbitrary SQL code and bypass authentication via the (1) linpha_userid or (2) linpha_password cookies.


SQL injection vulnerability in controlpanel.php in Jaws Framework and Content Management System 0.4 allows remote attackers to execute arbitrary SQL and bypass authentication via the (1) user (2) password or (3) crypted_password parameters.


SQL injection vulnerability in IP3 Networks NetAccess Appliance before firmware 3.1.18b13 allows remote attackers to bypass authentication via the (1) login or (2) password. NOTE: this issue was later reported to also affect firmware 4.0.34.


SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentication and gain access by injecting base64-encoded SQL code into the user parameter.


SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.


SQL injection vulnerability in verify.asp in Asp-rider allows remote attackers to execute arbitrary SQL statements and bypass authentication via the username parameter.


SQL injection vulnerability in Infinity WEB 1.0 allows remote attackers to bypass authentication and gain privileges via the login page.


SQL injection vulnerability in DeluxeBB 1.07 and earlier allows remote attackers to bypass authentication spoof users and modify settings via the (1) memberpw and (2) membercookie cookies.


SQL injection vulnerability in the loginADP function in ajaxp.php in AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.


SQL injection vulnerability in administration/includes/login/auth.php in HotPlug CMS 1.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password parameters.


SQL injection vulnerability in admin/auth.inc.php in Geeklog 1.4.0sr2 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the loginname parameter.


SQL injection vulnerability in admin/processlogin.php in Bit 5 Blog 8.01 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password parameter.


SQL injection vulnerability in WebspotBlogging 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter to login.php.


SQL injection vulnerability in CyberShop allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action.


SQL injection vulnerability in index.php in BlogPHP 1.0 when magic_quotes_gpc is disabled allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action.


SQL injection vulnerability in login.php in Scriptme SmE GB Host 1.21 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the Username parameter.


SQL injection vulnerability in login.php in miniBloggie 1.0 and earlier when gpc_magic_quotes is disabled allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password parameters.


SQL injection vulnerability in DSLogin 1.0 with magic_quotes_gpc disabled allows remote attackers to execute arbitrary SQL commands and bypass authentication via the $log_userid variable in (1) index.php and (2) admin/index.php.


SQL injection vulnerability in config.php in EKINboard 1.0.3 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username cookie.


SQL injection vulnerability in includes/functions.php in Kubix 0.7 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the member_id parameter ($id variable) to index.php.


SQL injection vulnerability in giris_yap.asp in Hazir Site 2.0 allows remote attackers to bypass authentication via the (1) k_a class or (2) sifre parameter.


SQL injection vulnerability in Call Center Software 0.93 and earlier allows remote attackers to execute arbitrary SQL commands and bypass authentication via the user name in the login page.


SQL injection vulnerability in article.php in PostNuke 0.62 through 0.64 allows remote attackers to bypass authentication via the user parameter.


SQL injection vulnerability in PHPGurukul Employee Record Management System 1.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication.


SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System With admin panel 2.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication.


SQL injection vulnerability in BloodX 1.0 allows attackers to bypass authentication.


SQL injection vulnerability in login.asp in NEXTWEB (i)Site allows remote attackers to execute arbitrary SQL commands and bypass authentication via the password field.


SQL injection vulnerability in login.asp for Net56 Browser Based File Manager 1.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the password field.


SQL injection vulnerability in Techno Dreams Mailing List script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.


SQL injection vulnerability in Techno Dreams Guest Book script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.


SQL injection vulnerability in auth.inc.php in PHPX 3.5.9 and earlier allows remote attackers to execute arbitrary SQL commands bypass authentication and upload arbitrary PHP code via the username parameter.


SQL injection vulnerability in Techno Dreams Web Directory script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.


SQL injection vulnerability in resetcore.php in e107 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands bypass authentication and inject HTML or script via the (1) a_name parameter or (2) user field of the login page.


SQL injection vulnerability in admin/index.php in ActiveCampaign 1-2-All Broadcast Email allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username field in the admin control panel.


SQL injection vulnerability in Techno Dreams Announcement script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.


SQL injection vulnerability in ASPKnowledgebase allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password fields in adminlogin.asp.


SQL injection vulnerability in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the login field.


SQL injection vulnerability in the login function for the administration login panel in cosmoshop 8.10.78 allows remote attackers to execute arbitrary SQL commands and bypass authentication via unspecified vectors.


SQL injection vulnerability in the login form for LogiSense software including (1) Hawk-i Billing (2) Hawk-i ASP and (3) DNS Manager allows remote attackers to bypass authentication via SQL code in the password field.


SQL injection vulnerability in Spooky Login 2.0 through 2.5 allows remote attackers to bypass authentication and gain privileges via the password field.


SQL injection vulnerability in ASP Client Check (ASPCC) 1.3 and 1.5 allows remote attackers to bypass authentication and gain unauthorized access via the password field.


SQL injection vulnerability in shopadmin.asp in VP-ASP 4.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password fields.


An issue in the administrator authentication panel of PTCL HG150-Ub v3.0 allows attackers to bypass authentication via modification of the cookie value and Response Path.


admin/login.php in DM FileManager 3.9.2 allows remote attackers to bypass authentication and gain administrative access by setting the (1) USER (2) GROUPID (3) GROUP and (4) USERID cookies to certain values.


admin/login.php in Stash 1.0.3 allows remote attackers to bypass authentication and gain administrative access by setting a bsm cookie.


admin/login.php in BilboBlog 0.2.1 when register_globals is enabled allows remote attackers to bypass authentication and obtain administrative access via a direct request that sets the login admin_login password and admin_passwd parameters.


Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication and read sensitive information or upload an arbitrary ZIP archive to the server.


The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote attackers to bypass authentication via a crafted password-reset action that triggers a new administrative session.


IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow an attacker to bypass authentication and issue commands using a specially crafted HTTP command. IBM X-Force ID: 181995.


Hands-on Vulnerability Learning Tool \AppGoat\ for Web Application V3.0.0 and earlier allows remote attackers to bypass authentication to perform arbitrary operations via unspecified vectors.


index.php in PHP Site Lock 2.0 allows remote attackers to bypass authentication and obtain administrative access by setting the login_id group_id login_name user_id and user_type cookies to certain values.


importbuddy.php in the BackupBuddy plugin 1.3.4 2.1.4 2.2.25 2.2.28 and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter.


MultiFileUploadHandler.php in the Sun Cobalt RaQ XTR administration interface allows local users to bypass authentication and overwrite arbitrary files via a symlink attack on a temporary file followed by a request to MultiFileUpload.php.


SG Real Estate Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the Auth cookie to 1.


IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IBM X-Force ID: 138824.


Directory Services in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 does not properly handle errors associated with disabled mobile accounts which allows remote attackers to bypass authentication by providing a valid account name.


IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not invalidate a session upon a logout action which allows remote attackers to bypass authentication by leveraging an unattended workstation.


HP System Management Homepage (SMH) 2.1.3.132 when running on CompaqHTTPServer/9.9 on Windows Linux or Tru64 UNIX and when \Trust by Certificates\ is not enabled allows remote attackers to bypass authentication via a crafted URL.


Multiple unknown vulnerabilities in the MicroServer Web Server for Xerox WorkCentre Pro Color 2128 2636 and 3545 version 0.001.04.044 through 0.001.04.504 allow attackers to bypass authentication.


A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated remote attacker to bypass authentication and get the administrator privileges.


Unknown vulnerability in Cisco Catalyst 7.5(1) allows local users to bypass authentication and gain access to the enable mode without a password.


Unspecified vulnerability in Citrix VDI-In-A-Box 5.3.x before 5.3.8 and 5.4.x before 5.4.4 allows remote attackers to bypass authentication via unspecified vectors related to a Java servlet.


Unspecified vulnerability in Citrix XenServer 5.0 Update 3 and earlier and 5.5 allows local users to bypass authentication and execute unspecified Xen API (XAPI) calls via unknown vectors.


Unspecified vulnerability in Citrix Access Gateway with Advanced Access Control (AAC) 4.2 before 20060914 when AAC is configured to use LDAP authentication allows remote attackers to bypass authentication via unknown vectors.


Unspecified vulnerability in Citrix Access Gateway Standard Edition 4.5.7 and earlier and Advanced Edition 4.5 HF2 and earlier allows attackers to bypass authentication and gain \access to network resources\ via unspecified vectors.


Unspecified vulnerability in Hitachi JP1/File Transmission Server/FTP 01-00 through 08-10-01 allows remote attackers to bypass authentication and \view files\ via unspecified vectors.


Unknown vulnerability in Hitachi Job Management Partner (JP1) JP1/File Transmission Server/FTP 6 and 7 when running on HP-UX in trusted mode allows attackers to bypass authentication and gain administrator rights.


Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Service Operation Management Software Module allows remote attackers to bypass authentication via unknown vectors aka ZDI-CAN-1644.


Unspecified vulnerability in HP Integrated Lights-Out 3 (aka iLO3) firmware before 1.60 and 4 (aka iLO4) firmware before 1.30 allows remote attackers to bypass authentication via unknown vectors.


Unspecified vulnerability in HP SiteScope 11.1x through 11.13 and 11.2x through 11.24 allows remote attackers to bypass authentication via unknown vectors aka ZDI-CAN-2140.


Unspecified vulnerability in HP Operations Orchestration 10.x allows remote attackers to bypass authentication and obtain sensitive information or modify data via unknown vectors.


Unspecified vulnerability in Sun Java System Access Manager 7.0 allows local users logged in as \root\ to bypass authentication and gain top-level administrator privileges via the amadmin CLI tool.


Unspecified vulnerability in Sun Java System Access Manager (AM) 7.1 when used with certain versions and configurations of Sun Directory Server Enterprise Edition (DSEE) allows remote attackers to bypass authentication via unspecified vectors.


A vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication.


Unspecified vulnerability in the management EJB (MEJB) in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain \access to Geronimo internals\ via unspecified vectors.


Unspecified vulnerability in the Web User Interface in Xerox WorkCentre and WorkCentre Pro before 12.050.03.000 13.x before 13.050.03.000 and 14.x before 14.050.03.000 allows remote attackers to bypass authentication controls via unknown vectors.


Unspecified vulnerability in the administration interface in Uresk Links 2.0 Lite allows remote attackers to bypass authentication via unspecified vectors in index.php.


A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance.


It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information or to possibly conduct further attacks.


The web interface for Everfocus EDR1600 DVR allows remote attackers to bypass authentication and access live cams via certain vectors.


The web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 allows remote attackers to bypass authentication and reset the modem or replace the firmware via a direct request to an unspecified page.


The web interface on (1) Foscam and (2) Wansview IP cameras allows remote attackers to bypass authentication and perform administrative functions or read the admin password via a direct request to an unspecified URL.


The web management interface on the LG-Nortel ELO GS24M switch allows remote attackers to bypass authentication and consequently obtain cleartext credential and configuration information via a direct request to a configuration web page.


The web server on the AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to bypass authentication and modify settings via a direct request to an unspecified URL.


Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy which makes it easier for remote attackers to bypass authentication and join arbitrary meetings without a password aka Bug ID CSCuc79643.


BEA WebLogic Server and WebLogic Express 6.1 through 10.0 allows remote attackers to bypass authentication for application servlets via crafted request headers.


IBM WebSphere Application Server 6.0.2 before FixPack 3 allows remote attackers to bypass authentication for the Welcome Page via a request to the default context root.


A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled.

bypass authentication
weak authentication management


Jetty before 4.2.27 5.1 before 5.1.12 6.0 before 6.0.2 and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random which makes it easier for remote attackers to guess a session identifier through brute force attacks bypass authentication requirements and possibly conduct cross-site request forgery attacks.

bypass authentication
cross site request forgery


The management interface in Akamai Client (formerly Red Swoosh) 3322 and earlier allows remote attackers to bypass authentication via an HTTP request that contains (1) no Referer header or (2) a spoofed Referer header that matches an approved domain which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and force the client to download and execute arbitrary files.


Cross-site request forgery (CSRF) vulnerability in Greenbone Security Assistant (GSA) before 2.0+rc3 allows remote attackers to hijack the authentication of users for requests that send email via an OMP request to OpenVAS Manager. NOTE: this issue can be leveraged to bypass authentication requirements for exploiting CVE-2011-0018.


A vulnerability in the Secure Shell (SSH) authentication process of Cisco Small Business Switches software could allow an attacker to bypass client-side certificate authentication and revert to password authentication. The vulnerability exists because OpenSSH mishandles the authentication process. An attacker could exploit this vulnerability by attempting to connect to the device via SSH. A successful exploit could allow the attacker to access the configuration as an administrative user if the default credentials are not changed. There are no workarounds available; however if client-side certificate authentication is enabled disable it and use strong password authentication. Client-side certificate authentication is disabled by default.


A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocol inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to bypass the configured file policies on an affected system. The vulnerability is due to errors when handling specific SSL/TLS messages. An attacker could exploit this vulnerability by sending crafted HTTP packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured file policies and deliver a malicious payload to the protected network.


A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to bypass configured content filters on the device. The vulnerability is due to improper input validation of the email body. An attacker could exploit this vulnerability by inserting specific character strings in the message. A successful exploit could allow the attacker to bypass configured content filters that would normally drop the email.


A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to bypass configured filters on the device. The vulnerability is due to improper input validation of certain email fields. An attacker could exploit this vulnerability by sending a crafted email message to a recipient protected by the ESA. A successful exploit could allow the attacker to bypass configured message filters and inject arbitrary scripting code inside the email body. The malicious code is not executed by default unless the recipient's email client is configured to execute scripts contained in emails.


A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocol parser of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to bypass configured policies. The vulnerability is due to improper parsing of specific attributes in a TLS packet header. An attacker could exploit this vulnerability by sending malicious TLS messages to the affected system. A successful exploit could allow the attacker to bypass the configured policies for the system which could allow traffic to flow through without being inspected.


A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated remote attacker to bypass configured user filters on the device. The vulnerability is due to incomplete input and validation checking mechanisms for certain SPF messages that are sent to an affected device. An attacker could exploit this vulnerability by sending a customized SPF packet to an affected device. A successful exploit could allow the attacker to bypass the header filters that are configured for the affected device which could allow malicious content to pass through the device.


Cisco Adaptive Security Appliance (ASA) and Cisco PIX security appliance 8.0.x before 8.0(3)9 allows remote attackers to bypass control-plane ACLs for the device via unknown vectors.


Cisco Adaptive Security Appliance (ASA) Software 8.2 through 9.4.3.3 allows remote attackers to bypass intended ICMP Echo Reply ACLs via vectors related to subtypes.


An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can bypass Factory Reset Protection (FRP) via an RCS call. The Samsung ID is SVE-2019-15035 (October 2019).


An issue was discovered on Samsung mobile devices with N(7.x) O(8.x) and P(9.0) software. Attackers can bypass Factory Reset Protection (FRP) via a SIM card by blocking the PUK code. The Samsung ID is SVE-2019-15262 (October 2019).


An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can bypass Factory Reset Protection (FRP) via SamsungPay mini. The Samsung ID is SVE-2019-15090 (November 2019).


An issue was discovered on Samsung mobile devices with N(7.x) O(8.x) and P(9.0) software. Attackers can bypass Factory Reset Protection (FRP) via a Class 0 Type Message. The Samsung ID is SVE-2019-14941 (October 2019).


An issue was discovered on Samsung mobile devices with P(9.0) O(8.0) and N(7.1) software. Attackers can bypass Factory Reset Protection (FRP) via Smart Switch. The Samsung ID is SVE-2019-15138 (September 2019).


An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can bypass Factory Reset Protection (FRP) via the status bar. The Samsung ID is SVE-2019-15089 (September 2019).


An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. Attackers can bypass Factory Reset Protection (FRP) via SVoice T&C. The Samsung ID is SVE-2018-13547 (March 2019).


An issue was discovered on Samsung mobile devices with O(8.x) software. Attackers can bypass Factory Reset Protection (FRP) via an external keyboard. The Samsung ID is SVE-2019-15164 (October 2019).


A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software Cisco FirePOWER Services Software for ASA and Cisco Firepower Management Center Software could allow an unauthenticated remote attacker to bypass filtering protections. The vulnerability is due to insufficient normalization of a text-based payload. An attacker could exploit this vulnerability by sending traffic that contains specifically obfuscated payloads through an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious payloads to protected systems that would otherwise be blocked.


A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software Cisco FirePOWER Services Software for ASA and Cisco Firepower Management Center Software could allow an unauthenticated remote attacker to bypass filtering protections. The vulnerability is due to improper reassembly of traffic streams. An attacker could exploit this vulnerability by sending crafted streams through an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious requests to protected systems that would otherwise be blocked.


Caucho Quercus as distributed in Resin before 4.0.29 allows remote attackers to bypass intended restrictions on filename extensions for created files via a %00 sequence in a pathname within an HTTP request.


MyBB (aka MyBulletinBoard) before 1.4.12 allows remote authenticated users to bypass intended restrictions on the number of img MyCodes by editing a post after it has been created.


In findAvailSpellCheckerLocked of TextServicesManagerService.java there is a possible way to bypass the warning dialog when selecting an untrusted spell checker due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0Android ID: A-118694079


An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5. A malicious application may be able to bypass Privacy preferences.


Extreme EXOS 16.x 21.x and 22.x allows administrators to bypass the \exsh restricted shell\ protection mechanism and obtain an interactive shell.


The administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to bypass a read-only protection mechanism by using Firefox with a web-developer plugin.


Adobe Acrobat and Reader versions 2019.010.20069 and earlier 2017.011.30113 and earlier version and 2015.006.30464 and earlier have a security bypass vulnerability. Successful exploitation could lead to privilege escalation.


In Serendipity before 2.0.5 an attacker can bypass SSRF protection by using a malformed IP address (e.g. http://127.1) or a 30x (aka Redirection) HTTP status code.


Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.


Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.


Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.


Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.


Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.


Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.


A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated remote attacker to bypass user authentication and gain access as an administrative user. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to gain full administrative access to the affected device.


A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated remote attacker to acquire a valid session token with administrator privileges bypassing user authentication. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to use the acquired session token to gain full administrator access to the affected device.


In all Android releases from CAF using the Linux kernel a vulnerability in eMMC write protection exists that can be used to bypass power-on write protection.


libautotrace.a in AutoTrace 0.31.1 has a \cannot be represented in type int\ issue in input-bmp.c:309:7.


libautotrace.a in AutoTrace 0.31.1 has a \cannot be represented in type int\ issue in input-bmp.c:486:7.


libautotrace.a in AutoTrace 0.31.1 has a \cannot be represented in type int\ issue in autotrace.c:191:2.


libautotrace.a in AutoTrace 0.31.1 has a \cannot be represented in type int\ issue in input-tga.c:498:55.


libautotrace.a in AutoTrace 0.31.1 has a \cannot be represented in type int\ issue in pxl-outline.c:106:54.


libautotrace.a in AutoTrace 0.31.1 has a \negative-size-param\ issue in the ReadImage function in input-tga.c:528:7.


libautotrace.a in AutoTrace 0.31.1 has a \cannot be represented in type int\ issue in input-bmp.c:326:17.


libautotrace.a in AutoTrace 0.31.1 has a \left shift ... cannot be represented in type int\ issue in input-bmp.c:516:63.


libautotrace.a in AutoTrace 0.31.1 has a \cannot be represented in type int\ issue in autotrace.c:188:23.


libautotrace.a in AutoTrace 0.31.1 has a \cannot be represented in type int\ issue in input-tga.c:508:18.


libautotrace.a in AutoTrace 0.31.1 has a \cannot be represented in type int\ issue in input-bmp.c:314:7.


libautotrace.a in AutoTrace 0.31.1 has a \cannot be represented in type int\ issue in input-tga.c:192:19.


libautotrace.a in AutoTrace 0.31.1 has a \cannot be represented in type int\ issue in input-tga.c:528:63.


libautotrace.a in AutoTrace 0.31.1 has a \cannot be represented in type int\ issue in input-bmp.c:319:7.


Cisco Wireless LAN Controller (WLC) devices with software 7.6.x 8.0 before 8.0.121.0 and 8.1 before 8.1.131.0 allow remote attackers to change configuration settings via unspecified vectors aka Bug ID CSCuw06153.


Side-channel information leakage in DevTools in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to bypass site isolation via a crafted HTML page.


Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.


Side-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


Side-channel information leakage in scroll to text in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.


Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page.


The Antivirus component in Comodo Internet Security before 5.3.175888.1227 does not check whether X.509 certificates in signed executable files have been revoked which has unknown impact and remote attack vectors.


An access issue was addressed with additional sandbox restrictions. This issue is fixed in Shortcuts 2.1.3 for iOS. A sandboxed process may be able to circumvent sandbox restrictions.


In KeePassX before 0.4.4 a cleartext copy of password data is created upon a cancel of an XML export action. This allows context-dependent attackers to obtain sensitive information by reading the .xml dotfile.


Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when replying to query on port tcp/5010.


The web interface for American Power Conversion (APC) PowerChute Network Shutdown performs all communication in cleartext (base64-encoded) which allows remote attackers to sniff authentication credentials.


The web interface in Pattern Insight 2.3 allows remote attackers to conduct clickjacking attacks via a FRAME element.


IBM AIX 7.0 7.1 7.2 and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the lscore command which could lead to code execution. IBM X-Force ID: 212953.


** DISPUTED ** In Tcl 8.6.11 a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding.


IBM AIX 7.1 7.2 and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the mount command which could lead to code execution. IBM X-Force ID: 212952.


A Code Execution vulnerability exists in select.py when using python-mode 2012-12-19.


A code execution vulnerability exists in the kdu_buffered_expand function of the Kakadu SDK 7.9. A specially crafted JPEG 2000 file can be read by the program and can lead to an out of bounds write causing an exploitable condition to arise.


A code execution vulnerability exists in the Kakadu SDK 7.9's parsing of compressed JPEG 2000 images. A specially crafted JPEG 2000 file can be read by the program and can lead to an out of bounds write causing an exploitable condition to arise.


Arbitrary Code Execution vulnerability in Micro Focus Universal CMDB version 4.10 4.11 4.12. This vulnerability could be remotely exploited to allow Arbitrary Code Execution.


Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in the execution of arbitrary code.


A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A specially crafted web page can lead to a use after free.


A Code Execution vulnerability exists the attachment parameter to index.php in Jcow CMS 4.x to 4.2 and 5.2 to 5.2.


A Code Execution vulnerability exists in Android prior to 4.4.0 related to the addJavascriptInterface method and the accessibility and accessibilityTraversal objects which could let a remote malicious user execute arbitrary code.

code execution vulnerability
arbitrary code execution


Arbitrary code execution vulnerability on Micro Focus Operation Bridge Reporter affecting version 10.40 and earlier. The vulnerability could allow remote attackers to execute arbitrary code on affected installations of OBR.


A code execution vulnerability exists in the DL_Dxf::handleLWPolylineData functionality of Ribbonsoft dxflib 3.17.0. A specially-crafted .dxf file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

code execution vulnerability
buffer overflow


A Code Execution vulnerability exists in the memcpy function when processing AMF requests in Ezhometech EzServer 7.0 which could let a remote malicious user execute arbitrary code or cause a Denial of Service

code execution vulnerability
denial of service
arbitrary code execution


Remote code execution vulnerability exists in KaKaoTalk PC messenger when user clicks specially crafted link in the message window. This affects KaKaoTalk windows version 2.7.5.2024 or lower.

code execution vulnerability
remote code execution


Remote Code Execution vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product affecting versions 7.0.2 through 7.5. The vulnerability could be exploited resulting in remote code execution.


Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess.


A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.


Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the \timezone\ parameter in step 4 of a fresh installation procedure.


Remote Code Execution vulnerability in PbootCMS 2.0.8 in the message board.


Remote Code Execution vulnerability in the web interface in McAfee Web Advisor (WA) 8.0.34745 and earlier allows remote unauthenticated attacker to execute arbitrary code via a cross site scripting attack.

code execution vulnerability
remote code execution
arbitrary code execution


Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31 2019 allows remote attackers to execute arbitrary code.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by a Developer user.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by an Admin user.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by a Developer user.


SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by an Admin user.


Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScript or HTML.


FTP

Function

of

SAP

NetWeaver

AS

ABAP

Platform

versions-

KERNEL

allows

an

attacker

to

inject

code

or

specifically

manipulated

command

that

can

be

executed

by

the

application.

An

attacker

could

thereby

control

the

behaviour

of

the

application.


An authenticated attacker in SAP E-Commerce (Business-to-Consumer application) versions 7.3 7.31 7.32 7.33 7.54 can change the price of the product to zero and also checkout by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine leading to Code Injection.


SAP Commerce Cloud (Mediaconversion Extension) versions 6.4 6.5 6.6 6.7 1808 1811 1905 allows an authenticated Backoffice/HMC user to inject code that can be executed by the application leading to Code Injection. An attacker could thereby control the behavior of the application.


The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service) version 7.2 allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.


SAP NetWeaver Application Server Java Web Container ENGINEAPI (before versions 7.10 7.20 7.30 7.31 7.40 7.50) and SAP-JEECOR (before versions 6.40 7.0 7.01) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application.


SAP Cloud Connector before version 2.11.3 allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.


The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain a code injection vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to run custom Groovy scripts to gain limited access to view or modify information on the Workflow system.


Code Injection vulnerability in EPSetup.exe in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to get their malicious code installed by the ENS installer via code injection into EPSetup.exe by an attacker with access to the installer.


The events-manager plugin before 5.6 for WordPress has code injection.


Code injection in the /ui/login form Language parameter in Epicentro E_7.3.2+ allows attackers to execute JavaScript code by making a user issue a manipulated POST request.


There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause code injection.


The login page in Telmat AccessLog <= 6.0 (TAL_20180415) allows an attacker to get root shell access via Unauthenticated code injection over the network.


Simple

Machines

Forum

(SMF)

allows

PHP

Code

Injection

via

the

index.php?action=admin;area=languages;sa=editlang

dictionary

parameter.


A reflected cross site scripting attack in the NetIQ Access Manager before 4.3.3 using the \typecontainerid\ parameter of the policy editor could allowed code injection into pages of authenticated users.


A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).

code injection vulnerability
arbitrary code execution
code injection


A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file.


A code injection vulnerability exists in one of the webpages in GE Reason RT430 RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the system.


Direct code injection vulnerability in Task Manager in Invision Power Board 2.0.1 allows limited remote attackers to execute arbitrary code by referencing the file in \Task PHP File To Run\ field and selecting \Run Task Now\.


A code injection vulnerability exists within the firewall software of GlassWire v2.1.167 that could lead to arbitrary code execution from a file in the user path on first execution.

code injection vulnerability
code injection


A code injection vulnerability has been discovered in the Upgrade function of QibosoftX1 v1.0. An attacker is able execute arbitrary PHP code via exploitation of client_upgrade_edition.php and Upgrade.php.


Static code injection vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to execute arbitrary PHP code via the value parameter.


Static code injection vulnerability in process.php in AimStats 3.2 allows remote attackers to inject PHP code into config.php via the number parameter in an update action.


Static code injection vulnerability in install.php in mcRefer allows remote attackers to execute arbitrary PHP code via the bgcolor parameter which is inserted into mcrconf.inc.php.


Static code injection vulnerability in install.php in Morfy CMS 1.05 allows remote authenticated users to inject arbitrary PHP code into config.php via the site_url parameter.


Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the _word_upper_bound parameter.


Static code injection vulnerability in admin.php in sun-jester OpenNews 1.0 allows remote authenticated administrators to inject arbitrary PHP code into config.php via the \Overall Width\ field in a setconfig action.


Static code injection vulnerability in add_reg.php in DB Top Sites 1.0 allows remote attackers to inject arbitrary PHP code via a crafted (1) url and (2) location parameter.


Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP code into Config.php via the adminEMail parameter to SaveConfig.php.


Static code injection vulnerability in index.php in Podcast Generator 1.1 and earlier allows remote authenticated administrators to inject arbitrary PHP code into config.php via the recent parameter in a config change action.


Static code injection vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to inject arbitrary PHP code into phpre_config.php via the form_aula parameter.


Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file.


Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.


Static code injection vulnerability in forms/ajax/configure.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to inject arbitrary PHP code into config.php via the configure action to index.php.


Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files.


A code injection vulnerability exists in SAP TREX / Business Warehouse Accelerator (BWA). The vendor response is SAP Security Note 2419592.


Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 allows remote attackers to execute arbitrary PHP code via the nom_blog parameter which is injected into include/variables.php.


Static code injection vulnerability in chat_panel.php in the SimpleChat 1.0.0 module for iWare Professional CMS allows remote attackers to inject arbitrary PHP code into chat_log.php via the msg parameter.


Static code injection vulnerability in admin/banners.php in PHP Enter allows remote attackers to inject arbitrary PHP code into horad.php via the code parameter.


A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.


A code injection vulnerability in the SeDebugPrivilege component of Trezor Bridge 2.0.27 allows attackers to escalate privileges.


Direct code injection vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to execute portions of Perl code via the PluginMode parameter.


Direct code injection vulnerability in FlatNuke 2.5.1 allows remote attackers to execute arbitrary PHP code by placing the code into the url_avatar field.


Direct code injection vulnerability in forumdisplay.php in vBulletin 3.0 through 3.0.4 when showforumusers is enabled allows remote attackers to execute inject arbitrary PHP commands via the comma parameter.


Direct code injection vulnerability in CuteNews 1.3.6 and earlier allows remote attackers with administrative privileges to execute arbitrary PHP code via certain inputs that are injected into a template (.tpl) file.


Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remote attackers to execute arbitrary PHP code via the cache_lastpostdateserver cookie.


Static code injection vulnerability in users.php in MySimpleNews allows remote attackers to inject arbitrary PHP code and HTML via the (1) LOGIN (2) DATA and (3) MESS parameters which are inserted into news.php3.


Static code injection vulnerability in installation/setup.php in phpCollab 2.5 rc3 and earlier allows remote authenticated administrators to inject arbitrary PHP code into include/settings.php via the URI.


Static code injection vulnerability in edithistory.php in OxYProject OxYBox 0.85 allows remote attackers to inject arbitrary PHP code into oxyhistory.php via the oxymsg parameter.


Static code injection vulnerability in user/settings/ in DeStar 0.2.2-5 allows remote authenticated users to add arbitrary administrators and inject arbitrary Python code into destar_cfg.py via a crafted pin parameter.


Static code injection vulnerability in the Guestbook component in CMS MAXSITE allows remote attackers to inject arbitrary PHP code into the guestbook via the message parameter.


Static code injection vulnerability in admincp.php in DeluxeBB 1.2 and earlier allows remote authenticated administrators to inject arbitrary PHP code into logs/cp.php via the URI.


Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitrary PHP code via the message parameter in an HTML webform which is written to data.php.


Static code injection vulnerability in box/minichat/boxpop.php in IT!CMS (aka itcms) 1.9 allows remote attackers to inject arbitrary PHP code into box/MiniChat/data/shouts.php via the shout parameter.


Static code injection vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to inject arbitrary PHP code into includes/Config.php via the default parameter.


Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions when the installation script is not removed allows remote attackers to inject arbitrary PHP code into e107_config.php via a crafted MySQL server name.


Static code injection vulnerability in translate.php in Support Incident Tracker (aka SiT!) 3.45 through 3.65 allows remote attackers to inject arbitrary PHP code into an executable language file in the i18n directory via the lang variable.


Code injection vulnerability in installer for Intel(R) CSME before versions 11.8.65 11.11.65 11.22.65 12.0.35 and Intel(R) TXE 3.1.65 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.


The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory allowing code injection because \python -m\ looks in this directory as demonstrated by rdf2dot. This issue is specific to use of the debian/scripts directory.


A code injection issue was discovered in ipycache through 2016-05-31.


Pexip Infinity before 20.1 allows Code Injection onto nodes via an admin.


An issue was discovered in Symfony 3.4.0 through 3.4.34 4.2.0 through 4.2.11 and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.


An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2 as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL because unserialize is used.


Codiad Web IDE through 2.8.4 allows PHP Code injection.


Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.


IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the application potentially bypassing security checks. Exploitation of this weakness can result in a limited form of code injection. IBM X-Force ID: 156162.


Multiple binaries in IBM SDK Java Technology Edition 7 7R and 8 on the AIX platform use insecure absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984.


ONTAP Select Deploy administration utility versions 2.11.2 through 2.12.2 are susceptible to a code injection vulnerability which when successfully exploited could allow an unauthenticated remote attacker to enable and use a privileged user account.


Video Insight VMS 7.5 and earlier allows remote attackers to conduct code injection attacks via unspecified vectors.


A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.


Prior to 0.1 AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users.


AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users.


openITCOCKPIT before 3.7.1 allows code injection aka RVID 1-445b21.


The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.


In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc) code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.


An issue was discovered in Bitdefender products for Windows (Bitdefender Endpoint Security Tool versions prior to 6.6.8.115; and Bitdefender Antivirus Plus Bitdefender Internet Security and Bitdefender Total Security versions prior to 23.0.24.120) that can lead to local code injection. A local attacker with administrator privileges can create a malicious DLL file in %SystemRoot%\\System32\\ that will be executed with local user privileges.


There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request. It allows PHP code injection by providing a filename in the file parameter and providing file content in the filetext parameter.


There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit request. It allows PHP code injection by providing a filename in the file parameter and providing file content in the t2 parameter.


Ruby through 2.4.7 2.5.x through 2.5.6 and 2.6.x through 2.6.4 allows code injection if the first argument (aka the \command\ argument) to Shell# or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.


pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value.


Foswiki before 1.1.8 contains a code injection vulnerability in the MAKETEXT macro.


vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.


MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page for all authenticated and unauthenticated visitors.


HHEE system has a Code Injection vulnerability.Successful exploitation of this vulnerability may affect HHEE system integrity.


OpenOLAT is a web-based learning management system (LMS). A path traversal vulnerability exists in versions prior to 15.3.18 15.5.3 and 16.0.0. Using a specially prepared ZIP file it is possible to overwrite any file that is writable by the application server user (e.g. the tomcat user). Depending on the configuration this can be limited to files of the OpenOlat user data directory however if not properly set up the attack could also be used to overwrite application server config files java code or even operating system files. The attack could be used to corrupt or modify any OpenOlat file such as course structures config files or temporary test data. Those attack would require in-depth knowledge of the installation and thus more theoretical. If the app server configuration allows the execution of jsp files and the path to the context is known it is also possible to execute java code. If the app server runs with the same user that is used to deploy the OpenOlat code or has write permissions on the OpenOlat code files and the path to the context is know code injection is possible. The attack requires an OpenOlat user account to upload a ZIP file and trigger the unzip method. It can not be exploited by unregistered users. The problem is fixed in versions 15.3.18 15.5.3 and 16.0.0. There are no known workarounds aside from upgrading.


HedgeDoc

(formerly

known

as

CodiMD)

is

an

open-source

collaborative

markdown

editor.

An

attacker

is

able

to

receive

arbitrary

files

from

the

file

system

when

exporting

a

note

to

PDF.

Since

the

code

injection

has

to

take

place

as

note

content

there

fore

this

exploit

requires

the

attackers

ability

to

modify

a

note.

This

will

affect

all

instances

which

have

pdf

export

enabled.

This

issue

has

been

fixed

by

and

is

available

in

version

Starting

the

CodiMD/HedgeDoc

instance

with

or

set

`\allowPDFExport\:

false`

in

config.json

can

mitigate

this

issue

for

those

who

cannot

upgrade.

This

exploit

works

because

while

PhantomJS

doesn't

actually

render

the

references

to

the

PDF

file

itself

it

still

uses

them

internally

and

exfiltration

is

possible

and

easy

through

JavaScript

rendering.

The

impact

is

pretty

bad

as

the

attacker

is

able

to

read

the

CodiMD/HedgeDoc

`config.json`

file

as

well

any

other

files

on

the

filesystem.

Even

though

the

suggested

Docker

deploy

option

doesn't

have

many

interesting

files

itself

the

`config.json`

still

often

contains

sensitive

information

database

credentials

and

maybe

OAuth

secrets

among

other

things.


Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability someone must have an admin user account in Nagios XI's web system.


HTML code injection vulnerability in Android Application Bosch Video Security version 3.2.3. or earlier when successfully exploited allows an attacker to inject random HTML code into a component loaded by WebView thus allowing the Application to display web resources controlled by the attacker.


The package underscore from 1.13.0-0 and before 1.13.0-2 from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function particularly when a variable property is passed as an argument as it is not sanitized.


Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.


There is a logic bypass vulnerability in smartphones. Successful exploitation of this vulnerability may cause code injection.


There is a code injection vulnerability in smartphones. Successful exploitation of this vulnerability may affect service confidentiality.


There is a deserialization vulnerability in Huawei AnyOffice V200R006C10. An attacker can construct a specific request to exploit this vulnerability. Successfully exploiting this vulnerability the attacker can execute remote malicious code injection and to control the device.


Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link


There is a Code Injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to system restart.


@asyncapi/java-spring-cloud-stream-template

generates

a

Spring

Cloud

Stream

(SCSt)

microservice.

In

versions

prior

to

arbitrary

code

injection

was

possible

when

an

attacker

controls

the

AsyncAPI

document.

An

example

is

provided

in

There

are

no

mitigations

available

and

all

users

are

advised

to

update.


Akaunting

version

and

earlier

suffers

from

a

code

injection

issue

in

the

Money.php

component

of

the

application.

A

POST

sent

to

with

an

that

includes

a

PHP

callable

function

is

executed

directly.

This

issue

was

fixed

in

version

of

the

product.


There is a Code injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may exhaust system resources and cause the system to restart.


RSSHub is an open source easy to use and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor` which may be injected by the target site with unsafe code causing server-side security issues The fix in version 7f1c430 is to temporarily remove the problematic route and added a `no-new-func` rule to eslint.


Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are vulnerable to code injection in random.php. The attack requires user authentication to access the random.php page unless the site is running in demo mode. This issue has been resolved in 4.4.3.


Invision

Community

(aka

IPS

Community

Suite)

before

allows

eval-based

PHP

code

injection

by

a

moderator

because

the

IPS\\cms\\modules\\front\\pages\\_builder::previewBlock

method

interacts

unsafely

with

the

method.


Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations.


The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an attacker to disable the program's password protection and disable protection. An attacker must already have administrator privileges on the machine to exploit this vulnerability.


PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.7.7 PatrowlManager unrestrictly handle upload files in the findings import feature. This vulnerability is capable of uploading dangerous type of file to server leading to XSS attacks and potentially other forms of code injection. Users are advised to update to 1.7.7 as soon as possible. There are no known workarounds for this issue.


MyBB before 1.8.29 allows Remote Code Injection by an admin with the \Can manage settings?\ permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update making it possible to add settings of supported type \php\ with PHP code executed on Change Settings pages.


The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format.


GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than graphql-playground-react@1.7.28 are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place the user must load a malicious schema in graphql-playground. There are several ways this can occur including by specifying the URL to a malicious schema in the endpoint query parameter. If a user clicks on a link to a GraphQL Playground installation that specifies a malicious server arbitrary JavaScript can run in the user's browser which can be used to exfiltrate user credentials or other harmful goals. If you are using graphql-playground-react directly in your client app upgrade to version 1.7.28 or later.


GraphiQL is the reference implementation of this monorepo GraphQL IDE an official project under the GraphQL Foundation. All versions of graphiql older than graphiql@1.4.7 are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place the user must load a vulnerable schema in graphiql. There are a number of ways that can occur. By default the schema URL is not attacker-controllable in graphiql or in its suggested implementations or examples leaving only very complex attack vectors. If a custom implementation of graphiql's fetcher allows the schema URL to be set dynamically such as a URL query parameter like ?endpoint= in graphql-playground or a database provided value then this custom graphiql implementation is vulnerable to phishing attacks and thus much more readily available low or no privelege level xss attacks. The URLs could look like any generic looking graphql schema URL. It should be noted that desktop clients such as Altair Insomnia Postwoman do not appear to be impacted by this. This vulnerability does not impact codemirror-graphql monaco-graphql or other dependents as it exists in onHasCompletion.ts in graphiql. It does impact all forks of graphiql and every released version of graphiql.


TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a code injection as it calls `eval` on user supplied strings. This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs. However given that the tool is always run manually the impact of this is not severe. We have patched this by adding a `safe` flag which defaults to `True` and an explicit warning for users. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1 TensorFlow 2.5.2 and TensorFlow 2.4.4 as these are also affected and still in supported range.


Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc realloc and memalign. This improper memory assignment can lead to arbitrary memory allocation resulting in unexpected behavior such as a crash or a remote code injection/execution.


Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring.


ARM mbed product Version 6.3.0 is vulnerable to integer wrap-around in malloc_wrapper function which can lead to arbitrary memory allocation resulting in unexpected behavior such as a crash or a remote code injection/execution.


ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _lang.php file under the system/user/language directory.


Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mm_malloc. This improper memory assignment can lead to arbitrary memory allocation resulting in unexpected behavior such as a crash or a remote code injection/execution.


TencentOS-tiny version 3.1.0 is vulnerable to integer wrap-around in function 'tos_mmheap_alloc incorrect calculation of effective memory allocation size. This improper memory assignment can lead to arbitrary memory allocation resulting in unexpected behavior such as a crash or a remote code injection/execution.


The Weintek cMT product line is vulnerable to code injection which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.


uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple. This improper memory assignment can lead to arbitrary memory allocation resulting in unexpected behavior such as a crash or a remote code injection/execution.


ARM mbed-ualloc memory library version 1.3.0 is vulnerable to integer wrap-around in function mbed_krbs which can lead to arbitrary memory allocation resulting in unexpected behavior such as a crash or a remote code injection/execution.


RIOT OS version 2020.01.1 is vulnerable to integer wrap-around in its implementation of calloc function which can lead to arbitrary memory allocation resulting in unexpected behavior such as a crash or a remote code injection/execution.


Spacewalk 2.10 and derivatives such as Uyuni 2021.08 allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.


Direct static code injection vulnerability in includes/admin/sub/conf_appearence.php in Shop-Script FREE 2.0 and earlier allows remote attackers to inject arbitrary PHP code into cfg/appearence.inc.php via a save_appearence action in admin.php as demonstrated with the (1) productscount (2) colscount and (3) darkcolor parameters.


Direct static code injection vulnerability in the download module in Flatnuke 3 allows remote authenticated administrators to inject arbitrary PHP code into a description.it.php file in a subdirectory of Download/ by saving a description and setting fneditmode to 1. NOTE: unauthenticated remote attackers can exploit this by leveraging a cookie manipulation issue.


Direct static code injection vulnerability in dirsys/modules/config/post.php in JBC Explorer 7.20 RC1 and earlier allows remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter which can be executed by accessing config.inc.php. NOTE: this can be exploited by unauthenticated remote attackers by leveraging CVE-2007-5913.


Direct static code injection vulnerability in forum.php in Ben Ng Scribe 0.2 and earlier allows remote attackers to inject arbitrary PHP code into a certain file in regged/ via the username parameter in a Register action possibly related to the register function in forumfunctions.php.


Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inject arbitrary PHP code via the (1) username (2) password and (3) email parameters when registering a user account which can be executed by accessing the user's php file for this account. NOTE: similar code injection might be possible in a user profile.


Multiple

direct

static

code

injection

vulnerabilities

in

RunCMS

before

allow

remote

authenticated

administrators

to

inject

arbitrary

PHP

code

via

the

header

and

footer

parameters

to

in

a

meta-generator

action

the

disclaimer

parameter

to

in

a

disclaimer

action

the

disclaimer

parameter

to

in

a

mydownloadsConfigAdmin

action

the

disclaimer

parameter

to

the

disclaimer

parameter

to

in

a

myLinksConfigAdmin

action

or

the

intro

parameter

to

in

a

secconfig

action

which

inject

PHP

sequences

into

(a)

(b)

(c)

(d)

(e)

(f)

(g)

or

(h)

in

modules/.


Direct static code injection vulnerability in admin/settings.php in MyBlog 0.9.8 and earlier allows remote authenticated admin users to inject arbitrary PHP code via the content parameter which can be executed by accessing index.php. NOTE: a separate vulnerability could be leveraged to make this issue exploitable by remote unauthenticated attackers.


Static code injection vulnerability in add.php in Mozzers SubSystem 1.0 allows remote attackers to inject PHP code into subs.php via the (1) Sub-name or (2) Sub-url field. NOTE: an earlier report indicated that the add action can be reached through a request to index.php.


Static

code

injection

vulnerability

in

in

Monalbum

allows

remote

authenticated

users

to

inject

arbitrary

PHP

code

into

the

conf/config.inc.php

file

via

the

gcfgHote

gcfgPass

gcfgUser

gcontour

gfond

ghome

ghor

glangage

gpage

gracine

grepertoire

gsite

gslide

gtitre

gversion

gvert

or

gcfgBase

parameter.


Multiple direct static code injection vulnerabilities in admin/configurer2.php in Crea-Book 1.0 and earlier allow remote authenticated administrators to execute arbitrary PHP code via the \Fond de la page\ (background color) field and other unspecified fields which injects into config.inc.php3.


Direct static code injection vulnerability in index.php in Limesoft Guestbook (LS Simple Guestbook) allows remote attackers to inject arbitrary PHP code into posts.txt via the name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Direct static code injection vulnerability in admin/save.php in Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier allows remote authenticated administrators to inject PHP code into .html files via the html parameter as demonstrated by head.html and foot.html which are included and executed upon a direct request for index.php. NOTE: a separate vulnerability could be leveraged to make this issue exploitable by remote unauthenticated attackers.


Static code injection vulnerability in process.php in AimStats 3.2 and earlier allows remote attackers to inject PHP code into config.php via the databasehost parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple direct static code injection vulnerabilities in MyCMS 0.9.8 and earlier allow remote attackers to inject arbitrary PHP code into (1) a _score.txt file via the score parameter or (2) a _setby.txt file via a login cookie which is then included by games.php. NOTE: programs that use games.php might include (a) snakep.php (b) tetrisp.php and possibly other site-specific files.


Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via the Chat Name field which is inserted into online.txt and included by users.php. NOTE: some of these details are obtained from third party information.


Static code injection vulnerability in admin/settings.php in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote authenticated users to inject arbitrary PHP code via the xtop parameter in a \ConfigSave\ op to admin.php which can later be accessed via a \Configure\ op to admin.php.


Direct static code injection vulnerability in admin/configuration.php in Guestbara 1.2 and earlier allows remote authenticated users to inject arbitrary PHP code into config.php via the (1) admin_mail (2) emotpatch (3) login (4) pass and unspecified other parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple static code injection vulnerabilities in error.php in GuppY 4.5.16 and earlier allow remote attackers to inject arbitrary PHP code into a .inc file in the data/ directory via (1) a REMOTE_ADDR cookie or (2) a cookie specifying an element of the msg array with an error number in the first dimension and 0 in the second dimension as demonstrated by msg9990.


Static code injection vulnerability in Coppermine Photo Gallery 1.4.10 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the Username to login.php which is injected into an error message in security.log.php which can then be accessed using viewlog.php.


Static Code Injection in GitHub repository microweber/microweber prior to 1.3.


Code Injection in GitHub repository publify/publify prior to 9.2.8.


Code Injection in Packagist microweber/microweber prior to 1.2.11.


Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.


Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.


Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report.


taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file.


All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.


Classcms v2.5 and below contains an arbitrary file upload via the component \\class\\classupload. This vulnerability allows attackers to execute code injection via a crafted .txt file.


A zero-code remote code injection vulnerability via configuration.php in Chamilo LMS v1.11.13 allows attackers to upload arbitrary code in the form of a new plugin.


In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.


A code injection vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allow an attacker to escalate privileges and run arbitrary code in the context of root. Please note: an attacker must first obtain access to the target agent in an un-activated and unconfigured state in order to exploit this vulnerability.


iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.


Twig is an open source template language for PHP. When in a sandbox mode the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.


Multiple static code injection vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to inject arbitrary PHP code (1) into settings.php via the menu parameter to admin_settings.php or (2) into a content/=NUMBER.php file via the title parameter to admin_new.php.


Static code injection vulnerability in RunCMS 2M1 allows remote authenticated administrators to execute arbitrary PHP code via the \Filter/Banning\ feature as demonstrated by modifying modules/system/cache/bademails.php using the \Prohibited: Emails\ action and other unspecified filters.


Static code injection vulnerability in config/writeconfig.php in the sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to inject arbitrary PHP code into include/config.ini.php via the pool1 parameter. NOTE: some of these details are obtained from third party information.


Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bitweaver 2.6 and earlier allow (1) remote authenticated users to inject arbitrary PHP code into files by placing PHP sequences into the account's \display name\ setting and then invoking boards/boards_rss.php and might allow (2) remote attackers to inject arbitrary PHP code into files via the HTTP Host header in a request to boards/boards_rss.php.


Static code injection vulnerability in post.php in Simple PHP News 1.0 final allows remote attackers to inject arbitrary PHP code into news.txt via the post parameter and then execute the code via a direct request to display.php. NOTE: some of these details are obtained from third party information.


Multiple static code injection vulnerabilities in post.php in Simple PHP News 1.0 final allow remote attackers to inject arbitrary PHP code into news.txt via the (1) title or (2) date parameter and then execute the code via a direct request to display.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Static code injection vulnerability in admin.php in Ryneezy phoSheezy 0.2 allows remote authenticated administrators to inject arbitrary PHP code into config/header via the header parameter. NOTE: this can be exploited by unauthenticated attackers by leveraging CVE-2009-0250. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Static code injection vulnerability in admin.php in Ryneezy phoSheezy 0.2 allows remote authenticated administrators to inject arbitrary PHP code into config/footer via the footer parameter. NOTE: this can be exploited by unauthenticated attackers by leveraging CVE-2009-0250. NOTE: some of these details are obtained from third party information.


Static code injection vulnerability in the administrative web interface in Accellion Secure File Transfer Appliance allows remote authenticated administrators to inject arbitrary shell commands by appending them to a request to update the SNMP public community string.


Static code injection vulnerability in the Categories module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the Category Access field.


Multiple static code injection vulnerabilities in the Categories module in CutePHP CuteNews 1.4.6 allow remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the (1) category and (2) Icon URL fields; or (3) inject arbitrary PHP code into data/ipban.php via the add_ip parameter.


Vulnerability issues with the web service inspection of input parameters in Trend Micro Web Security Virtual Appliance 6.5 may allow potential attackers who already have administration rights to the console to implement remote code injections.


Adobe Campaign versions 16.4 Build 8724 and earlier have a code injection vulnerability.


A Code Injection vulnerability in the non-certificate-based authentication mechanism in McAfee Live Safe versions prior to 16.0.3 and McAfee Security Scan Plus (MSS+) versions prior to 3.11.599.3 allows network attackers to perform a malicious file execution via a HTTP backend-response.


Code Injection vulnerability in the ePolicy Orchestrator (ePO) extension in McAfee Threat Intelligence Exchange (TIE) Server 2.1.0 and earlier allows remote attackers to execute arbitrary HTML code to be reflected in the response web page via unspecified vector.


\Dokodemo eye Smart HD\ SCR02HD Firmware 1.0.3.1000 and earlier allows authenticated attackers to conduct code injection attacks via unspecified vectors.


The Orpak SiteOmat OrCU component is vulnerable to code injection for all versions prior to 2017-09-25 due to a search query that uses a direct shell command. By tampering with the request an attacker is able to run shell commands and receive valid output from the device.


An issue was discovered in EMC Data Domain DD OS 5.7 family versions prior to 5.7.5.6; EMC Data Domain DD OS 6.0 family versions prior to 6.0.2.9; EMC Data Domain DD OS 6.1 family versions prior to 6.1.0.21; EMC Data Domain Virtual Edition 2.0 family all versions; EMC Data Domain Virtual Edition 3.0 family versions prior to 3.0 SP2 Update 1; and EMC Data Domain Virtual Edition 3.1 family versions prior to 3.1 Update 2. EMC Data Domain DD OS contains a memory overflow vulnerability in SMBv1 which may potentially be exploited by an unauthenticated remote attacker. An attacker may completely shut down both the SMB service and active directory authentication. This may also allow remote code injection and execution.


In Open Ticket Request System (OTRS) 3.3.x before 3.3.18 4.x before 4.0.25 and 5.x before 5.0.23 remote authenticated users can leverage statistics-write permissions to gain privileges via code injection.


An issue was discovered in Contiki Operating System 3.0. A Persistent XSS vulnerability is present in the MQTT/IBM Cloud Config page (aka mqtt.html) of cc26xx-web-demo. The cc26xx-web-demo features a webserver that runs on a constrained device. That particular page allows a user to remotely configure that device's operation by sending HTTP POST requests. The vulnerability consists of improper input sanitisation of the text fields on the MQTT/IBM Cloud config page allowing for JavaScript code injection.


Code injection vulnerability in Avira Total Security Suite 15.0 (and earlier) Optimization Suite 15.0 (and earlier) Internet Security Suite 15.0 (and earlier) and Free Security Suite 15.0 (and earlier) allows a local attacker to bypass a self-protection mechanism inject arbitrary code and take full control of any Avira process via a \DoubleAgent\ attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.


Code injection vulnerability in Bitdefender Total Security 12.0 (and earlier) Internet Security 12.0 (and earlier) and Antivirus Plus 12.0 (and earlier) allows a local attacker to bypass a self-protection mechanism inject arbitrary code and take full control of any Bitdefender process via a \DoubleAgent\ attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.


The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code \__format=%27;alert(%27xss%27)\ to the URL an alert window would execute.


Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24 4 before 4.0.26 and 3.3 before 3.3.20. In the agent interface an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation.


Code injection vulnerability in Trend Micro Maximum Security 11.0 (and earlier) Internet Security 11.0 (and earlier) and Antivirus+ Security 11.0 (and earlier) allows a local attacker to bypass a self-protection mechanism inject arbitrary code and take full control of any Trend Micro process via a \DoubleAgent\ attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.


Code injection vulnerability in Avast Premier 12.3 (and earlier) Internet Security 12.3 (and earlier) Pro Antivirus 12.3 (and earlier) and Free Antivirus 12.3 (and earlier) allows a local attacker to bypass a self-protection mechanism inject arbitrary code and take full control of any Avast process via a \DoubleAgent\ attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.


Code injection vulnerability in AVG Ultimate 17.1 (and earlier) AVG Internet Security 17.1 (and earlier) and AVG AntiVirus FREE 17.1 (and earlier) allows a local attacker to bypass a self-protection mechanism inject arbitrary code and take full control of any AVG process via a \DoubleAgent\ attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.


Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.


nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection


** DISPUTED ** oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension I think the claim in the Readme of \RFC 6749 compliant\ is valid and not misleading and I also therefore wouldn't describe this as a \vulnerability\ with the library per se.'


Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LM_FRONT_* field for a language as demonstrated by language/italian.php.


Direct static code injection vulnerability in code/class_db_text.php in EJ3 TOPo 2.2.178 and earlier allows remote attackers to execute arbitrary PHP code via parameters such as (1) descripcion and (2) pais which are stored directly in a PHP script. NOTE: the provenance of this information is unknown; the details are obtained solely from third party reports.


Direct static code injection vulnerability in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified \configuration fields\ in (1) admin_chatconfig.php (2) admin_configcss.php (3) admin_config.php or (4) admin_config2.php which are stored as configuration settings. NOTE: this issue can be exploited by remote attackers by leveraging other vulnerabilities in UPB.


Jelsoft vBulletin accepts uploads of Cascading Style Sheets (CSS) and processes them in a way that allows remote authenticated administrators to gain shell access by uploading a CSS file that contains PHP code then selecting the file via the style chooser which causes the PHP code to be executed. NOTE: the vendor was unable to reproduce this issue in 3.5.x. NOTE: this issue might be due to direct static code injection.


Unspecified vulnerability in config.php in Skate Board 0.9 allows remote authenticated administrators to execute arbitrary PHP code by causing certain variables in config.php to be modified possibly due to XSS or direct static code injection.


Direct static code injection vulnerability in edit.php in ACal Calendar Project 2.2.5 allows authenticated users to execute arbitrary PHP code via (1) the edit=header value which modifies header.php or (2) the edit=footer value which modifies footer.php. NOTE: this issue might be resultant from the poor authentication as identified by CVE-2006-0182. Since the design of the product allows the administrator to edit the code perhaps this issue should not be included in CVE except as a consequence of CVE-2006-0182.


Multiple direct static code injection vulnerabilities in savesettings.php in ShoutLIVE 1.1.0 allow remote attackers to execute arbitrary PHP code via variables that are written to settings.php.


Direct static code injection vulnerability in the modify_config action in admin.php for PHP-Stats 0.1.9.1 and earlier allows remote authenticated administrators to execute arbitrary PHP code via the option_newcompatibility_mode parameter which is not filtered before being stored in config.php. NOTE: this vulnerability can be exploited by remote unauthenticated attackers in conjunction with the optionadmin_pass authentication bypass vulnerability.


Direct static code injection vulnerability in add_link.txt in daverave Link Bank allows remote attackers to execute arbitrary PHP code via the url_name parameter which is not sanitized before being stored in links.txt which is later used in an include statement.


Direct static code injection vulnerability in includes/template.php in phpBB allows remote authenticated users with write access to execute arbitrary PHP code by modifying a template in a way that (1) bypasses a loose \.*\ regular expression to match BEGIN and END statements in overall_header.tpl or (2) is used in an eval statement by includes/bbcode.php for bbcode.tpl.


Unspecified vulnerability in phpBB allows remote authenticated users with Administration Panel access to execute arbitrary PHP code via crafted Font Colour 3 ($themefontcolor3 variable) and/or signature values possibly involving the highlight functionality. NOTE: the original report does not clarify whether this issue is static code injection eval injection or another type of vulnerability.


Multiple direct static code injection vulnerabilities in db/txt.inc.php in phpPowerCards 2.10 when register_globals is enabled allow remote attackers to create or overwrite arbitrary files via the (1) emailto (2) emailfrom (3) nameto (4) namefrom (5) picture (6) comment or (7) sessionID parameter as demonstrated by creating a new .php file that permits remote file inclusion and then requesting this file.


Direct static code injection vulnerability in delete.php in JaxUltraBB (JUBB) 2.0 when register_globals is enabled allows remote attackers to inject arbitrary web script HTML or PHP via the contents parameter whose value is prepended to the file specified by the forum parameter.


Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a theme array parameter to admin/doedittheme.php which is injected into includes/theme.inc.php; (2) inject PHP code via a config array parameter to admin/doeditconfig.php and then execute the code via includes/config.inc.php; and inject a reference to PHP code via a URL in the configpath parameter and then execute the code via (3) dorateuser.php (4) calendar.php and unspecified other scripts.


Multiple direct static code injection vulnerabilities in add_go.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote attackers to execute arbitrary PHP code via the (1) description (2) issue (3) title (4) var (5) name (6) keywords and (7) note parameters which are stored in an article file. NOTE: the original source of this vulnerability is unknown; the details are obtained from third party information and CVE post-disclosure analysis.


Direct static code injection vulnerability in admin/save_opt.php in SoftBB 0.1 and possibly earlier allows remote authenticated users to upload and execute arbitrary PHP code via the cache_forum parameter which saves the code to info_options.php which is accessible via a direct request.