Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2008-5517

Summary
Assigner-redhat
Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749
Published At-13 Jan, 2009 | 16:00
Updated At-07 Aug, 2024 | 10:56
Rejected At-
Credits

The web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary commands via shell metacharacters related to (1) git_snapshot and (2) git_object.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:redhat
Assigner Org ID:53f830b8-0a3f-465b-8143-3b8a9948e749
Published At:13 Jan, 2009 | 16:00
Updated At:07 Aug, 2024 | 10:56
Rejected At:
▼CVE Numbering Authority (CNA)

The web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary commands via shell metacharacters related to (1) git_snapshot and (2) git_object.

Affected Products
Vendor
n/a
Product
n/a
Versions
Affected
  • n/a
Problem Types
TypeCWE IDDescription
textN/An/a
Type: text
CWE ID: N/A
Description: n/a
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
http://www.debian.org/security/2009/dsa-1708
vendor-advisory
x_refsource_DEBIAN
https://bugzilla.redhat.com/show_bug.cgi?id=479715
x_refsource_CONFIRM
http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml
vendor-advisory
x_refsource_GENTOO
http://wiki.rpath.com/Advisories:rPSA-2009-0005
x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2009/0175
vdb-entry
x_refsource_VUPEN
http://secunia.com/advisories/34194
third-party-advisory
x_refsource_SECUNIA
http://secunia.com/advisories/33964
third-party-advisory
x_refsource_SECUNIA
http://repo.or.cz/w/git.git?a=commitdiff%3Bh=516381d5
x_refsource_MISC
http://www.securityfocus.com/bid/33215
vdb-entry
x_refsource_BID
http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00002.html
vendor-advisory
x_refsource_SUSE
http://www.openwall.com/lists/oss-security/2009/01/23/2
mailing-list
x_refsource_MLIST
http://www.securityfocus.com/archive/1/500008/100/0/threaded
mailing-list
x_refsource_BUGTRAQ
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512330
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2009/01/20/1
mailing-list
x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2009/01/21/7
mailing-list
x_refsource_MLIST
https://issues.rpath.com/browse/RPL-2936
x_refsource_CONFIRM
http://www.ubuntu.com/usn/USN-723-1
vendor-advisory
x_refsource_UBUNTU
Hyperlink: http://www.debian.org/security/2009/dsa-1708
Resource:
vendor-advisory
x_refsource_DEBIAN
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=479715
Resource:
x_refsource_CONFIRM
Hyperlink: http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml
Resource:
vendor-advisory
x_refsource_GENTOO
Hyperlink: http://wiki.rpath.com/Advisories:rPSA-2009-0005
Resource:
x_refsource_CONFIRM
Hyperlink: http://www.vupen.com/english/advisories/2009/0175
Resource:
vdb-entry
x_refsource_VUPEN
Hyperlink: http://secunia.com/advisories/34194
Resource:
third-party-advisory
x_refsource_SECUNIA
Hyperlink: http://secunia.com/advisories/33964
Resource:
third-party-advisory
x_refsource_SECUNIA
Hyperlink: http://repo.or.cz/w/git.git?a=commitdiff%3Bh=516381d5
Resource:
x_refsource_MISC
Hyperlink: http://www.securityfocus.com/bid/33215
Resource:
vdb-entry
x_refsource_BID
Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00002.html
Resource:
vendor-advisory
x_refsource_SUSE
Hyperlink: http://www.openwall.com/lists/oss-security/2009/01/23/2
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://www.securityfocus.com/archive/1/500008/100/0/threaded
Resource:
mailing-list
x_refsource_BUGTRAQ
Hyperlink: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512330
Resource:
x_refsource_CONFIRM
Hyperlink: http://www.openwall.com/lists/oss-security/2009/01/20/1
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: http://www.openwall.com/lists/oss-security/2009/01/21/7
Resource:
mailing-list
x_refsource_MLIST
Hyperlink: https://issues.rpath.com/browse/RPL-2936
Resource:
x_refsource_CONFIRM
Hyperlink: http://www.ubuntu.com/usn/USN-723-1
Resource:
vendor-advisory
x_refsource_UBUNTU
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
http://www.debian.org/security/2009/dsa-1708
vendor-advisory
x_refsource_DEBIAN
x_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=479715
x_refsource_CONFIRM
x_transferred
http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml
vendor-advisory
x_refsource_GENTOO
x_transferred
http://wiki.rpath.com/Advisories:rPSA-2009-0005
x_refsource_CONFIRM
x_transferred
http://www.vupen.com/english/advisories/2009/0175
vdb-entry
x_refsource_VUPEN
x_transferred
http://secunia.com/advisories/34194
third-party-advisory
x_refsource_SECUNIA
x_transferred
http://secunia.com/advisories/33964
third-party-advisory
x_refsource_SECUNIA
x_transferred
http://repo.or.cz/w/git.git?a=commitdiff%3Bh=516381d5
x_refsource_MISC
x_transferred
http://www.securityfocus.com/bid/33215
vdb-entry
x_refsource_BID
x_transferred
http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00002.html
vendor-advisory
x_refsource_SUSE
x_transferred
http://www.openwall.com/lists/oss-security/2009/01/23/2
mailing-list
x_refsource_MLIST
x_transferred
http://www.securityfocus.com/archive/1/500008/100/0/threaded
mailing-list
x_refsource_BUGTRAQ
x_transferred
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512330
x_refsource_CONFIRM
x_transferred
http://www.openwall.com/lists/oss-security/2009/01/20/1
mailing-list
x_refsource_MLIST
x_transferred
http://www.openwall.com/lists/oss-security/2009/01/21/7
mailing-list
x_refsource_MLIST
x_transferred
https://issues.rpath.com/browse/RPL-2936
x_refsource_CONFIRM
x_transferred
http://www.ubuntu.com/usn/USN-723-1
vendor-advisory
x_refsource_UBUNTU
x_transferred
Hyperlink: http://www.debian.org/security/2009/dsa-1708
Resource:
vendor-advisory
x_refsource_DEBIAN
x_transferred
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=479715
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml
Resource:
vendor-advisory
x_refsource_GENTOO
x_transferred
Hyperlink: http://wiki.rpath.com/Advisories:rPSA-2009-0005
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: http://www.vupen.com/english/advisories/2009/0175
Resource:
vdb-entry
x_refsource_VUPEN
x_transferred
Hyperlink: http://secunia.com/advisories/34194
Resource:
third-party-advisory
x_refsource_SECUNIA
x_transferred
Hyperlink: http://secunia.com/advisories/33964
Resource:
third-party-advisory
x_refsource_SECUNIA
x_transferred
Hyperlink: http://repo.or.cz/w/git.git?a=commitdiff%3Bh=516381d5
Resource:
x_refsource_MISC
x_transferred
Hyperlink: http://www.securityfocus.com/bid/33215
Resource:
vdb-entry
x_refsource_BID
x_transferred
Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00002.html
Resource:
vendor-advisory
x_refsource_SUSE
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2009/01/23/2
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://www.securityfocus.com/archive/1/500008/100/0/threaded
Resource:
mailing-list
x_refsource_BUGTRAQ
x_transferred
Hyperlink: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512330
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2009/01/20/1
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2009/01/21/7
Resource:
mailing-list
x_refsource_MLIST
x_transferred
Hyperlink: https://issues.rpath.com/browse/RPL-2936
Resource:
x_refsource_CONFIRM
x_transferred
Hyperlink: http://www.ubuntu.com/usn/USN-723-1
Resource:
vendor-advisory
x_refsource_UBUNTU
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:secalert@redhat.com
Published At:13 Jan, 2009 | 17:00
Updated At:13 Feb, 2023 | 02:19

The web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary commands via shell metacharacters related to (1) git_snapshot and (2) git_object.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary2.07.5HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
Type: Primary
Version: 2.0
Base score: 7.5
Base severity: HIGH
Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
CPE Matches
git
git
>>git>>1.5.0
cpe:2.3:a:git:git:1.5.0:*:*:*:*:*:*:*
git
git
>>git>>1.5.0
cpe:2.3:a:git:git:1.5.0:rc2:*:*:*:*:*:*
git
git
>>git>>1.5.0
cpe:2.3:a:git:git:1.5.0:rc3:*:*:*:*:*:*
git
git
>>git>>1.5.0
cpe:2.3:a:git:git:1.5.0:rc4:*:*:*:*:*:*
git
git
>>git>>1.5.0.1
cpe:2.3:a:git:git:1.5.0.1:*:*:*:*:*:*:*
git
git
>>git>>1.5.0.2
cpe:2.3:a:git:git:1.5.0.2:*:*:*:*:*:*:*
git
git
>>git>>1.5.0.3
cpe:2.3:a:git:git:1.5.0.3:*:*:*:*:*:*:*
git
git
>>git>>1.5.0.4
cpe:2.3:a:git:git:1.5.0.4:*:*:*:*:*:*:*
git
git
>>git>>1.5.0.5
cpe:2.3:a:git:git:1.5.0.5:*:*:*:*:*:*:*
git
git
>>git>>1.5.0.6
cpe:2.3:a:git:git:1.5.0.6:*:*:*:*:*:*:*
git
git
>>git>>1.5.0.7
cpe:2.3:a:git:git:1.5.0.7:*:*:*:*:*:*:*
git
git
>>git>>1.5.1
cpe:2.3:a:git:git:1.5.1:*:*:*:*:*:*:*
git
git
>>git>>1.5.1.1
cpe:2.3:a:git:git:1.5.1.1:*:*:*:*:*:*:*
git
git
>>git>>1.5.1.2
cpe:2.3:a:git:git:1.5.1.2:*:*:*:*:*:*:*
git
git
>>git>>1.5.1.3
cpe:2.3:a:git:git:1.5.1.3:*:*:*:*:*:*:*
git
git
>>git>>1.5.1.4
cpe:2.3:a:git:git:1.5.1.4:*:*:*:*:*:*:*
git
git
>>git>>1.5.1.5
cpe:2.3:a:git:git:1.5.1.5:*:*:*:*:*:*:*
git
git
>>git>>1.5.1.6
cpe:2.3:a:git:git:1.5.1.6:*:*:*:*:*:*:*
git
git
>>git>>1.5.2
cpe:2.3:a:git:git:1.5.2:*:*:*:*:*:*:*
git
git
>>git>>1.5.2.1
cpe:2.3:a:git:git:1.5.2.1:*:*:*:*:*:*:*
git
git
>>git>>1.5.2.2
cpe:2.3:a:git:git:1.5.2.2:*:*:*:*:*:*:*
git
git
>>git>>1.5.2.3
cpe:2.3:a:git:git:1.5.2.3:*:*:*:*:*:*:*
git
git
>>git>>1.5.2.4
cpe:2.3:a:git:git:1.5.2.4:*:*:*:*:*:*:*
git
git
>>git>>1.5.2.5
cpe:2.3:a:git:git:1.5.2.5:*:*:*:*:*:*:*
git
git
>>git>>1.5.3
cpe:2.3:a:git:git:1.5.3:*:*:*:*:*:*:*
git
git
>>git>>1.5.3
cpe:2.3:a:git:git:1.5.3:rc4:*:*:*:*:*:*
git
git
>>git>>1.5.3
cpe:2.3:a:git:git:1.5.3:rc5:*:*:*:*:*:*
git
git
>>git>>1.5.3
cpe:2.3:a:git:git:1.5.3:rc7:*:*:*:*:*:*
git
git
>>git>>1.5.3.1
cpe:2.3:a:git:git:1.5.3.1:*:*:*:*:*:*:*
git
git
>>git>>1.5.3.2
cpe:2.3:a:git:git:1.5.3.2:*:*:*:*:*:*:*
git
git
>>git>>1.5.3.3
cpe:2.3:a:git:git:1.5.3.3:*:*:*:*:*:*:*
git
git
>>git>>1.5.3.4
cpe:2.3:a:git:git:1.5.3.4:*:*:*:*:*:*:*
git
git
>>git>>1.5.3.5
cpe:2.3:a:git:git:1.5.3.5:*:*:*:*:*:*:*
git
git
>>git>>1.5.3.6
cpe:2.3:a:git:git:1.5.3.6:*:*:*:*:*:*:*
git
git
>>git>>1.5.3.7
cpe:2.3:a:git:git:1.5.3.7:*:*:*:*:*:*:*
git
git
>>git>>1.5.3.8
cpe:2.3:a:git:git:1.5.3.8:*:*:*:*:*:*:*
git
git
>>git>>1.5.4
cpe:2.3:a:git:git:1.5.4:*:*:*:*:*:*:*
git
git
>>git>>1.5.4
cpe:2.3:a:git:git:1.5.4:rc0:*:*:*:*:*:*
git
git
>>git>>1.5.4
cpe:2.3:a:git:git:1.5.4:rc1:*:*:*:*:*:*
git
git
>>git>>1.5.4
cpe:2.3:a:git:git:1.5.4:rc1.1136.g2794:*:*:*:*:*:*
git
git
>>git>>1.5.4
cpe:2.3:a:git:git:1.5.4:rc2:*:*:*:*:*:*
git
git
>>git>>1.5.4
cpe:2.3:a:git:git:1.5.4:rc3:*:*:*:*:*:*
git
git
>>git>>1.5.4
cpe:2.3:a:git:git:1.5.4:rc4:*:*:*:*:*:*
git
git
>>git>>1.5.4
cpe:2.3:a:git:git:1.5.4:rc5:*:*:*:*:*:*
git
git
>>git>>1.5.4.1
cpe:2.3:a:git:git:1.5.4.1:*:*:*:*:*:*:*
git
git
>>git>>1.5.4.2
cpe:2.3:a:git:git:1.5.4.2:*:*:*:*:*:*:*
git
git
>>git>>1.5.4.3
cpe:2.3:a:git:git:1.5.4.3:*:*:*:*:*:*:*
git
git
>>git>>1.5.4.4
cpe:2.3:a:git:git:1.5.4.4:*:*:*:*:*:*:*
git
git
>>git>>1.5.4.5
cpe:2.3:a:git:git:1.5.4.5:*:*:*:*:*:*:*
git
git
>>git>>1.5.4.6
cpe:2.3:a:git:git:1.5.4.6:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-94Primarynvd@nist.gov
CWE ID: CWE-94
Type: Primary
Source: nvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512330secalert@redhat.com
N/A
http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00002.htmlsecalert@redhat.com
N/A
http://repo.or.cz/w/git.git?a=commitdiff%3Bh=516381d5secalert@redhat.com
N/A
http://secunia.com/advisories/33964secalert@redhat.com
Vendor Advisory
http://secunia.com/advisories/34194secalert@redhat.com
Vendor Advisory
http://wiki.rpath.com/Advisories:rPSA-2009-0005secalert@redhat.com
N/A
http://www.debian.org/security/2009/dsa-1708secalert@redhat.com
N/A
http://www.gentoo.org/security/en/glsa/glsa-200903-15.xmlsecalert@redhat.com
N/A
http://www.openwall.com/lists/oss-security/2009/01/20/1secalert@redhat.com
N/A
http://www.openwall.com/lists/oss-security/2009/01/21/7secalert@redhat.com
N/A
http://www.openwall.com/lists/oss-security/2009/01/23/2secalert@redhat.com
N/A
http://www.securityfocus.com/archive/1/500008/100/0/threadedsecalert@redhat.com
N/A
http://www.securityfocus.com/bid/33215secalert@redhat.com
Patch
http://www.ubuntu.com/usn/USN-723-1secalert@redhat.com
N/A
http://www.vupen.com/english/advisories/2009/0175secalert@redhat.com
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=479715secalert@redhat.com
N/A
https://issues.rpath.com/browse/RPL-2936secalert@redhat.com
N/A
Hyperlink: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512330
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00002.html
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://repo.or.cz/w/git.git?a=commitdiff%3Bh=516381d5
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://secunia.com/advisories/33964
Source: secalert@redhat.com
Resource:
Vendor Advisory
Hyperlink: http://secunia.com/advisories/34194
Source: secalert@redhat.com
Resource:
Vendor Advisory
Hyperlink: http://wiki.rpath.com/Advisories:rPSA-2009-0005
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://www.debian.org/security/2009/dsa-1708
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2009/01/20/1
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2009/01/21/7
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2009/01/23/2
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://www.securityfocus.com/archive/1/500008/100/0/threaded
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://www.securityfocus.com/bid/33215
Source: secalert@redhat.com
Resource:
Patch
Hyperlink: http://www.ubuntu.com/usn/USN-723-1
Source: secalert@redhat.com
Resource: N/A
Hyperlink: http://www.vupen.com/english/advisories/2009/0175
Source: secalert@redhat.com
Resource:
Vendor Advisory
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=479715
Source: secalert@redhat.com
Resource: N/A
Hyperlink: https://issues.rpath.com/browse/RPL-2936
Source: secalert@redhat.com
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

886Records found
CVE-2022-25648
Matching Score-8
Assigner-Snyk
ShareView Details
Matching Score-8
Assigner-Snyk
CVSS Score-8.1||HIGH
EPSS-1.71% / 81.57%
||
7 Day CHG~0.00%
Published-19 Apr, 2022 | 16:35
Updated-16 Sep, 2024 | 17:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Command Injection

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Action-Not Available
Vendor-gitn/aDebian GNU/LinuxFedora Project
Product-extra_packages_for_enterprise_linuxdebian_linuxfedoragitgit
CWE ID-CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CVE-2008-5516
Matching Score-8
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-8
Assigner-Red Hat, Inc.
CVSS Score-7.5||HIGH
EPSS-1.46% / 80.03%
||
7 Day CHG~0.00%
Published-20 Jan, 2009 | 16:00
Updated-07 Aug, 2024 | 10:56
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_search.

Action-Not Available
Vendor-git-scmrpathgitn/a
Product-linuxgitn/a
CWE ID-CWE-264
Not Available
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2008-3546
Matching Score-8
Assigner-MITRE Corporation
ShareView Details
Matching Score-8
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-2.32% / 84.17%
||
7 Day CHG~0.00%
Published-07 Aug, 2008 | 21:00
Updated-07 Aug, 2024 | 09:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before 1.5.6.4 might allow local users to execute arbitrary code via a PATH whose length is larger than the system's PATH_MAX when running GIT utilities such as git-diff or git-grep.

Action-Not Available
Vendor-gitn/aLinux Kernel Organization, Inc
Product-parduslinuxgitn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2006-0477
Matching Score-8
Assigner-MITRE Corporation
ShareView Details
Matching Score-8
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-6.72% / 90.89%
||
7 Day CHG~0.00%
Published-31 Jan, 2006 | 11:00
Updated-03 Apr, 2025 | 01:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute arbitrary code via an index file with a long symbolic link.

Action-Not Available
Vendor-gitn/a
Product-gitn/a
CVE-2021-22961
Matching Score-4
Assigner-HackerOne
ShareView Details
Matching Score-4
Assigner-HackerOne
CVSS Score-9.8||CRITICAL
EPSS-0.96% / 75.50%
||
7 Day CHG~0.00%
Published-18 Oct, 2021 | 12:48
Updated-03 Aug, 2024 | 18:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A code injection vulnerability exists within the firewall software of GlassWire v2.1.167 that could lead to arbitrary code execution from a file in the user path on first execution.

Action-Not Available
Vendor-glasswiren/a
Product-glasswireGlassWire
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2018-2418
Matching Score-4
Assigner-SAP SE
ShareView Details
Matching Score-4
Assigner-SAP SE
CVSS Score-5.5||MEDIUM
EPSS-0.52% / 65.79%
||
7 Day CHG~0.00%
Published-09 May, 2018 | 20:00
Updated-05 Aug, 2024 | 04:21
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

Action-Not Available
Vendor-SAP SE
Product-maxdb_odbc_driverSAP MaxDB ODBC driver
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2018-20027
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.51% / 65.50%
||
7 Day CHG~0.00%
Published-17 Dec, 2018 | 15:00
Updated-05 Aug, 2024 | 11:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The yaml_parse.load method in Pylearn2 allows code injection.

Action-Not Available
Vendor-lisa-labn/a
Product-pylearn2n/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2021-22205
Matching Score-4
Assigner-GitLab Inc.
ShareView Details
Matching Score-4
Assigner-GitLab Inc.
CVSS Score-10||CRITICAL
EPSS-94.47% / 100.00%
||
7 Day CHG~0.00%
Published-23 Apr, 2021 | 17:39
Updated-30 Jul, 2025 | 01:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Known KEV||Action Due Date - 2021-11-17||Apply updates per vendor instructions.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Action-Not Available
Vendor-GitLab Inc.
Product-gitlabGitLabCommunity and Enterprise Editions
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-4367
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-7.27% / 91.27%
||
7 Day CHG~0.00%
Published-02 Dec, 2010 | 16:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located on a (1) WebDAV server or (2) NFS server.

Action-Not Available
Vendor-awstatsn/a
Product-awstatsn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-4939
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-1.50% / 80.39%
||
7 Day CHG~0.00%
Published-09 Oct, 2011 | 10:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PHP remote file inclusion vulnerability in index.php in MailForm 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the theme parameter.

Action-Not Available
Vendor-scripts.bdr130n/a
Product-mailformn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-4879
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.77% / 72.50%
||
7 Day CHG-0.55%
Published-07 Oct, 2011 | 10:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the input_file parameter.

Action-Not Available
Vendor-digitaljunkiesn/a
Product-dompdfn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2019-19502
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.85% / 74.02%
||
7 Day CHG~0.00%
Published-02 Dec, 2019 | 15:14
Updated-05 Aug, 2024 | 02:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.

Action-Not Available
Vendor-maleckn/a
Product-image_uploader_and_browser_for_ckeditorn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2018-20605
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.99% / 76.01%
||
7 Day CHG~0.00%
Published-30 Dec, 2018 | 21:00
Updated-16 Sep, 2024 | 22:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

imcat 4.4 allows remote attackers to execute arbitrary PHP code by using root/run/adm.php to modify the boot/bootskip.php file.

Action-Not Available
Vendor-txjian/a
Product-imcatn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-4281
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-6.71% / 90.88%
||
7 Day CHG~0.00%
Published-02 Dec, 2010 | 17:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Incomplete blacklist vulnerability in the safe_url_extraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for the : (colon) character.

Action-Not Available
Vendor-n/aPandora FMS S.L.U.
Product-pandora_fmsn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-4948
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-1.50% / 80.39%
||
7 Day CHG~0.00%
Published-09 Oct, 2011 | 10:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PHP remote file inclusion vulnerability in libs/adodb/adodb.inc.php in PHP Free Photo Gallery script allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.

Action-Not Available
Vendor-phpgalleryscriptn/a
Product-php_free_photo_galleryn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-4988
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-1.17% / 77.77%
||
7 Day CHG~0.00%
Published-01 Nov, 2011 | 22:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PHP remote file inclusion vulnerability in mod_chatting/themes/default/header.php in Family Connections Who is Chatting 2.2.3 allows remote attackers to execute arbitrary PHP code via a URL in the TMPL[path] parameter.

Action-Not Available
Vendor-familycmsn/a
Product-family_connections_who_is_chattingn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-4810
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.71% / 71.32%
||
7 Day CHG~0.00%
Published-08 Jul, 2011 | 22:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple PHP remote file inclusion vulnerabilities in AR Web Content Manager (AWCM) 2.1 final allow remote attackers to execute arbitrary PHP code via a URL in the theme_file parameter to (1) includes/window_top.php and (2) header.php, and the (3) lang_file parameter to control/common.php.

Action-Not Available
Vendor-awcm-cmsn/a
Product-ar_web_content_managern/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2018-20133
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.42% / 61.01%
||
7 Day CHG~0.00%
Published-17 Dec, 2018 | 18:00
Updated-05 Aug, 2024 | 11:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

ymlref allows code injection.

Action-Not Available
Vendor-ymlref_projectn/a
Product-ymlrefn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2018-20325
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-3.53% / 87.20%
||
7 Day CHG~0.00%
Published-21 Dec, 2018 | 22:00
Updated-05 Aug, 2024 | 11:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

There is a vulnerability in load() method in definitions/parser.py in the Danijar Hafner definitions package for Python. It can execute arbitrary python commands resulting in command execution.

Action-Not Available
Vendor-definitions_projectn/a
Product-definitionsn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-4368
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.90% / 74.79%
||
7 Day CHG~0.00%
Published-02 Dec, 2010 | 16:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

awstats.cgi in AWStats before 7.0 on Windows accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located at a UNC share pathname.

Action-Not Available
Vendor-awstatsn/aMicrosoft Corporation
Product-awstatswindowsn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2018-1999022
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-1.40% / 79.65%
||
7 Day CHG~0.00%
Published-23 Jul, 2018 | 16:00
Updated-16 Sep, 2024 | 16:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hierselect's _setOptions method, HTML_QuickForm_element's _findValue method, HTML_QuickForm_element's _prepareValue method. that can result in Possible information disclosure, possible impact on data integrity and execution of arbitrary code. This attack appear to be exploitable via A specially crafted query string could be utilised, e.g. http://www.example.com/admin/add_practice_type_id[1]=fubar%27])%20OR%20die(%27OOK!%27);%20//&mode=live. This vulnerability appears to have been fixed in 3.2.15.

Action-Not Available
Vendor-civicrmhtml_quickform_projectn/a
Product-civicrmhtml_quickformn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2018-19595
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-5.13% / 89.46%
||
7 Day CHG~0.00%
Published-27 Nov, 2018 | 07:00
Updated-05 Aug, 2024 | 11:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by an index.php/list/5/?current={pboot:if(evAl($_GET[a]))}1{/pboot:if}&a=phpinfo(); URI, because of an incorrect apps\home\controller\ParserController.php parserIfLabel protection mechanism.

Action-Not Available
Vendor-pbootcmsn/a
Product-pbootcmsn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-5038
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.63% / 69.35%
||
7 Day CHG~0.00%
Published-02 Nov, 2011 | 21:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PHP remote file inclusion vulnerability in contact/contact.php in Groone's Simple Contact Form allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.

Action-Not Available
Vendor-groonesworldn/a
Product-simple_contact_formn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-4283
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-5.64% / 89.99%
||
7 Day CHG~0.00%
Published-02 Dec, 2010 | 17:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PHP remote file inclusion vulnerability in extras/pandora_diag.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the argv[1] parameter.

Action-Not Available
Vendor-n/aPandora FMS S.L.U.
Product-pandora_fmsn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2018-1999019
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-1.77% / 81.91%
||
7 Day CHG~0.00%
Published-23 Jul, 2018 | 15:00
Updated-16 Sep, 2024 | 19:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This vulnerability appears to have been fixed in After commit 0de84700648f098c1fbf6b807dee28ec640efe62.

Action-Not Available
Vendor-chamilon/a
Product-chamilo_lmsn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-3313
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-7.5||HIGH
EPSS-2.30% / 84.10%
||
7 Day CHG~0.00%
Published-22 Sep, 2010 | 18:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) aspell_path or (2) spellchecker_lang parameters.

Action-Not Available
Vendor-egroupwaren/a
Product-egroupwaren/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-3204
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-1.40% / 79.63%
||
7 Day CHG~0.00%
Published-03 Sep, 2010 | 17:12
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple PHP remote file inclusion vulnerabilities in Pecio CMS 2.0.5 allow remote attackers to execute arbitrary PHP code via a URL in the template parameter to (1) post.php, (2) article.php, (3) blog.php, or (4) home.php in pec_templates/nova-blue/.

Action-Not Available
Vendor-pecio-cmsn/a
Product-pecio_cmsn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-3205
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.94% / 75.31%
||
7 Day CHG~0.00%
Published-03 Sep, 2010 | 17:12
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PHP remote file inclusion vulnerability in index.php in Textpattern CMS 4.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter.

Action-Not Available
Vendor-textpatternn/a
Product-textpatternn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2018-20768
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.64% / 69.57%
||
7 Day CHG~0.00%
Published-10 Feb, 2019 | 17:00
Updated-17 Sep, 2024 | 03:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. An attacker can execute PHP code by leveraging a writable file.

Action-Not Available
Vendor-n/aXerox Corporation
Product-workcentre_6655iworkcentre_7220i_firmwareworkcentre_7855workcentre_5890workcentre_5865workcentre_5890i_firmwareworkcentre_3655_firmwareworkcentre_5845workcentre_5865_firmwareworkcentre_7225i_firmwareworkcentre_6655_firmwareworkcentre_7845iworkcentre_7835workcentre_3655i_firmwareworkcentre_7970_firmwareworkcentre_3655workcentre_7855i_firmwareworkcentre_5875i_firmwareworkcentre_7830i_firmwareworkcentre_7225iworkcentre_7970iworkcentre_7225workcentre_7225_firmwareworkcentre_7220_firmwareworkcentre_7845i_firmwareworkcentre_7835_firmwareworkcentre_6655workcentre_5900iworkcentre_7830iworkcentre_7855iworkcentre_7220workcentre_5890_firmwareworkcentre_7835iworkcentre_5900i_firmwareworkcentre_ec7856workcentre_5900_firmwareworkcentre_5865i_firmwareworkcentre_5875iworkcentre_ec7836_firmwareworkcentre_7970i_firmwareworkcentre_7970workcentre_ec7856_firmwareworkcentre_3655iworkcentre_7845workcentre_7835i_firmwareworkcentre_5865iworkcentre_5900workcentre_7830workcentre_7220iworkcentre_6655i_firmwareworkcentre_7855_firmwareworkcentre_5875_firmwareworkcentre_5845_firmwareworkcentre_5875workcentre_ec7836workcentre_7845_firmwareworkcentre_5890iworkcentre_7830_firmwaren/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-3307
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-7.5||HIGH
EPSS-0.70% / 71.03%
||
7 Day CHG~0.00%
Published-05 Oct, 2010 | 17:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) body, (2) footer, (3) header, (4) menu_left, or (5) menu_right parameter.

Action-Not Available
Vendor-dustincowelln/a
Product-free_simple_cmsn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2014-5519
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-82.62% / 99.19%
||
7 Day CHG~0.00%
Published-11 Sep, 2014 | 14:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the edit[content] parameter to index.php/HeIp. NOTE: some of these details are obtained from third party information.

Action-Not Available
Vendor-phpwiki_projectn/a
Product-phpwikin/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2019-17408
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-1.97% / 82.78%
||
7 Day CHG~0.00%
Published-14 Oct, 2019 | 11:43
Updated-05 Aug, 2024 | 01:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the danger_key function can be bypassed via manipulations such as strtr.

Action-Not Available
Vendor-zzzcmsn/a
Product-zzzphpn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-3210
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.94% / 75.31%
||
7 Day CHG~0.00%
Published-03 Sep, 2010 | 17:12
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple PHP remote file inclusion vulnerabilities in Multi-lingual E-Commerce System 0.2 allow remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to (1) checkout2-CYM.php, (2) checkout2-EN.php, (3) checkout2-FR.php, (4) cat-FR.php, (5) cat-EN.php, (6) cat-CYM.php, (7) checkout1-CYM.php, (8) checkout1-EN.php, (9) checkout1-FR.php, (10) prod-CYM.php, (11) prod-EN.php, and (12) prod-FR.php in inc/.

Action-Not Available
Vendor-martin_leen/a
Product-multi-lingual_e-commerce_systemn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-2918
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-1.60% / 80.98%
||
7 Day CHG~0.00%
Published-30 Jul, 2010 | 20:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PHP remote file inclusion vulnerability in core/include/myMailer.class.php in the Visites (com_joomla-visites) component 1.1 RC2 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

Action-Not Available
Vendor-visocrean/aJoomla!
Product-joomla\!com_joomla_visitesn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-3209
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.94% / 75.31%
||
7 Day CHG~0.00%
Published-03 Sep, 2010 | 17:12
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple PHP remote file inclusion vulnerabilities in Seagull 0.6.7 allow remote attackers to execute arbitrary PHP code via a URL in the includeFile parameter to (1) Config/Container.php and (2) HTML/QuickForm.php in fog/lib/pear/, the (3) driverpath parameter to fog/lib/pear/DB/NestedSet.php, and the (4) path parameter to fog/lib/pear/DB/NestedSet/Output.php.

Action-Not Available
Vendor-seagullproject.orgn/a
Product-seagulln/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2018-19641
Matching Score-4
Assigner-OpenText (formerly Micro Focus)
ShareView Details
Matching Score-4
Assigner-OpenText (formerly Micro Focus)
CVSS Score-6.1||MEDIUM
EPSS-0.63% / 69.43%
||
7 Day CHG~0.00%
Published-27 Mar, 2019 | 16:42
Updated-16 Sep, 2024 | 17:47
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Solutions Business Manager (SBM) Unauthenticated remote code execution issue in version prior to 11.5

Unauthenticated remote code execution issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5.

Action-Not Available
Vendor-Micro Focus International Limited
Product-solutions_business_managerSolutions Business Manager (SBM)
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-3742
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-1.82% / 82.12%
||
7 Day CHG~0.00%
Published-05 Oct, 2010 | 17:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) meta or (2) phpincdir parameter, a different issue than CVE-2010-3307.

Action-Not Available
Vendor-dustincowelln/a
Product-free_simple_cmsn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2014-5261
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-1.34% / 79.20%
||
7 Day CHG~0.00%
Published-22 Aug, 2014 | 14:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php.

Action-Not Available
Vendor-n/aThe Cacti Group, Inc.
Product-cactin/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-2127
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-2.10% / 83.37%
||
7 Day CHG~0.00%
Published-01 Jun, 2010 | 21:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PHP remote file inclusion vulnerability in gallery.php in JV2 Folder Gallery 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the lang_file parameter.

Action-Not Available
Vendor-jv2designn/a
Product-jv2_folder_galleryn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-1922
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-1.92% / 82.58%
||
7 Day CHG~0.00%
Published-12 May, 2010 | 16:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple PHP remote file inclusion vulnerabilities in 29o3 CMS 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the LibDir parameter to (1) lib/page/pageDescriptionObject.php, and (2) layoutHeaderFuncs.php, (3) layoutManager.php, and (4) layoutParser.php in lib/layout/.

Action-Not Available
Vendor-29o3_cmsn/a
Product-29o3_cmsn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-2626
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-16.08% / 94.53%
||
7 Day CHG~0.00%
Published-02 Jul, 2010 | 20:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

index.pl in Miyabi CGI Tools SEO Links 1.02 allows remote attackers to execute arbitrary commands via shell metacharacters in the fn command. NOTE: some of these details are obtained from third party information.

Action-Not Available
Vendor-miyabi-seon/a
Product-cgi_tools_seo_linksn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-2146
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-1.32% / 79.06%
||
7 Day CHG~0.00%
Published-03 Jun, 2010 | 14:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PHP remote file inclusion vulnerability in banned.php in Visitor Logger allows remote attackers to execute arbitrary PHP code via a URL in the VL_include_path parameter.

Action-Not Available
Vendor-graviton-mediatechn/a
Product-visitor_loggern/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2021-21244
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-10||CRITICAL
EPSS-0.37% / 58.05%
||
7 Day CHG~0.00%
Published-15 Jan, 2021 | 20:05
Updated-03 Aug, 2024 | 18:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Pre-Auth SSTI via Bean validation message tampering

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely.

Action-Not Available
Vendor-onedev_projecttheonedev
Product-onedevonedev
CWE ID-CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2014-5297
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.65% / 69.92%
||
7 Day CHG~0.00%
Published-10 Oct, 2014 | 01:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery (SSRF) attacks via crafted serialized data in the report parameter.

Action-Not Available
Vendor-x2enginen/a
Product-x2enginen/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-2145
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.62% / 69.20%
||
7 Day CHG~0.00%
Published-03 Jun, 2010 | 14:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple PHP remote file inclusion vulnerabilities in ClearSite Beta 4.50, and possibly other versions, allow remote attackers to execute arbitrary PHP code via a URL in the cs_base_path parameter to (1) docs.php and (2) include/admin/device_admin.php. NOTE: the header.php vector is already covered by CVE-2009-3306. NOTE: this issue may be due to a variable extraction error.

Action-Not Available
Vendor-richrumblen/a
Product-clearsiten/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-2005
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-1.32% / 79.06%
||
7 Day CHG~0.00%
Published-20 May, 2010 | 21:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple PHP remote file inclusion vulnerabilities in DataLife Engine (DLE) 8.3 allow remote attackers to execute arbitrary PHP code via a URL in (1) the selected_language parameter to engine/inc/include/init.php, (2) the config[langs] parameter to engine/inc/help.php, (3) the config[lang] parameter to engine/ajax/pm.php, (4) and the _REQUEST[skin] parameter to engine/ajax/addcomments.php.

Action-Not Available
Vendor-datalifecmsn/a
Product-datalife_enginen/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-2681
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.26% / 48.93%
||
7 Day CHG~0.00%
Published-09 Jul, 2010 | 19:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PHP remote file inclusion vulnerability in the SEF404x (com_sef) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig.absolute.path parameter to index.php.

Action-Not Available
Vendor-n/aJoomla!
Product-joomla\!com_sefn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-2132
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.71% / 71.46%
||
7 Day CHG~0.00%
Published-02 Jun, 2010 | 18:14
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple PHP remote file inclusion vulnerabilities in Open Education System (OES) 0.1 beta allow remote attackers to execute arbitrary PHP code via a URL in the CONF_INCLUDE_PATH parameter to (1) forum/admin.php and (2) plotgraph/index.php in admin/modules/modules/, and (3) admin_user/mod_admuser.php and (4) ogroup/mod_group.php in admin/modules/user_account/, different vectors than CVE-2007-1446.

Action-Not Available
Vendor-danny_hon/a
Product-oesn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-2137
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-2.10% / 83.37%
||
7 Day CHG~0.00%
Published-02 Jun, 2010 | 18:14
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

PHP remote file inclusion vulnerability in _center.php in ProMan 0.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.

Action-Not Available
Vendor-giaardn/a
Product-promann/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2010-1266
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-3.51% / 87.16%
||
7 Day CHG~0.00%
Published-06 Apr, 2010 | 15:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple PHP remote file inclusion vulnerabilities in WebMaid CMS 0.2-6 Beta and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) template, (2) menu, (3) events, and (4) SITEROOT parameters to template/babyweb/index.php; the (5) modules and (6) copyright parameters to template/calm/footer.php; the (7) menu parameter to template/calm/top.php; and the (8) modules, (9) copyright, and (10) menu parameters to template/wm025/footer.php.

Action-Not Available
Vendor-kjetiltroann/a
Product-webmaid_cmsn/a
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
  • Previous
  • 1
  • 2
  • 3
  • ...
  • 17
  • 18
  • Next
Details not found