CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
8272 vulnerabilities reference this CWE, most recent first.
GHSA-XJ37-VMC7-9W35
Vulnerability from github – Published: 2022-05-01 23:44 – Updated: 2022-05-01 23:44Argument injection vulnerability in login (login-utils/login.c) in util-linux-ng 2.14 and earlier makes it easier for remote attackers to hide activities by modifying portions of log events, as demonstrated by appending an "addr=" statement to the login name, aka "audit log injection."
{
"affected": [],
"aliases": [
"CVE-2008-1926"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-04-24T05:05:00Z",
"severity": "HIGH"
},
"details": "Argument injection vulnerability in login (login-utils/login.c) in util-linux-ng 2.14 and earlier makes it easier for remote attackers to hide activities by modifying portions of log events, as demonstrated by appending an \"addr=\" statement to the login name, aka \"audit log injection.\"",
"id": "GHSA-xj37-vmc7-9w35",
"modified": "2022-05-01T23:44:57Z",
"published": "2022-05-01T23:44:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1926"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41987"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9833"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00624.html"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git%3Ba=blobdiff%3Bf=login-utils/login.c%3Bh=230121316d953c59e7842c1325f6e9f326a37608%3Bhp=aad27794327c60391b5148b367d2c79338fc6ee4%3Bhb=8ccf0b253ac0f4f58d64bc9674de18bff5a88782%3Bhpb=3a4a13b12a8065b0b5354686d2807cce421a9973"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git%3Ba=commit%3Bh=8ccf0b253ac0f4f58d64bc9674de18bff5a88782"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git;a=blobdiff;f=login-utils/login.c;h=230121316d953c59e7842c1325f6e9f326a37608;hp=aad27794327c60391b5148b367d2c79338fc6ee4;hb=8ccf0b253ac0f4f58d64bc9674de18bff5a88782;hpb=3a4a13b12a8065b0b5354686d2807cce421a9973"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git;a=commit;h=8ccf0b253ac0f4f58d64bc9674de18bff5a88782"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/29982"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30014"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35161"
},
{
"type": "WEB",
"url": "http://wiki.rpath.com/Advisories:rPSA-2009-0143"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:114"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2009-0981.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/507854/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/28983"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1022256"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/1392/references"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XJ3F-76HF-WV75
Vulnerability from github – Published: 2022-05-17 01:56 – Updated: 2022-05-17 01:56PHP remote file inclusion vulnerability in iJoomla Magazine (com_magazine) component 3.0.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the config parameter to magazine.functions.php.
{
"affected": [],
"aliases": [
"CVE-2010-4918"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-10-08T10:55:00Z",
"severity": "HIGH"
},
"details": "PHP remote file inclusion vulnerability in iJoomla Magazine (com_magazine) component 3.0.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the config parameter to magazine.functions.php.",
"id": "GHSA-xj3f-76hf-wv75",
"modified": "2022-05-17T01:56:38Z",
"published": "2022-05-17T01:56:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4918"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61598"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.org/1009-exploits/ijoomlamagazine-rfi.txt"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/8451"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/14896"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XJ4F-8JJG-VX4Q
Vulnerability from github – Published: 2026-05-04 19:31 – Updated: 2026-05-15 23:48Impact
The ConceptReferenceRangeUtility.evaluateCriteria() method in OpenMRS Core
evaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The VelocityEngine is initialized with only logging properties and noSecureUberspector, leaving the default UberspectImpl in place, which allows
unrestricted Java reflection through template expressions.
A user with the Manage Concepts privilege can store a malicious Velocity template
expression in a concept's reference range criteria field. This payload is then executed
automatically whenever a user or API call validates an observation against the affected
concept. The Velocity context exposes $patient (the Person / Patient object), $obs (the Obs object), and $fn (the ConceptReferenceRangeUtility instance with access to the full OpenMRS service layer).
Persistent Remote Code Execution: The payload persists in the concept_reference_range database table (VARCHAR 65535). A single compromised concept for a common clinical measurement executes the payload on every subsequent observation validation across all users, API clients, and integrations in the facility.
Privilege Escalation: The Manage Concepts privilege is a content-management function, defined as "Able to add/edit/delete concept entries", not an administrative privilege. Multiple non-admin staff per facility typically hold this privilege. The attacker escalates from concept dictionary management to arbitrary code execution as the Tomcat application server process.
PHI Exfiltration: The Velocity context objects directly expose patient data without requiring OS-level RCE.
Patches
This is fixed in 2.8.6 and 2.7.9 as well as future versions.
Workarounds
Ensure the Manage Concepts privilege is restricted to only authorized users and carefully audit any ConceptReferenceRanges in the database.
Resources
https://github.com/openmrs/openmrs-core/commit/8d1c193 https://www.machinespirits.com/advisory/1e8430/
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.openmrs.api:openmrs-api"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.openmrs.api:openmrs-api"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41258"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-04T19:31:22Z",
"nvd_published_at": "2026-05-15T17:16:46Z",
"severity": "CRITICAL"
},
"details": "### Impact\n\nThe `ConceptReferenceRangeUtility.evaluateCriteria()` method in OpenMRS Core\nevaluates database-stored criteria strings as Apache Velocity templates without any sandbox configuration. The `VelocityEngine` is initialized with only logging properties and no`SecureUberspector`, leaving the default `UberspectImpl` in place, which allows\nunrestricted Java reflection through template expressions.\n\nA user with the `Manage Concepts` privilege can store a malicious Velocity template\nexpression in a concept\u0027s reference range criteria field. This payload is then executed\nautomatically whenever a user or API call validates an observation against the affected\nconcept. The Velocity context exposes `$patient` (the `Person` / `Patient` object), `$obs` (the `Obs` object), and `$fn` (the `ConceptReferenceRangeUtility` instance with access to the full OpenMRS service layer).\n\n**Persistent Remote Code Execution**: The payload persists in the concept_reference_range database table (VARCHAR 65535). A single compromised concept for a common clinical measurement executes the payload on every subsequent observation validation across all users, API clients, and integrations in the facility.\n\n**Privilege Escalation**: The Manage Concepts privilege is a content-management function, defined as \"Able to add/edit/delete concept entries\", not an administrative privilege. Multiple non-admin staff per facility typically hold this privilege. The attacker escalates from concept dictionary management to arbitrary code execution as the Tomcat application server process.\n\n**PHI Exfiltration**: The Velocity context objects directly expose patient data without requiring OS-level RCE.\n\n### Patches\n\nThis is fixed in 2.8.6 and 2.7.9 as well as future versions.\n\n### Workarounds\n\nEnsure the `Manage Concepts` privilege is restricted to only authorized users and carefully audit any `ConceptReferenceRanges` in the database.\n\n### Resources\nhttps://github.com/openmrs/openmrs-core/commit/8d1c193\nhttps://www.machinespirits.com/advisory/1e8430/",
"id": "GHSA-xj4f-8jjg-vx4q",
"modified": "2026-05-15T23:48:35Z",
"published": "2026-05-04T19:31:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openmrs/openmrs-core/security/advisories/GHSA-xj4f-8jjg-vx4q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41258"
},
{
"type": "WEB",
"url": "https://github.com/openmrs/openmrs-core/commit/8d1c193"
},
{
"type": "PACKAGE",
"url": "https://github.com/openmrs/openmrs-core"
},
{
"type": "WEB",
"url": "https://www.machinespirits.com/advisory/1e8430"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange"
}
GHSA-XJ56-P8MM-QMXJ
Vulnerability from github – Published: 2025-06-27 15:27 – Updated: 2025-06-27 15:27Summary
A critical remote code execution vulnerability was discovered during the Llama Factory training process. This vulnerability arises because the vhead_file is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passing a malicious Checkpoint path parameter through the WebUI interface. The attack is stealthy, as the victim remains unaware of the exploitation. The root cause is that the vhead_file argument is loaded without the secure parameter weights_only=True.
Note: In torch versions <2.6, the default setting is weights_only=False, and Llama Factory's setup.py only requires torch>=2.0.0.
Affected Version
Llama Factory versions <=0.9.3 are affected by this vulnerability.
Details
-
In LLaMA Factory's WebUI, when a user sets the
Checkpoint path, it modifies theadapter_name_or_pathparameter passed to the training process. code in src/llamafactory/webui/runner.py -
The
adapter_name_or_pathpassed to the training process is then used insrc/llamafactory/model/model_utils/valuehead.pyto fetch the correspondingvalue_head.binfile from Hugging Face. This file is subsequently loaded viatorch.load()without the security parameterweights_only=Truebeing set, resulting in remote code execution. code in src/llamafactory/model/model_utils/valuehead.py
PoC
Steps to Reproduce
- Deploy llama factory.
- Remote attack through the WebUI interface
- Configure
Model nameandModel pathcorrectly. For demonstration purposes, we'll use a small modelllamafactory/tiny-random-Llama-3to accelerate model loading. - Set
Finetuning methodtoLoRAandTrain StagetoReward Modeling. The vulnerability is specifically triggered during the Reward Modeling training stage. - Input a malicious Hugging Face path in
Checkpoint path– here we usepaulinsider/llamafactory-hack. This repository(https://huggingface.co/paulinsider/llamafactory-hack/tree/main ) contains a maliciousvalue_head.binfile. The generation method for this file is as follows (it can execute arbitrary attack commands; for demonstration, we configured it to create aHACKED!folder). - Click
Startto begin training. After a brief wait, aHACKED!folder will be created on the server. Note that arbitrary malicious code could be executed through this method.
- Configure
The video demonstration of the vulnerability exploitation is available at the Google Drive Link
Impact
Exploitation of this vulnerability allows remote attackers to: - Execute arbitrary malicious code / OS commands on the server. - Potentially compromise sensitive data or escalate privileges. - Deploy malware or create persistent backdoors in the system. This significantly increases the risk of data breaches and operational disruption.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "llamafactory"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.9.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-53002"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-27T15:27:01Z",
"nvd_published_at": "2025-06-26T15:15:23Z",
"severity": "HIGH"
},
"details": "### Summary\nA critical remote code execution vulnerability was discovered during the Llama Factory training process. This vulnerability arises because the `vhead_file` is loaded without proper safeguards, allowing malicious attackers to execute arbitrary malicious code on the host system simply by passing a malicious `Checkpoint path` parameter through the `WebUI` interface. The attack is stealthy, as the victim remains unaware of the exploitation. The root cause is that the `vhead_file` argument is loaded without the secure parameter `weights_only=True`.\n\nNote: In torch versions \u003c2.6, the default setting is `weights_only=False`, and Llama Factory\u0027s `setup.py` only requires `torch\u003e=2.0.0`.\n\n### Affected Version\n\nLlama Factory versions \u003c=0.9.3 are affected by this vulnerability.\n\n### Details\n\n1. In LLaMA Factory\u0027s WebUI, when a user sets the `Checkpoint path`, it modifies the `adapter_name_or_path` parameter passed to the training process.\ncode in src/llamafactory/webui/runner.py\n\u003cimg width=\"1040\" alt=\"image-1\" src=\"https://github.com/user-attachments/assets/c8bc79e4-ce7d-43c9-b0fd-e37c235e6585\" /\u003e\n\n2. The `adapter_name_or_path` passed to the training process is then used in `src/llamafactory/model/model_utils/valuehead.py` to fetch the corresponding `value_head.bin` file from Hugging Face. This file is subsequently loaded via `torch.load()` without the security parameter `weights_only=True` being set, resulting in remote code execution.\ncode in src/llamafactory/model/model_utils/valuehead.py\n\u003cimg width=\"1181\" alt=\"image-2\" src=\"https://github.com/user-attachments/assets/6edbe694-0c60-4a54-bfb3-5e1042c9230d\" /\u003e\n\n### PoC\n\n#### Steps to Reproduce\n\n1. Deploy llama factory.\n2. Remote attack through the WebUI interface\n 1. Configure `Model name` and `Model path` correctly. For demonstration purposes, we\u0027ll use a small model `llamafactory/tiny-random-Llama-3` to accelerate model loading.\n 2. Set `Finetuning method` to `LoRA` and `Train Stage` to `Reward Modeling`. The vulnerability is specifically triggered during the Reward Modeling training stage.\n 3. Input a malicious Hugging Face path in `Checkpoint path` \u2013 here we use `paulinsider/llamafactory-hack`. This repository(https://huggingface.co/paulinsider/llamafactory-hack/tree/main ) contains a malicious `value_head.bin` file. The generation method for this file is as follows (it can execute arbitrary attack commands; for demonstration, we configured it to create a `HACKED!` folder).\n 4. Click `Start` to begin training. After a brief wait, a `HACKED!` folder will be created on the server. Note that arbitrary malicious code could be executed through this method.\n\n**The video demonstration of the vulnerability exploitation is available at the** [Google Drive Link](https://drive.google.com/file/d/1AddKm2mllsXfuvL4Tvbn_WJdjEOYXx4y/view?usp=sharing) \n\n### Impact\nExploitation of this vulnerability allows remote attackers to:\n - Execute arbitrary malicious code / OS commands on the server.\n - Potentially compromise sensitive data or escalate privileges.\n - Deploy malware or create persistent backdoors in the system.\nThis significantly increases the risk of data breaches and operational disruption.",
"id": "GHSA-xj56-p8mm-qmxj",
"modified": "2025-06-27T15:27:02Z",
"published": "2025-06-27T15:27:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hiyouga/LLaMA-Factory/security/advisories/GHSA-xj56-p8mm-qmxj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53002"
},
{
"type": "WEB",
"url": "https://github.com/hiyouga/LLaMA-Factory/commit/bb7bf51554d4ba8432333c35a5e3b52705955ede"
},
{
"type": "PACKAGE",
"url": "https://github.com/hiyouga/LLaMA-Factory"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "LLaMA-Factory allows Code Injection through improper vhead_file safeguards"
}
GHSA-XJ6R-2JPM-QVXP
Vulnerability from github – Published: 2021-08-25 14:45 – Updated: 2021-08-24 18:50The following was initially reported by @jonaslagoni:
Given the following command:
ag ./dummy.json @asyncapi/java-spring-cloud-stream-template --force-write --output ./output
With the following AsyncAPI document:
{
"asyncapi": "2.0.0",
"info": {
"title": "Streetlight",
"version": "1.0.0"
},
"defaultContentType": "json",
"channels": {
"security/audit/channel": {
"description": "Channel for the turn on command which should turn on the streetlight",
"parameters": {
"streetlight_id": {
"description": "The ID of the streetlight",
"schema": {
"type": "string"
}
}
},
"publish": {
"operationId": "test() { System.out.println(\"injected\"); return test(0); }\n public Consumer<CustomClass> someothername",
"message": {
"name": "TurnonCommand",
"payload": {
"$ref": "#/components/schemas/CustomClass"
}
}
}
}
},
"components": {
"schemas" : {
"CustomClass": {
"type": "object",
"properties": {
"prop": {
"type": "string"
}
}
}
}
}
}
Which changes the following output:
...
@Bean
public Consumer<CustomClass> test() {
// Add business logic here.
return null;
}
...
To
...
@Bean
public Consumer<CustomClass> test() { System.out.println("injected"); return someothername(); }
public Consumer<CustomClass> someothername() {
// Add business logic here.
return null;
}
...
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.6.9"
},
"package": {
"ecosystem": "npm",
"name": "@asyncapi/java-spring-cloud-stream-template"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-37694"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-24T18:50:59Z",
"nvd_published_at": "2021-08-11T18:15:00Z",
"severity": "HIGH"
},
"details": "The following was initially reported by @jonaslagoni:\n\nGiven the following command:\n`ag ./dummy.json @asyncapi/java-spring-cloud-stream-template --force-write --output ./output`\n\nWith the following AsyncAPI document:\n```json\n{\n \"asyncapi\": \"2.0.0\",\n \"info\": {\n \"title\": \"Streetlight\",\n \"version\": \"1.0.0\"\n },\n \"defaultContentType\": \"json\",\n \"channels\": {\n \"security/audit/channel\": {\n \"description\": \"Channel for the turn on command which should turn on the streetlight\",\n \"parameters\": {\n \"streetlight_id\": {\n \"description\": \"The ID of the streetlight\",\n \"schema\": {\n \"type\": \"string\"\n }\n }\n },\n \"publish\": {\n \"operationId\": \"test() { System.out.println(\\\"injected\\\"); return test(0); }\\n public Consumer\u003cCustomClass\u003e someothername\",\n \"message\": {\n \"name\": \"TurnonCommand\",\n \"payload\": {\n \"$ref\": \"#/components/schemas/CustomClass\"\n }\n }\n }\n }\n },\n \"components\": {\n \"schemas\" : {\n \"CustomClass\": {\n \"type\": \"object\",\n \"properties\": {\n \"prop\": { \n \"type\": \"string\"\n }\n }\n }\n }\n }\n}\n```\n\nWhich changes the following output: \n\n```java\n...\n @Bean\n public Consumer\u003cCustomClass\u003e test() {\n // Add business logic here.\n return null;\n }\n...\n```\nTo\n```java\n...\n @Bean\n public Consumer\u003cCustomClass\u003e test() { System.out.println(\"injected\"); return someothername(); }\n public Consumer\u003cCustomClass\u003e someothername() {\n // Add business logic here.\n return null;\n }\n...\n```",
"id": "GHSA-xj6r-2jpm-qvxp",
"modified": "2021-08-24T18:50:59Z",
"published": "2021-08-25T14:45:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/asyncapi/java-spring-cloud-stream-template/security/advisories/GHSA-xj6r-2jpm-qvxp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37694"
},
{
"type": "PACKAGE",
"url": "https://github.com/asyncapi/java-spring-cloud-stream-template"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Code injection issue for java-spring-cloud-stream-template"
}
GHSA-XJ9J-GJXG-7JVQ
Vulnerability from github – Published: 2025-11-25 18:32 – Updated: 2025-11-26 22:00A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "redaxo/source"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.20.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-64050"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-26T22:00:29Z",
"nvd_published_at": "2025-11-25T16:16:07Z",
"severity": "HIGH"
},
"details": "A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.",
"id": "GHSA-xj9j-gjxg-7jvq",
"modified": "2025-11-26T22:00:29Z",
"published": "2025-11-25T18:32:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64050"
},
{
"type": "WEB",
"url": "https://github.com/redaxo/redaxo/pull/6372/commits/bc96462e20f7e651b2e6c3bb59d141d5cb09af0f"
},
{
"type": "WEB",
"url": "https://drive.google.com/drive/folders/1Via4r4wn5zCcBllWmHpxYweCPgcbN0bz?usp=sharing"
},
{
"type": "PACKAGE",
"url": "https://github.com/redaxo/redaxo"
},
{
"type": "WEB",
"url": "https://github.com/vettrivel007/CVE-Disclosures/blob/main/CVE-2025-64050.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "REDAXO CMS is vulnerable to RCE attack through its template management component"
}
GHSA-XJCR-R5HG-97FC
Vulnerability from github – Published: 2025-12-11 21:31 – Updated: 2026-03-11 18:30In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2025-36938"
],
"database_specific": {
"cwe_ids": [
"CWE-693",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-11T20:15:58Z",
"severity": "MODERATE"
},
"details": "In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-xjcr-r5hg-97fc",
"modified": "2026-03-11T18:30:25Z",
"published": "2025-12-11T21:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36938"
},
{
"type": "WEB",
"url": "https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2025-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XJH5-JF5M-43HX
Vulnerability from github – Published: 2025-05-16 18:31 – Updated: 2026-04-01 18:35Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG Lite allows Code Injection. This issue affects MapSVG Lite: from n/a through 8.6.4.
{
"affected": [],
"aliases": [
"CVE-2025-48120"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-16T16:15:44Z",
"severity": "MODERATE"
},
"details": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in RomanCode MapSVG Lite allows Code Injection. This issue affects MapSVG Lite: from n/a through 8.6.4.",
"id": "GHSA-xjh5-jf5m-43hx",
"modified": "2026-04-01T18:35:07Z",
"published": "2025-05-16T18:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48120"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-lite-plugin-8-5-41-arbitrary-shortcode-execution-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XJHR-J8QW-XVFW
Vulnerability from github – Published: 2022-05-01 18:45 – Updated: 2022-05-01 18:45PHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter.
{
"affected": [],
"aliases": [
"CVE-2007-6649"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-01-04T11:46:00Z",
"severity": "HIGH"
},
"details": "PHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter.",
"id": "GHSA-xjhr-j8qw-xvfw",
"modified": "2022-05-01T18:45:04Z",
"published": "2022-05-01T18:45:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-6649"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39314"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/4815"
},
{
"type": "WEB",
"url": "http://osvdb.org/39916"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/27073"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XJM4-P3WM-QFM9
Vulnerability from github – Published: 2023-11-14 18:30 – Updated: 2023-11-14 18:30Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.
{
"affected": [],
"aliases": [
"CVE-2023-6125"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-14T16:15:27Z",
"severity": "MODERATE"
},
"details": " Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.",
"id": "GHSA-xjm4-p3wm-qfm9",
"modified": "2023-11-14T18:30:27Z",
"published": "2023-11-14T18:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6125"
},
{
"type": "WEB",
"url": "https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/a9462f1e-9746-4380-8228-533ff2f64691"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.