CWE-94
CVEs classified under CWE-94, newest first.
1393 CVEsRSS
CVE-2026-22771High· 8.8Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's …
CVE-2026-22244High· 7.2OpenMetadata is a unified metadata platform
OpenMetadata is a unified metadata platform. Versions 1.5.0 through 1.11.3 are vulnerable to remote code execution via Server-Side Template Injection (SSTI) in FreeMarker email templates. An attacker must have administrative privileges t…
CVE-2025-69262High· 7.5pnpm is a package manager
pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environme…
CVE-2025-15454Low· 3.1A vulnerability was detected in zhanglun lettura up to 0.1.22
A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/ArticleView/ContentRender.tsx of the component RSS Handler. The manipulation results in cross site scrip…
CVE-2025-15452Low· 2.4A weakness has been identified in xnx3 wangmarket up to 4.9
A weakness has been identified in xnx3 wangmarket up to 4.9. This affects the function variableList of the file /admin/system/variableList.do of the component Backend Variable Search. Executing a manipulation of the argument Description …
CVE-2025-15451Low· 2.4A security flaw has been discovered in xnx3 wangmarket up to 4.9
A security flaw has been discovered in xnx3 wangmarket up to 4.9. Affected by this issue is some unknown functionality of the file /admin/system/variableSave.do of the component System Variables Page. Performing a manipulation of the arg…
CVE-2025-55204High· 8.8muffon is a cross-platform music streaming client for desktop
muffon is a cross-platform music streaming client for desktop. Versions prior to 2.3.0 have a one-click Remote Code Execution (RCE) vulnerability in. An attacker can exploit this issue by embedding a specially crafted `muffon://` link on…
CVE-2025-15437Low· 3.5A vulnerability was found in LigeroSmart up to 6.1.24
A vulnerability was found in LigeroSmart up to 6.1.24. This affects an unknown part of the component Environment Variable Handler. Performing a manipulation of the argument REQUEST_URI results in cross site scripting. The attack may be i…
CVE-2025-15416Low· 2.4A vulnerability was found in xnx3 wangmarket up to 6.4
A vulnerability was found in xnx3 wangmarket up to 6.4. This affects an unknown function of the file /siteVar/save.do of the component Add Global Variable Handler. The manipulation of the argument Remark/Variable Value results in cross s…
CVE-2025-68619High· 7.2Signal K Server is a server application that runs on a central hub in a boat
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. While the endpoint validates that …
CVE-2025-15394Medium· 4.7A vulnerability was detected in iCMS up to 8.0.0
A vulnerability was detected in iCMS up to 8.0.0. Affected is the function Save of the file app/config/ConfigAdmincp.php of the component POST Parameter Handler. The manipulation of the argument config results in code injection. The atta…
CVE-2025-15393Medium· 6.3A security vulnerability has been detected in Kohana KodiCMS up to 13.82.135
A security vulnerability has been detected in Kohana KodiCMS up to 13.82.135. This impacts the function Save of the file cms/modules/kodicms/classes/kodicms/model/file.php of the component Layout API Endpoint. The manipulation of the arg…
CVE-2025-15221Low· 3.5A flaw has been found in SohuTV CacheCloud up to 3.2.0
A flaw has been found in SohuTV CacheCloud up to 3.2.0. This vulnerability affects the function index of the file src/main/java/com/sohu/cache/web/controller/AppDataMigrateController.java. This manipulation causes cross site scripting. R…
CVE-2025-15220Medium· 4.3A vulnerability was detected in SohuTV CacheCloud up to 3.2.0
A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. This affects the function init of the file src/main/java/com/sohu/cache/web/controller/LoginController.java. The manipulation results in cross site scripting. The attack may …
CVE-2025-14509High· 7.2The Lucky Wheel for WooCommerce – Spin a Sale plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.1.13
The Lucky Wheel for WooCommerce – Spin a Sale plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.1.13. This is due to the plugin using eval() to execute user-supplied input from the 'Conditio…
CVE-2025-15219Low· 3.5A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0
A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. Affected by this issue is the function doMachineList/doPodList of the file src/main/java/com/sohu/cache/web/controller/MachineManageController.java. The manipul…
CVE-2025-15214Low· 2.4A vulnerability was found in Campcodes Park Ticketing System 1.0
A vulnerability was found in Campcodes Park Ticketing System 1.0. The impacted element is the function save_pricing of the file admin_class.php. The manipulation of the argument name/ride results in cross site scripting. The attack may b…
CVE-2025-15201Low· 3.5A flaw has been found in SohuTV CacheCloud up to 3.2.0
A flaw has been found in SohuTV CacheCloud up to 3.2.0. The impacted element is the function redirectNoPower of the file src/main/java/com/sohu/cache/web/controller/WebResourceController.java. This manipulation causes cross site scriptin…
CVE-2025-15200Low· 2.4A vulnerability was detected in SohuTV CacheCloud up to 3.2.0
A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. The affected element is the function getExceptionStatisticsByClient/getCommandStatisticsByClient/doIndex of the file src/main/java/com/sohu/cache/web/controller/AppClientData…
CVE-2025-13592High· 7.2The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.14 via the 'change-ad__content' shortcode parameter
The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.0.14 via the 'change-ad__content' shortcode parameter. This allows authenticated attackers with editor-level permissions or …
CVE-2025-15173Low· 3.5A weakness has been identified in SohuTV CacheCloud up to 3.2.0
A weakness has been identified in SohuTV CacheCloud up to 3.2.0. Affected is the function advancedAnalysis of the file src/main/java/com/sohu/cache/web/controller/InstanceController.java. This manipulation causes cross site scripting. Th…
CVE-2025-15172Low· 3.5A security flaw has been discovered in SohuTV CacheCloud up to 3.2.0
A security flaw has been discovered in SohuTV CacheCloud up to 3.2.0. This impacts the function preview of the file src/main/java/com/sohu/cache/web/controller/RedisConfigTemplateController.java. The manipulation results in cross site sc…
CVE-2025-15171Low· 3.5A vulnerability was identified in SohuTV CacheCloud up to 3.2.0
A vulnerability was identified in SohuTV CacheCloud up to 3.2.0. This affects the function index of the file src/main/java/com/sohu/cache/web/controller/ServerController.java. The manipulation leads to cross site scripting. Remote exploi…
CVE-2025-15188Low· 2.4A vulnerability was determined in Campcodes Complete Online Beauty Parlor Management System 1.0
A vulnerability was determined in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/search-invoices.php. Executing a manipulation of the argument searchdata can lead…
CVE-2025-15175Low· 3.5A vulnerability was detected in SohuTV CacheCloud up to 3.2.0
A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. Affected by this issue is the function doAppList/appCommandAnalysis of the file src/main/java/com/sohu/cache/web/controller/AppController.java. Performing manipulation result…
CVE-2025-15174Low· 3.5A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0
A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. Affected by this vulnerability is the function doAppAuditList of the file src/main/java/com/sohu/cache/web/controller/AppManageController.java. Such manipulatio…
CVE-2025-15204Low· 2.4A vulnerability was determined in SohuTV CacheCloud up to 3.2.0
A vulnerability was determined in SohuTV CacheCloud up to 3.2.0. Affected is the function doQuartzList of the file src/main/java/com/sohu/cache/web/controller/QuartzManageController.java. Executing manipulation can lead to cross site scr…
CVE-2025-15203Low· 2.4A vulnerability was found in SohuTV CacheCloud up to 3.2.0
A vulnerability was found in SohuTV CacheCloud up to 3.2.0. This impacts the function index of the file src/main/java/com/sohu/cache/web/controller/ResourceController.java. Performing manipulation results in cross site scripting. It is p…
CVE-2025-68897Critical· 9.9Improper Control of Generation of Code ('Code Injection') vulnerability in Mohammad I
Improper Control of Generation of Code ('Code Injection') vulnerability in Mohammad I. Okfie IF AS Shortcode if-as-shortcode allows Code Injection.This issue affects IF AS Shortcode: from n/a through <= 1.2.
CVE-2025-15202Low· 2.4A vulnerability has been found in SohuTV CacheCloud up to 3.2.0
A vulnerability has been found in SohuTV CacheCloud up to 3.2.0. This affects the function taskQueueList of the file src/main/java/com/sohu/cache/web/controller/TaskController.java. Such manipulation leads to cross site scripting. The at…