Base de CVEs

Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.

1.455 resultado(s)

Exportar esta busca: RSS · CSV · STIX

CVE-2025-66457 Alta · 8.8 CWE-94 09/12/2025

Elysia affected by arbitrary code injection through cookie config

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and below are subject to arbitrary code execution from cookie config. When dynamic cookies are enabled (e.g. there an existing cookie schema), the cookie config is injected into the compiled route without first being sanitised. Availability of this exploit is generally low, but when combined with GHSA-hxj9-33pp-j2cc, it allows for a full RCE chain. An attack requires write access to either the Elysia app's source code (in which case the vulnerability is meaningless) or write access to the cookie config (perhaps where it is assumed to be provisioned by the environment). This issue is fixed in version 1.4.18.

CVE-2025-66533 Média · 6.5 CWE-94 09/12/2025

WordPress GiveWP plugin <= 4.13.1 - Arbitrary Shortocde Execution vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Liquid Web / StellarWP GiveWP give allows Code Injection.This issue affects GiveWP: from n/a through 4.13.1.

CVE-2025-42880 Crítica · 9.9 CWE-94 09/12/2025

Code Injection vulnerability in SAP Solution Manager

Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system.

CVE-2025-14324 Crítica · 9.8 CWE-94 09/12/2025

JIT miscompilation in the JavaScript Engine: JIT component

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

CVE-2025-13642 Média · 5.4 CWE-94 09/12/2025

ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.7 due to insufficient input sanitization on the `type` parameter in the form preview functionality. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes via the `pp_preview_form` endpoint.

CVE-2025-65271 Alta · 8.8 CWE-94 08/12/2025

Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user...

Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard components that render untrusted user input, potentially enabling privilege escalation to an administrative account. Fixed in Azuriom 1.2.7.

CVE-2024-32641 Crítica · 9.8 CWE-94 03/12/2025

Masa CMS Vulnerable to Pre-Auth RCE via JSON API

Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is patched in versions 7.2.8, 7.3.13, and 7.4.6.

CVE-2025-13486 Crítica · 9.8 Exploit público CWE-94 03/12/2025

Advanced Custom Fields: Extended (WordPress) - RCE não autenticada via prepare_form

O plugin Advanced Custom Fields: Extended para WordPress é vulnerável a Execução Remota de Código nas versões 0.9.0.5 até 0.9.1.1 através da função prepare_form(). Isso se deve à função aceitar entrada do usuário e então repassá-la para call_user_func_array(). Isso torna possível que atacantes não autenticados executem código arbitrário no servidor, o que pode ser aproveitado para injetar backdoors ou criar novas contas de administrador.

CVE-2025-13658 Crítica · 9.3 CWE-94 02/12/2025

Industrial Video & Control Longwatch: injeção de código

Uma vulnerabilidade em dispositivos Longwatch permite que requisições HTTP GET não autenticadas executem código arbitrário por meio de um endpoint exposto, devido à ausência de assinatura de código e de controles de execução. A exploração resulta em privilégios de nível SYSTEM.

CVE-2025-66448 Alta · 8.8 CWE-94 01/12/2025

vLLM vulnerable to remote code execution via transformers_utils/get_config

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.11.1, vllm has a critical remote code execution vector in a config class named Nemotron_Nano_VL_Config. When vllm loads a model config that contains an auto_map entry, the config class resolves that mapping with get_class_from_dynamic_module(...) and immediately instantiates the returned class. This fetches and executes Python from the remote repository referenced in the auto_map string. Crucially, this happens even when the caller explicitly sets trust_remote_code=False in vllm.transformers_utils.config.get_config. In practice, an attacker can publish a benign-looking frontend repo whose config.json points via auto_map to a separate malicious backend repo; loading the frontend will silently run the backend’s code on the victim host. This vulnerability is fixed in 0.11.1.

CVE-2025-66299 Alta · 8.8 CWE-94 01/12/2025

Security Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user with editor permissions to execute arbitrary code on the remote server, bypassing the existing security sandbox. Since the security sandbox does not fully protect the Twig object, it is possible to interact with it (e.g., call methods, read/write attributes) through maliciously crafted Twig template directives injected into a web page. This allows an authenticated editor to add arbitrary functions to the Twig attribute system.twig.safe_filters, effectively bypassing the Grav CMS sandbox. This vulnerability is fixed in 1.8.0-beta.27.

CVE-2025-66294 Alta · 8.8 Exploit público CWE-94 01/12/2025

Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the cleanDangerousTwig method. This vulnerability is fixed in 1.8.0-beta.27.

CVE-2024-39148 Alta · 8.1 CWE-94 01/12/2025

Code Injection em Kerlink Keros

The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is reachable over network. Typically, the service is protected via local firewall.

CVE-2025-13786 Crítica · 9.8 CWE-94 30/11/2025

taosir WTCMS index.php fetch code injection

A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Impacted is the function fetch of the file /index.php. Performing manipulation of the argument content results in code injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-66224 Alta · 8.8 CWE-94 29/11/2025

OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralization flaw in its mail configuration and delivery workflow that allows user-controlled values to flow directly into the system’s sendmail command. Because these values are not sanitized or constrained before being incorporated into the command execution path, certain sendmail behaviors can be unintentionally invoked during email processing. This makes it possible for the application to write files on the server as part of the mail-handling routine, and in deployments where those files end up in web-accessible locations, the behavior can be leveraged to achieve execution of attacker-controlled content. The issue stems entirely from constructing OS-level command strings using unsanitized input within the mail-sending logic. This issue has been patched in version 5.8.

CVE-2025-59302 Média · 4.7 CWE-94 27/11/2025

Apache CloudStack: Potential remote code execution on Javascript engine defined rules

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins. * quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix. The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.

CVE-2025-62593 Alta · 8.8 KEV Alta · 69 Exploit público CWE-94 26/11/2025

Vulnerabilidade de Injeção de Código no Ray-Project Ray

O Ray é um mecanismo de computação para IA. Antes da versão 2.52.0, desenvolvedores que trabalham com o Ray como ferramenta de desenvolvimento podem ser explorados por meio de uma vulnerabilidade crítica de RCE, explorável via Firefox e Safari. A falha decorre de uma proteção insuficiente contra ataques baseados em navegador, já que a defesa atual usa o cabeçalho User-Agent que começa com a string “Mozilla” como mecanismo de defesa. Essa defesa é insuficiente porque a especificação fetch permite que o cabeçalho User-Agent seja modificado. Combinada com um ataque de DNS rebinding contra o navegador, a vulnerabilidade pode ser explorada contra um desenvolvedor que executa o Ray e visita, sem perceber, um site malicioso, ou que é exposto a um anúncio malicioso (malvertising). Este problema foi corrigido na versão 2.52.0.

CVE-2025-33204 Alta · 7.8 CWE-94 25/11/2025

NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP and LLM components,...

NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP and LLM components, where malicious data created by an attacker could cause code injection. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.

CVE-2025-64050 Alta · 7.2 CWE-94 25/11/2025

Code Injection em Redaxo

A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.

CVE-2025-6389 Crítica · 9.8 Exploit público CWE-94 25/11/2025

Plugin Sneeit Framework para WordPress - Execução remota de código sem autenticação (CVE-2025-6389)

O plugin Sneeit Framework para WordPress é vulnerável a Execução Remota de Código em todas as versões até, inclusive, a 8.3, por meio da função sneeit_articles_pagination_callback(). Isso ocorre porque a função aceita entrada do usuário e a repassa para call_user_func(). Isso torna possível que atacantes não autenticados executem código no servidor, o que pode ser usado para inserir backdoors ou, por exemplo, criar novas contas de usuário administrativas.

CVE-2025-65108 Crítica · 10.0 CWE-94 21/11/2025

md-to-pdf: injeção de código JavaScript via front matter

md-to-pdf é uma ferramenta de linha de comando para converter arquivos Markdown em PDF usando Node.js e Chrome headless. Antes da versão 5.2.5, um bloco de front matter em Markdown que contém um delimitador de JavaScript faz com que o mecanismo JS da biblioteca gray-matter execute código arbitrário no processo do conversor de Markdown para PDF da biblioteca md-to-pdf, resultando em execução remota de código. Este problema foi corrigido na versão 5.2.5.

CVE-2025-12120 Alta · 7.3 CWE-94 20/11/2025

CVE-2025-12120

Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process.

CVE-2025-65099 Crítica · 9.8 CWE-94 19/11/2025

Claude Code vulnerable to command execution prior to startup trust dialog

Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would have required a user to start Claude Code in an untrusted directory and to be using Yarn 3.0 or above. This issue has been patched in version 1.0.39.

CVE-2025-10703 Alta · 8.6 CWE-94 19/11/2025

Code Injection em Progress DataDirect Connect for JDBC for Amazon Redshift

CVE-2025-10702 Alta · 8.6 CWE-94 19/11/2025

Code Injection em Progress DataDirect Connect for JDBC for Amazon Redshift