CWE-95: Eval Injection
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
Also known as Improper Neutralization of Directives in Dynamically Evaluated Code.
A kind of CWE-94 Improper Control of Generation of Code.
From the CWE List. © The MITRE Corporation.
Newest
- douglas wilson spreadsheet::parseexcel, debian linux, fedoraproject fedora +1 more +3 moreArbitrary Code Execution (ACE) Vulnerability7.8 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform remote code execution/programming rights with configuration section from any user account10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform RCE from account through SearchAdmin10.0 Critical
- fastbotsfastbots Eval Injection vulnerability8.4 High
- xwiki, xwiki xwiki-platform +1 moreRemote code execution through the section parameter in Administration as guest in XWiki Platform10.0 Critical
- xwiki, xwiki xwiki-platform +1 morePrivilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet10.0 Critical
- python pillow, debian linux +1 moreArbitrary Code Execution in Pillow8.1 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform privilege escalation (PR) from account through AWM content fields9.9 Critical
- xwiki, xwiki xwiki-platform +1 morePrivilege escalation (PR)/RCE from account through Invitation subject/message9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection from view right on XWiki.AttachmentSelector in xwiki-platform9.9 Critical
- xwiki, xwiki xwiki-platform +1 morexwiki-platform-administration-ui vulnerable to privilege escalation9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-logging-ui Injection vulnerability9.1 Critical
- xwiki, xwiki xwiki-platform +1 morexwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability10.0 Critical
- b. braun space battery pack sp with wi-fi, bbraun battery-pack sp with wifi firmware +1 moreAuthenticated eval injection in B. Braun Space Battery pack SP with Wi-Fi4.9 Medium
- proofpoint enterprise protectionProofpoint Enterprise Protection webservices unauthenticated RCE9.8 Critical
- proofpoint enterprise protectionProofpoint Enterprise Protection webutils authenticated RCE8.8 High
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability10.0 Critical
phpxmlrpc/phpxmlrpcPackagistcode injection in phpxmlrpc/phpxmlrpcNo score- xwiki, xwiki xwiki-platform +1 moreImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml9.9 Critical
- dolibarr erp\/crmDolibarr vulnerable to Eval Injection9.8 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Wiki UI Main Wiki Eval Injection vulnerability9.9 Critical
- esri portal for arcgisCode injection issue in Portal for ArcGIS (10.7.1 and 10.8.1)6.1 Medium
- oxyno-zeta react-editable-json-tree, react editable json tree project editable json tree +1 moreArbitrary code execution via function parsing in react-editable-json-tree10.0 Critical
- prestashopRemote code execution in prestashop9.8 Critical
- sap se netweaver as abap (reconciliation framework), sap netweaver application server abap +1 moreA function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702,...6.5 Medium
- gitlab, gitlab community and enterprise editions +1 moreAn issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab...10.0 Critical
- exiftool, debian linux, fedoraproject fedora +2 moreImproper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up...6.8 Medium
- eaton intelligent power manager (ipm), intelligent power manager, intelligent power manager virtual appliance +1 more +3 moreImproper Neutralization of Directives in Dynamically Evaluated Code8.3 High
- vertiv avocent umg-4000, avocent umg-4000 firmware +1 moreThe web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to arbitrary remote code execution8.3 High
- eaton ups companion software, ups companion +1 moreArbitrary code execution through “Update Manager” Class8.3 High
- bookstackapp bookstackRemote Code Execution Through Image Uploads in BookStack7.9 High
- twitter secure headersDirective injection when using dynamic overrides with user input in RubyGems secure_headers4.4 Medium