Vulnerabilities > Improper Control of Generation of Code ('Code Injection')
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-11-17 | CVE-2017-16871 | Code Injection vulnerability in Updraftplus The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. | 8.1 |
| 2017-11-17 | CVE-2017-1000196 | Code Injection vulnerability in Octobercms October October CMS build 412 is vulnerable to PHP code execution in the asset manager functionality resulting in site compromise and possibly other applications on the server. | 9.8 |
| 2017-11-15 | CVE-2017-15806 | Code Injection vulnerability in Zetacomponents Mail The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php." | 8.1 |
| 2017-11-15 | CVE-2014-4000 | Code Injection vulnerability in Cacti Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()). | 8.8 |
| 2017-11-10 | CVE-2017-16783 | Code Injection vulnerability in Cmsmadesimple CMS Made Simple 2.1.6 In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter. | 9.8 |
| 2017-10-30 | CVE-2017-7411 | Code Injection vulnerability in Enalean Tuleap An issue was discovered in Enalean Tuleap 9.6 and prior versions. | 8.8 |
| 2017-10-27 | CVE-2017-15935 | Code Injection vulnerability in Artica Pandora FMS 7.0 Artica Pandora FMS version 7.0 is vulnerable to remote PHP code execution through the manager files function. | 7.2 |
| 2017-10-16 | CVE-2017-15376 | Code Injection vulnerability in Mobatek Mobaxterm 10.4 The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which allows remote attackers to execute arbitrary commands via TCP port 23. | 9.8 |
| 2017-10-05 | CVE-2017-14353 | Code Injection vulnerability in HP Ucmdb Foundation Software A remote code execution vulnerability in HP UCMDB Foundation Software versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, and 10.33, could be remotely exploited to allow code execution. | 8.8 |
| 2017-10-03 | CVE-2015-6576 | Code Injection vulnerability in Atlassian Bamboo Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource. | 8.8 |