← Back
CWE-94

7,044 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

JSON object

Loading...

CVEs (7,044)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2013-7050
1Devscripts Devel Team
1Devscripts
Apr 29, 2026
Dec 13, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The get_main_source_dir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCAN_EXCLUSION, allows remote attackers to execute arbitrary commands via shell metacharacters in a directory name.
CVE-2013-6421
1Projectsprouts
1Sprout
Apr 29, 2026
Dec 12, 2013
N/A· v4
N/A· v3
7.5 HIGH· v2
The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.
CVE-2013-2751
1Netgear
1Raidiator
Apr 29, 2026
Dec 12, 2013
N/A· v4
N/A· v3
10.0 HIGH· v2
Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to execute arbitrary Perl code via a...Show more
Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to execute arbitrary Perl code via a crafted request, related to the "forgot password workflow."Show less
CVE-2013-6810
1Emc
1Connectrix Manager
Apr 29, 2026
Dec 12, 2013
N/A· v4
N/A· v3
10.0 HIGH· v2
The server in Brocade Network Advisor before 12.1.0, as used in EMC Connectrix Manager Converged Network Edition (CMCNE), HP B-series SAN Network Advisor, and possibly other products, allows remote attackers to execute a...Show more
The server in Brocade Network Advisor before 12.1.0, as used in EMC Connectrix Manager Converged Network Edition (CMCNE), HP B-series SAN Network Advisor, and possibly other products, allows remote attackers to execute arbitrary code by using a servlet to upload an executable file.Show less
CVE-2013-6671
6Canonical
FedoraprojectMozilla+3 more
16Enterprise Linux Desktop
Enterprise Linux EusEnterprise Linux Server+13 more
Apr 29, 2026
Dec 11, 2013
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code via crafted use...Show more
The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code via crafted use of JavaScript code for ordered list elements.Show less
CVE-2013-5332
1Adobe
3Air
Air SdkFlash Player
Apr 29, 2026
Dec 11, 2013
N/A· v4
N/A· v3
9.3 HIGH· v2
Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before 3.9.0.1380, and Adobe AIR SDK &...Show more
Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before 3.9.0.1380, and Adobe AIR SDK & Compiler before 3.9.0.1380 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.Show less
CVE-2013-5331
1Adobe
3Air
Air SdkFlash Player
Apr 29, 2026
Dec 11, 2013
N/A· v4
N/A· v3
9.3 HIGH· v2
Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before 3.9.0.1380, and Adobe AIR SDK &...Show more
Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux, Adobe AIR before 3.9.0.1380, Adobe AIR SDK before 3.9.0.1380, and Adobe AIR SDK & Compiler before 3.9.0.1380 allow remote attackers to execute arbitrary code via crafted .swf content that leverages an unspecified "type confusion," as exploited in the wild in December 2013.Show less
CVE-2013-5059
1Microsoft
2Office Web Apps
Sharepoint Server
Apr 29, 2026
Dec 11, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Microsoft SharePoint Server 2010 SP1 and SP2 and 2013, and Office Web Apps 2013, allows remote attackers to execute arbitrary code via crafted page content, aka "SharePoint Page Content Vulnerabilities."
CVE-2013-6427
1Hp
1Linux Imaging And Printing Project
Apr 29, 2026
Dec 9, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control...Show more
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.Show less
CVE-2013-4376
1X2go
1X2go Server
Apr 29, 2026
Dec 9, 2013
N/A· v4
N/A· v3
7.5 HIGH· v2
The setgid wrapper libx2go-server-db-sqlite3-wrapper.c in X2Go Server before 4.0.0.2 allows remote attackers to execute arbitrary code via unspecified vectors, related to the path to libx2go-server-db-sqlite3-wrapper.pl.
CVE-2013-1349
1Os4ed
1Opensis
Apr 29, 2026
Dec 9, 2013
N/A· v4
N/A· v3
7.5 HIGH· v2
Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter.
CVE-2013-6385
1Drupal
1Drupal
Apr 29, 2026
Dec 7, 2013
N/A· v4
N/A· v3
5.1 MEDIUM· v2
The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger app...Show more
The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via application-specific vectors.Show less
CVE-2013-4479
1Supmua
1Sup
Apr 29, 2026
Dec 7, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
lib/sup/message_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of an email attachment.
CVE-2013-4478
1Supmua
1Sup
Apr 29, 2026
Dec 7, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
CVE-2013-4446
1Steven Jones
1Context
Apr 29, 2026
Dec 7, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The _json_decode function in plugins/context_reaction_block.inc in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal, when using a version of PHP that does not support the json_decode functi...Show more
The _json_decode function in plugins/context_reaction_block.inc in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal, when using a version of PHP that does not support the json_decode function, allows remote attackers to execute arbitrary PHP code via unspecified vectors related to Ajax operations, possibly involving eval injection.Show less
CVE-2013-4212
1Apache
1Roller
Apr 29, 2026
Dec 7, 2013
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle param...Show more
Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka "OGNL Injection."Show less
CVE-2012-6535
1Djvulibre Project
1Djvulibre
Apr 29, 2026
Dec 2, 2013
N/A· v4
N/A· v3
9.3 HIGH· v2
DjVuLibre before 3.5.25.3, as used in Evince, Sumatra PDF Reader, VuDroid, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted DjVu (aka .d...Show more
DjVuLibre before 3.5.25.3, as used in Evince, Sumatra PDF Reader, VuDroid, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted DjVu (aka .djv) file.Show less
CVE-2013-5912
1Thomsonreuters
1Velocity Analytics Vhayu Analytic Server
Apr 29, 2026
Nov 28, 2013
N/A· v4
N/A· v3
10.0 HIGH· v2
VhttpdMgr in Thomson Reuters Velocity Analytics Vhayu Analytic Server 6.94 build 2995 allows remote attackers to execute arbitrary code via a URL in the fileName parameter during an importFile action.
CVE-2013-6866
1Sybase
1Adaptive Server Enterprise
Apr 29, 2026
Nov 23, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vectors, ak...Show more
SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka CR736689.Show less
CVE-2013-6865
1Sybase
1Adaptive Server Enterprise
Apr 29, 2026
Nov 23, 2013
N/A· v4
N/A· v3
9.0 HIGH· v2
SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vect...Show more
SAP Sybase Adaptive Server Enterprise (ASE) 15.0.3 before 15.0.3 ESD#4.3, 15.5 before 15.5 ESD#5.3, and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka CR732989.Show less