CWE-95 · Command and Code Injection
Improper Neutralization of Directives in Dynamically Evaluated Code
218CVEs
4exploited
7with a public check
13likely (EPSS 10%+)
SortMost likely exploited
218 CVEs with CWE-95 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-24893In CISA KEVExploitedXWiki Platform - Remote Code Executionxwiki · xwiki-platform · CVSS 9.8 · 2025-02-20 | 9.8 | 100% | 2025-02-20 |
| CVE-2024-36401In CISA KEVExploitedGeoServer RCE in Evaluating Property Name Expressionsgeoserver · geoserver · CVSS 9.8 · 2024-07-01 | 9.8 | 100% | 2024-07-01 |
| CVE-2026-33017In CISA KEVExploitedLangflow < 1.9.0 - Remote Code Executionlangflow-ai · langflow · CVSS 9.3 · 2026-03-20 | 9.3 | 96% | 2026-03-20 |
| CVE-2023-7101In CISA KEVExploitedArbitrary Code Execution (ACE) VulnerabilityDouglas Wilson · Spreadsheet::ParseExcel · CVSS 7.8 · 2023-12-24 | 7.8 | 19% | 2023-12-24 |
| CVE-2024-21650CheckXWiki < 4.10.20 - Remote code executionxwiki · xwiki-platform · CVSS 10 · 2024-01-08 | 10.0 | 93% | 2024-01-08 |
| CVE-2023-37462CheckXWiki Platform - Remote Code Executionxwiki · xwiki-platform · CVSS 10 · 2023-07-14 | 10.0 | 92% | 2023-07-14 |
| CVE-2024-7954CheckSPIP Porte Plume Plugin - Remote Code ExecutionSPIP · SPIP · CVSS 9.8 · 2024-08-23 | 9.8 | 90% | 2024-08-23 |
| CVE-2024-36404CheckGeoServer and GeoTools - Remote Code Executiongeotools · geotools · CVSS 9.8 · 2024-07-02 | 9.8 | 76% | 2024-07-02 |
| CVE-2026-61511CheckvBulletin 6.x - Remote Code ExecutionvBulletin · vBulletin · CVSS 9.8 · 2026-07-27 | 9.8 | 74% | 2026-07-27 |
| CVE-2024-31982CheckXWiki < 4.10.20 - Remote code executionxwiki · xwiki-platform · CVSS 10 · 2024-04-10 | 10.0 | 35% | 2024-04-10 |
| CVE-2025-0868CheckDocsGPT - Unauthenticated Remote Code ExecutionArc53 · DocsGPT · CVSS 9.3 · 2025-02-20 | 9.3 | 17% | 2025-02-20 |
| CVE-2023-46731Remote code execution through the section parameter in Administration as guest in XWiki Platformxwiki · xwiki-platform · CVSS 10 · 2023-11-06 | 10.0 | 90% | 2023-11-06 |
| CVE-2024-31984XWiki Platform: Remote code execution through space title and Solr space facetxwiki · xwiki-platform · CVSS 10 · 2024-04-10 | 10.0 | 83% | 2024-04-10 |
| CVE-2023-50721XWiki Platform RCE from account through SearchAdminxwiki · xwiki-platform · CVSS 10 · 2023-12-15 | 10.0 | 79% | 2023-12-15 |
| CVE-2023-35150XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation applicationxwiki · xwiki-platform · CVSS 9.9 · 2023-06-23 | 9.9 | 78% | 2023-06-23 |
| CVE-2022-36099XWiki Platform Wiki UI Main Wiki Eval Injection vulnerabilityxwiki · xwiki-platform · CVSS 9.9 · 2022-09-08 | 9.9 | 76% | 2022-09-08 |
| CVE-2023-29509org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityxwiki · xwiki-platform · CVSS 10 · 2023-04-16 | 10.0 | 76% | 2023-04-16 |
| CVE-2024-31465XWiki Platform: Remote code execution from account via SearchSuggestSourceSheetxwiki · xwiki-platform · CVSS 10 · 2024-04-10 | 10.0 | 76% | 2024-04-10 |
| CVE-2023-26477org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityxwiki · xwiki-platform · CVSS 10 · 2023-03-02 | 10.0 | 75% | 2023-03-02 |
| CVE-2022-36100XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injectionxwiki · xwiki-platform · CVSS 9.9 · 2022-09-08 | 9.9 | 74% | 2022-09-08 |
| CVE-2026-0769Langflow eval_custom_component_code Eval Injection Remote Code Execution VulnerabilityLangflow · Langflow · CVSS 9.8 · 2026-01-23 | 9.8 | 41% | 2026-01-23 |
| CVE-2026-1470Authenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.N8n · N8n · CVSS 9.9 · 2026-01-27 | 9.9 | 20% | 2026-01-27 |
| CVE-2026-22666Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()Dolibarr · Dolibarr ERP/CRM · CVSS 7.2 · 2026-04-07 | 7.2 | 16% | 2026-04-07 |
| CVE-2025-54322Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP parameters are also used.Xspeeder · SXZOS · CVSS 10 · 2025-12-27 | 10.0 | 15% | 2025-12-27 |
| CVE-2026-0863Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.N8n · N8n · CVSS 8.5 · 2026-01-18 | 8.5 | 9.3% | 2026-01-18 |
| CVE-2025-64496Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Eventsopen-webui · open-webui · CVSS 7.3 · 2025-11-08 | 7.3 | 7.2% | 2025-11-08 |
| CVE-2013-10051InstantCMS <= 1.6 Remote PHP Code ExecutionInstantCMS · InstantCMS · CVSS 9.3 · 2025-08-01 | 9.3 | 3.7% | 2025-08-01 |
| CVE-2021-33678A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows…SAP SE · SAP NetWeaver AS ABAP (Reconciliation Framework) · CVSS 6.5 · 2021-07-14 | 6.5 | 2.5% | 2021-07-14 |
| CVE-2025-48868Horilla vulnerable to authenticated RCE via eval() in project_bulk_archivehorilla-opensource · horilla · CVSS 7.2 · 2025-09-24 | 7.2 | 2.5% | 2025-09-24 |
| CVE-2013-10070PHP-Charts v1.0 PHP Code ExecutionPHP-Charts · PHP-Charts · CVSS 10 · 2025-08-05 | 10.0 | 2.4% | 2025-08-05 |
| CVE-2019-9507The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to arbitrary remote code executionVertiv · Avocent UMG-4000 · CVSS 8.3 · 2020-03-30 | 8.3 | 2.2% | 2020-03-30 |
| CVE-2024-45846An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a speci…mindsdb · mindsdb · CVSS 8.8 · 2024-09-12 | 8.8 | 2.1% | 2024-09-12 |
| CVE-2024-31996XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code executionxwiki · xwiki-commons · CVSS 10 · 2024-04-10 | 10.0 | 2.1% | 2024-04-10 |
| CVE-2020-6650Arbitrary code execution through “Update Manager” ClassEaton · UPS Companion Software · CVSS 8.3 · 2020-03-23 | 8.3 | 2.1% | 2020-03-23 |
| CVE-2026-39932OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injectionopenemr · openemr · CVSS 9.1 · 2026-08-03 | 9.1 | 2.0% | 2026-08-03 |
| CVE-2020-5256Remote Code Execution Through Image Uploads in BookStackBookStackApp · BookStack · CVSS 7.9 · 2020-03-09 | 7.9 | 2.0% | 2020-03-09 |
| CVE-2023-37909Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheetxwiki · xwiki-platform · CVSS 10 · 2023-10-25 | 10.0 | 1.9% | 2023-10-25 |
| CVE-2020-5217Directive injection when using dynamic overrides with user input in RubyGems secure_headersTwitter · secure_headers · CVSS 4.4 · 2020-01-23 | 4.4 | 1.8% | 2020-01-23 |
| CVE-2026-100741Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServerProgressive Robot Ltd · hMailServer · CVSS 9.8 · 2026-09-27 | 9.8 | 1.7% | 2026-09-27 |
| CVE-2023-50447Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expressi…Python · Pillow · CVSS 8.1 · 2024-01-19 | 8.1 | 1.7% | 2024-01-19 |
| CVE-2026-19626Remote Code ExecutionTenable, Inc. · Security Center · CVSS 9.9 · 2026-08-14 | 9.9 | 1.7% | 2026-08-14 |
| CVE-2026-19295Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcementIBM · Langflow OSS · CVSS 9.9 · 2026-08-28 | 9.9 | 1.6% | 2026-08-28 |
| CVE-2022-36010Arbitrary code execution via function parsing in react-editable-json-treeoxyno-zeta · react-editable-json-tree · CVSS 10 · 2022-08-15 | 10.0 | 1.5% | 2022-08-15 |
| CVE-2025-53837org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issuexwiki · xwiki-rendering · CVSS 9.9 · 2026-09-18 | 9.9 | 1.5% | 2026-09-18 |
| CVE-2026-47391PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool executionMervinPraison · PraisonAI · CVSS 9.8 · 2026-07-21 | 9.8 | 1.5% | 2026-07-21 |
| CVE-2026-64193Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERRORNLNETLABS · Net::DNS · CVSS 9.8 · 2026-07-20 | 9.8 | 1.4% | 2026-07-20 |
| CVE-2026-27493n8n has Unauthenticated Expression Evaluation via Form Noden8n-io · n8n · CVSS 9.5 · 2026-02-25 | 9.5 | 1.4% | 2026-02-25 |
| CVE-2026-47103Python StateMachine 3.0.0 < 3.2.0 RCE via SCXML eval() Injectionfgmacedo · python-statemachine · CVSS 9.8 · 2026-06-17 | 9.8 | 1.4% | 2026-06-17 |
| CVE-2022-41931Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-uixwiki · xwiki-platform · CVSS 9.9 · 2022-11-23 | 9.9 | 1.3% | 2022-11-23 |
| CVE-2026-44939Command injection through unsanitized YAML parameter in RancherSUSE · Rancher · CVSS 9.4 · 2026-06-19 | 9.4 | 1.3% | 2026-06-19 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.