CWE-94

{
  "affected": [],
  "aliases": [
    "CVE-2015-0093"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-03-11T10:59:00Z",
    "severity": "HIGH"
  },
  "details": "Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka \"Adobe Font Driver Remote Code Execution Vulnerability,\" a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0091, and CVE-2015-0092.",
  "id": "GHSA-7p87-g4q8-442j",
  "modified": "2022-05-14T01:03:08Z",
  "published": "2022-05-14T01:03:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0093"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-021"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/72907"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1031889"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.9.2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "nltk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-14009"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-19T20:27:43Z",
    "nvd_published_at": "2026-02-18T18:24:19Z",
    "severity": "CRITICAL"
  },
  "details": "A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assumes all downloaded packages are trusted and extracts them without validation. If a malicious package contains Python files, such as __init__.py, these files are executed automatically upon import, leading to remote code execution. This issue can result in full system compromise, including file system access, network access, and potential persistence mechanisms.",
  "id": "GHSA-7p94-766c-hgjp",
  "modified": "2026-06-06T14:46:18Z",
  "published": "2026-02-18T18:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14009"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/pull/3468"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/commit/1056b323af6462455571302e766b67cf300aea18"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nltk/nltk"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/blob/4154eb85e832f266660a09286c7e37e308292284/ChangeLog#L1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-96.yaml"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/49ecbc02-054e-4470-b2e0-b267936cc4e4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "NLTK has a Zip Slip Vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-21574"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-12T09:15:06Z",
    "severity": "CRITICAL"
  },
  "details": "The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or URL, resulting in remote code execution (RCE) on the server.",
  "id": "GHSA-7p9r-9x76-5h9r",
  "modified": "2024-12-12T09:31:36Z",
  "published": "2024-12-12T09:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21574"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ltdrdata/ComfyUI-Manager/commit/ffc095a3e5acc1c404773a0510e6d055a6a72b0e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ltdrdata/ComfyUI-Manager/blob/ffc095a3e5acc1c404773a0510e6d055a6a72b0e/glob/manager_server.py#L798"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-45200"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-30T08:15:03Z",
    "severity": "MODERATE"
  },
  "details": "In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to exploit a stack-based buffer overflow upon deserialization of session information via a malformed browse-reply packet, aka KartLANPwn. The victim is not required to join a game session with an attacker. The victim must open the \"Wireless Play\" (or \"LAN Play\") menu from the game\u0027s title screen, and an attacker nearby (LDN) or on the same LAN network as the victim can send a crafted reply packet to the victim\u0027s console. This enables a remote attacker to obtain complete denial-of-service on the game\u0027s process, or potentially, remote code execution on the victim\u0027s console. The issue is caused by incorrect use of the Nintendo Pia library,",
  "id": "GHSA-7p9w-p89x-5ghq",
  "modified": "2024-09-30T21:02:12Z",
  "published": "2024-09-30T09:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45200"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2611669"
    },
    {
      "type": "WEB",
      "url": "https://github.com/latte-soft/kartlanpwn"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-7235"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-10-07T14:55:00Z",
    "severity": "HIGH"
  },
  "details": "htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function, as exploited in the wild in September 2014.",
  "id": "GHSA-7pc8-wp58-mr3p",
  "modified": "2025-04-12T12:39:23Z",
  "published": "2022-05-13T01:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7235"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FreePBX/fw_ari/commit/f294b4580ce725ca3c5e692d86e63d40cef4d836"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96790"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/41005"
    },
    {
      "type": "WEB",
      "url": "http://community.freepbx.org/t/critical-freepbx-rce-vulnerability-all-versions-cve-2014-7235/24536"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/128516/FreePBX-Authentication-Bypass-Account-Creation.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/61601"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/70188"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.10"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.7"
            },
            {
              "fixed": "2.0.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-69088"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-470",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T17:16:39Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nGrav CMS\u0027s blueprint dynamic-field callable guard can be bypassed with a fully-qualified `Class::method` string, letting an account with only page-editing rights (`admin.pages`, not super-admin) plant a directive in a page\u0027s form-field frontmatter that invokes an arbitrary public static PHP method with attacker-controlled arguments. Using built-in gadget methods this yields, at minimum, arbitrary reading of any server-readable file (disclosed to anonymous visitors of the crafted page) and arbitrary creation/copying of files and directories under the web-server account.\n\n### Details\n`Blueprint::isSafeDynamicCall()` (`system/src/Grav/Common/Data/Blueprint.php`, method around line 488) is meant to block dangerous callables named in a blueprint\u0027s dynamic-field directives (`data-*@`). It only consults its dangerous-name denylist when the callable string does **not** contain `::`:\n```php\nif (is_string($function) \u0026\u0026 !str_contains($function, \u0027::\u0027) \u0026\u0026 Utils::isDangerousFunction($function)) {\n    return false;\n}\n```\nAny callable string containing `::` \u2014 i.e. every `Class::method` static call \u2014 skips the check entirely and is passed to `call_user_func_array()` at `Blueprint::dynamicData()` (`Blueprint.php`, around line 461) and `FlexDirectory::dynamicDataField()` (`system/src/Grav/Framework/Flex/FlexDirectory.php`, around line 937). There is no allowlist restricting which classes or methods may be invoked this way; only the call\u0027s *arguments* are (separately) scanned for smuggled dangerous callables, never the target itself.\n\n`Utils::isDangerousFunction()` (`system/src/Grav/Common/Utils.php`) classifies any string containing a colon (`str_contains($name, \":\")`) or a namespace backslash as dangerous \u2014 so a qualified `Class::method` string would be rejected *if* it ever reached this function. The `!str_contains($function, \u0027::\u0027)` condition in `isSafeDynamicCall()` ensures it never does, which is what leaves qualified static calls entirely unscreened. (Whether the exemption was intended to admit legitimate `Class::method` option-providers is a plausible reading of the surrounding code, but the intent is not established here.)\n\nThis is an incomplete fix of two recently published advisories \u2014 one addressing page editors executing hidden callables via form-field settings, the other extending the same guard to Flex directories. The guard those fixes introduced never covered qualified static calls. Grav\u0027s own permission model separates page-content code execution into a distinct, higher privilege (`admin.pages_twig`) from plain page editing (`admin.pages`), so invoking arbitrary methods from an `admin.pages`-authored page is a genuine trust-boundary bypass, not editor capability by design.\n\n### PoC\nTested on Grav `develop` at commit `db8c1fc` (which self-reports version 2.0.11) with the admin and form plugins, using an account granted only `admin.login` + `admin.pages` (page editor, not super-admin). The same guard is present in every current release from 2.0.7 through 2.0.10. Base URL shown as `https://grav.example`.\n\n**A. Arbitrary file read (confidentiality)**\n\n1. Log in to `/admin` as the page-editor account (GET `/admin` for the login nonce, then POST `task=login`).\n2. Save a page via the standard admin endpoint, `POST /admin/pages/\u003croute\u003e` with the session cookie, the admin nonce, and `data[frontmatter]` containing a form field with a `download` gadget directive:\n    ```yaml\n    forms:\n      x:\n        fields:\n          y:\n            type: text\n            data-opts@:\n              - \u0027Grav\\Common\\Utils::download\u0027\n              - \u0027/etc/passwd\u0027\n              - false\n              - 0\n              - 1024\n              - mime: \u0027text/plain\u0027\n    ```\n   The server returns `HTTP 200` and accepts the save \u2014 the `data-opts@` directive is not rejected.\n3. As an unauthenticated visitor (no cookies), request the saved page, e.g. `GET /\u003croute\u003e` (use a fresh query string to avoid a cached copy; immediately after saving, a first request may `404` while the flat-file page index catches up \u2014 retry moments later). The response is `HTTP 200` with the raw contents of `/etc/passwd` in the body (`root:x:0:0:...`). Pointing the path at `user/accounts/\u003cname\u003e.yaml` instead returns that account file, including its `hashed_password:` bcrypt line \u2014 i.e. an anonymous visitor obtains a stored administrator\u0027s password hash.\n\n**B. Arbitrary file/directory write (integrity) \u2014 verified**\n\nUsing the same mechanism with `Grav\\Common\\Filesystem\\Folder::copy` (a public static method taking source and destination paths), a page editor caused the server to copy an existing page directory to an attacker-chosen new path under `user/pages/`; the newly created page then rendered its (attacker-controlled) content at the new route over plain HTTP. This demonstrates attacker-controlled creation of files/directories anywhere the web-server account can write. `Folder::move` and `Folder::delete` are equally reachable (their destructive nature was not exercised).\n\n### Impact\nA page editor (an `admin.pages`-only account, **not** super-admin) can, through a page they author:\n\n- **Read any server-readable file**, disclosed to any anonymous, unauthenticated visitor of the crafted page \u2014 including `user/accounts/*.yaml`, which stores account metadata and bcrypt password hashes. An attacker may attempt offline cracking of a disclosed hash; recovery of a weak or reused administrator password could lead to full admin-panel compromise. Other secrets on disk (site/plugin config, environment files) are equally exposed.\n- **Create or overwrite files and directories** under the web-server account (demonstrated via `Folder::copy`), with `Folder::move`/`Folder::delete` additionally reachable for destructive tampering.\n\nBecause the guard permits *any* public static method, the reachable impact is bounded only by the gadget surface of the loaded codebase, not by this report\u0027s demonstrated cases.",
  "id": "GHSA-7pgq-cr25-xvc8",
  "modified": "2026-09-17T17:16:39Z",
  "published": "2026-09-17T17:16:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-7pgq-cr25-xvc8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69088"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-cms-through-arbitrary-method-invocation-via-blueprint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure"
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-1789"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-03-22T12:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "IBM Tivoli Monitoring V6 6.2.3 and 6.3.0 could allow an unauthenticated user to remotely execute code through unspecified methods. IBM X-Force ID: 137034.",
  "id": "GHSA-7phg-9j65-8vgw",
  "modified": "2022-05-13T01:36:58Z",
  "published": "2022-05-13T01:36:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1789"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/137034"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg22014096"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-22395"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-25T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "There is a code injection vulnerability in smartphones. Successful exploitation of this vulnerability may affect service confidentiality.",
  "id": "GHSA-7php-xvw9-j4qp",
  "modified": "2022-03-08T00:00:40Z",
  "published": "2022-02-26T00:00:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22395"
    },
    {
      "type": "WEB",
      "url": "https://consumer.huawei.com/en/support/bulletin/2021/7"
    },
    {
      "type": "WEB",
      "url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202108-0000001181125881"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-5366"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-20T17:16:26Z",
    "severity": "CRITICAL"
  },
  "details": "Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as `--upload-pack`, enabling execution of external programs. Additionally, the `directories` parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.",
  "id": "GHSA-7pm4-56h2-5rxr",
  "modified": "2026-06-20T18:31:29Z",
  "published": "2026-06-20T18:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5366"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/e2e88a0f-a8f6-49c9-94c5-e98dc385f07a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-46639"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-23T20:15:05Z",
    "severity": "HIGH"
  },
  "details": "A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box.",
  "id": "GHSA-7pp5-7gq3-2q5p",
  "modified": "2024-09-23T21:30:47Z",
  "published": "2024-09-23T21:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46639"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/0xashfaq/45c3f300d125468161c3fa6e38576769"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xashfaq/-HelpDeskZ-v2.0.2---Stored-Cross-Site-Scripting-XSS-"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}