CWE-94 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-94 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 실제 악용이 확인됨CVE-2015-1635HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows…100.0%심각9.8● 실제 악용이 확인됨CVE-2017-9841Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to exe…100.0%심각9.8● 랜섬웨어 캠페인에 사용됨CVE-2022-22954VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due t…100.0%심각9.8● 랜섬웨어 캠페인에 사용됨CVE-2025-49704Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an a…100.0%높음8.8● 랜섬웨어 캠페인에 사용됨CVE-2025-3248Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endp…100.0%심각9.8● 실제 악용이 확인됨CVE-2021-22204Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows…100.0%높음7.8● 랜섬웨어 캠페인에 사용됨CVE-2012-0158The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in…100.0%높음8.8● 실제 악용이 확인됨CVE-2025-24893XWiki Platform is a generic wiki platform offering runtime services for applications built on top of…100.0%심각9.8
전체 목록
120건
CVE-2022-22963악용 확인In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionalit…99.9%심각9.8
CVE-2022-24816악용 확인JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing …99.9%심각10.0
CVE-2024-36401악용 확인GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22…99.8%심각9.8
CVE-2025-32432악용 확인Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting…99.8%심각10.0
CVE-2021-22205랜섬웨어 악용An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properl…99.7%심각10.0
CVE-2019-16759악용 확인vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/re…99.7%심각9.8
CVE-2022-22965악용 확인A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) …99.6%심각9.8
CVE-2024-4040악용 확인A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all pla…99.5%심각10.0
CVE-2024-23692랜섬웨어 악용Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerabilit…99.5%심각9.8
CVE-2017-7494랜섬웨어 악용Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerabi…99.4%심각9.8
CVE-2014-6287악용 확인The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x bef…99.3%심각9.8
CVE-2018-7602랜섬웨어 악용A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentiall…99.2%심각9.8
CVE-2021-44529랜섬웨어 악용A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user…99.1%심각9.8
CVE-2022-3236악용 확인A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sop…98.9%심각9.8
CVE-2008-4250악용 확인The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1,…98.8%심각9.8
CVE-2026-1281악용 확인A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code e…98.7%심각9.8
CVE-2026-1340악용 확인A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code e…98.6%심각9.8
CVE-2026-34197악용 확인Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache A…98.3%높음8.8
CVE-2022-22947악용 확인In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection …98.3%심각10.0
CVE-2021-39144악용 확인XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerabilit…98.1%높음8.5
CVE-2023-25717악용 확인Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as de…98.1%심각9.8
CVE-2022-43769악용 확인Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow…97.7%높음7.2
CVE-2024-56145악용 확인Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of…97.5%심각9.3
CVE-2019-9082악용 확인ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution v…97.4%높음8.8
CVE-2018-1273랜섬웨어 악용Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain …97.0%심각9.8
CVE-2023-33246악용 확인For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. …96.6%심각9.8
CVE-2009-1151악용 확인Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 a…96.6%심각9.8
CVE-2025-54068악용 확인Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability all…96.3%심각9.2
CVE-2026-33017악용 확인Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the…96.2%심각9.3
CVE-2019-7609악용 확인Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. A…95.3%심각10.0
CVE-2017-9822랜섬웨어 악용DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible rem…94.8%높음8.8
CVE-2020-8243악용 확인A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacke…90.8%높음7.2
CVE-2017-8759악용 확인Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code r…88.7%높음7.8
CVE-2025-4428악용 확인Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified pla…88.0%높음8.8
CVE-2019-4716악용 확인IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthent…86.4%심각9.8
CVE-2013-3906악용 확인GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Offi…84.9%높음7.8
CVE-2019-10758악용 확인mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method…84.7%심각9.9
CVE-2019-0193악용 확인In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other…83.5%높음7.2
CVE-2023-22952악용 확인In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates…80.1%높음8.8
CVE-2025-6204악용 확인An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release …79.6%높음8.0
CVE-2013-4810악용 확인HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application …79.5%심각9.8
CVE-2012-0391악용 확인The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressio…75.6%심각9.8
CVE-2018-14667악용 확인The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserReso…74.2%심각9.8
CVE-2012-1535악용 확인Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.20…70.4%높음7.8
CVE-2009-0556악용 확인Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac,…67.3%높음8.8
CVE-2025-62593악용 확인Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be…60.2%심각9.4
CVE-2014-4148악용 확인win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server …59.9%높음8.8
CVE-2009-0557악용 확인Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in…52.8%높음7.8
CVE-2009-0238악용 확인Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewe…42.9%높음8.8
CVE-2021-22894악용 확인A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated a…41.3%높음8.8
CVE-2020-8218악용 확인A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI …32.3%높음7.2
CVE-2026-9198악용 확인IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPE…28.7%심각9.8
CVE-2026-60004악용 확인Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.24.0%심각9.8
CVE-2025-23209악용 확인Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is …21.6%높음8.1
CVE-2025-67038악용 확인An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write …20.3%심각9.8
CVE-2023-7101악용 확인Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is…19.0%높음7.8
CVE-2024-20359악용 확인A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that ha…18.8%보통6.0
CVE-2021-22900악용 확인A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead …14.1%높음7.2
CVE-2026-15410랜섬웨어 악용Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identifie…11.8%높음7.2
CVE-2022-41223랜섬웨어 악용The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated at…10.7%보통6.8
CVE-2026-65660악용 확인Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized …8.2%높음8.8
CVE-2026-20045악용 확인A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Ses…4.5%심각9.8
CVE-2023-41179악용 확인A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), W…4.2%높음7.2
CVE-2023-6548악용 확인Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an att…3.2%높음8.8
CVE-2026-3910악용 확인Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execut…2.7%높음8.8
CVE-2023-29492악용 확인Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of…2.7%심각9.8
CVE-2026-0322악용 확인A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software…1.7%높음8.6
CVE-2026-72530악용 확인A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to …1.7%심각9.5
CVE-2025-1976악용 확인Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin priv…0.7%높음8.6
CVE-2026-93674IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper …2.7%심각9.8
CVE-2026-69806Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate pr…1.8%높음7.0
CVE-2026-86596The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including,…1.5%심각9.8
CVE-2026-45140Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticate…1.3%심각9.8
CVE-2026-97160Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.…1.3%심각9.4
CVE-2026-89275Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulne…1.2%심각10.0
CVE-2026-84412Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulne…1.2%심각10.0
CVE-2026-75699Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulne…1.2%심각10.0
CVE-2026-73369Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulne…1.2%심각10.0
CVE-2026-75721Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulne…1.2%심각10.0
CVE-2026-75703Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulne…1.2%심각10.0
CVE-2026-58400GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2…1.2%심각9.1
CVE-2026-106624ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that coul…1.0%심각10.0
CVE-2026-19804The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscripti…1.0%높음8.8
CVE-2026-94169Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows …1.0%심각10.0
CVE-2026-51990An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute …1.0%심각9.8
CVE-2026-57131PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jo…1.0%심각9.8
CVE-2026-90817An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Im…1.0%심각9.8
CVE-2026-105796Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentat…0.9%높음8.8
CVE-2026-102863Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized …0.9%높음8.8
CVE-2026-107329IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code du…0.9%높음8.8
CVE-2026-107328IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code du…0.9%높음8.8
CVE-2026-61552Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API w…0.9%높음7.2
CVE-2026-78463Improper control of generation of code ('code injection') in Remote Desktop Client allows an unauthorized atta…0.9%높음8.8
CVE-2026-85978An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platf…0.9%심각10.0
CVE-2026-88404A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/scr…0.9%심각9.8
CVE-2026-103572Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Serv…0.8%높음8.8
CVE-2026-82531Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_h…0.8%심각9.2
CVE-2026-110193IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated accoun…0.8%높음8.8
CVE-2026-120338Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, …0.8%심각10.0
CVE-2026-53710MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the…0.8%심각10.0
CVE-2026-88962IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code du…0.8%높음8.8
CVE-2026-84738The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its…0.8%심각9.1
CVE-2026-55107Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of …0.8%심각10.0
CVE-2026-83627The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Re…0.8%심각9.8
CVE-2026-104339IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper …0.7%심각9.8
CVE-2026-61991Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.0.7%심각10.0
CVE-2026-83531Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in…0.8%높음8.8
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.