CWE-94

{
  "affected": [],
  "aliases": [
    "CVE-2010-4410"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-12-06T20:13:00Z",
    "severity": "MODERATE"
  },
  "details": "CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172.",
  "id": "GHSA-63qf-cwcv-ff3r",
  "modified": "2022-05-17T03:23:45Z",
  "published": "2022-05-17T03:23:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4410"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=658970"
    },
    {
      "type": "WEB",
      "url": "http://cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes"
    },
    {
      "type": "WEB",
      "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10705"
    },
    {
      "type": "WEB",
      "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10735"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053576.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053591.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html"
    },
    {
      "type": "WEB",
      "url": "http://openwall.com/lists/oss-security/2010/12/01/1"
    },
    {
      "type": "WEB",
      "url": "http://openwall.com/lists/oss-security/2010/12/01/2"
    },
    {
      "type": "WEB",
      "url": "http://openwall.com/lists/oss-security/2010/12/01/3"
    },
    {
      "type": "WEB",
      "url": "http://perl5.git.perl.org/perl.git/blobdiff/a0b94c2432b1d8c20653453a0f6970cb10f59aec..84601d63a7e34958da47dad1e61e27cb3bd467d1:/cpan/CGI/lib/CGI.pm"
    },
    {
      "type": "WEB",
      "url": "http://perl5.git.perl.org/perl.git/commit/84601d63a7e34958da47dad1e61e27cb3bd467d1"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/43068"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/43147"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:237"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:252"
    },
    {
      "type": "WEB",
      "url": "http://www.nntp.perl.org/group/perl.perl5.changes/2010/11/msg28043.html"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2011-1797.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/44199"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/45145"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2010/3230"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2011/0212"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2011/0249"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-12120"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-20T17:15:48Z",
    "severity": "HIGH"
  },
  "details": "Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the user for confirmation. The .lite_project.lua file is intended for project-specific configuration but can contain executable Lua logic. This behavior could allow execution of untrusted Lua code if a user opens a malicious project, potentially leading to arbitrary code execution with the privileges of the Lite XL process.",
  "id": "GHSA-63qf-frrc-rvqp",
  "modified": "2025-11-20T21:30:32Z",
  "published": "2025-11-20T18:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12120"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lite-xl/lite-xl/pull/2164"
    },
    {
      "type": "WEB",
      "url": "https://kb.cert.org/vuls/id/579478"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2013-4957"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-10-25T23:55:00Z",
    "severity": "MODERATE"
  },
  "details": "The dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML code via a crafted report-specific type.",
  "id": "GHSA-63rf-cwpf-vw2p",
  "modified": "2022-05-14T00:56:49Z",
  "published": "2022-05-14T00:56:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4957"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/88089"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/98639"
    },
    {
      "type": "WEB",
      "url": "http://puppetlabs.com/security/cve/cve-2013-4957"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/55362"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2010-2562"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-08-11T18:47:00Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Office Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Excel file, aka \"Excel Memory Corruption Vulnerability.\"",
  "id": "GHSA-63rq-3xg5-w7p2",
  "modified": "2022-05-14T02:36:46Z",
  "published": "2022-05-14T02:36:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2562"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-057"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12088"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-222A.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-1753"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-08-20T21:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple IBM Rational products are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim\u0027s Web browser within the security context of the hosting site. IBM X-Force ID: 135655.",
  "id": "GHSA-63x7-3c6x-c3hw",
  "modified": "2022-05-13T01:37:01Z",
  "published": "2022-05-13T01:37:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1753"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/135655"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/docview.wss?uid=ibm10713739"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-10958"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-10T13:15:03Z",
    "severity": "HIGH"
  },
  "details": "The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, 8.8.08.007 . This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.",
  "id": "GHSA-6422-rq87-298q",
  "modified": "2024-11-10T15:30:47Z",
  "published": "2024-11-10T15:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10958"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wp-photo-album-plus/tags/8.8.08.004/wppa-ajax.php#L1238"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3184852"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/wp-photo-album-plus/#developers"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53bb0871-343a-4299-9902-682c422152d1?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-6230"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-04-14T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the application and lead to Code Injection. An attacker could thereby control the behavior of the application.",
  "id": "GHSA-6428-3gjw-r4ph",
  "modified": "2022-05-24T17:14:16Z",
  "published": "2022-05-24T17:14:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6230"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/2900118"
    },
    {
      "type": "WEB",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-36014"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-10T00:15:08Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
  "id": "GHSA-6436-83pc-5gxw",
  "modified": "2023-11-10T00:30:27Z",
  "published": "2023-11-10T00:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36014"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36014"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "i18nextify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41692"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-22T17:42:24Z",
    "nvd_published_at": "2026-05-07T21:16:29Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nVersions of `i18nextify` prior to 4.0.8 substitute `{{key}}` interpolation tokens inside `src` and `href` attribute values with the raw string returned by `i18next.t()`. The substitution logic in `src/localize.js` (`replaceInside` handler around line 122) only guards against a duplicated `http://` origin prefix \u2014 it does not validate the URL scheme of the substituted value. A translated value such as `javascript:alert(1)` or `data:text/html,\u003cscript\u003e...\u003c/script\u003e` is applied unchanged to the live DOM attribute.\n\n### Impact\n\nWhen an attacker can influence the content of a translation file or the translation-backend response \u2014 compromised translation CDN, user-contributed locales, MITM on a plain-HTTP backend, write access to the translation JSON \u2014 they can:\n\n- Set any `href` on an anchor to a `javascript:` URI, executing arbitrary JavaScript when the victim clicks the link.\n- Set any `src` on `\u003ciframe\u003e`, `\u003cobject\u003e`, or `\u003cembed\u003e` to a `data:text/html` URI containing a full script payload that runs in the page\u0027s origin.\n- Use `vbscript:` on legacy IE installations or `file:` for local-resource navigation attacks.\n\nThis path is distinct from the general i18nextify design that intentionally renders HTML from translations \u2014 href/src schemes are narrow and attack-specific, and no legitimate translation needs `javascript:` or `data:`. The fix therefore blocks these schemes outright without changing other behaviour.\n\n### Also fixed in 4.0.8\n\n- **`debug` / `saveMissing` URL-parameter substring match.** The previous detection `window.location.search.indexOf(\u0027debug=true\u0027) \u003e -1` matched the substring anywhere in the query string. A URL like `?nosaveMissing=true` silently enabled `saveMissing` mode, causing the victim\u0027s browser to POST every unknown translation key to the configured `addPath` \u2014 a form of CSRF-style abuse of missing-key reporting. `?track_debug=true` enabled verbose debug logging, leaking i18next internals to the console. Now uses `URLSearchParams` for exact parameter matching.\n- **Optional `sanitize(html, ctx)` hook.** The library\u0027s core purpose is to render HTML from translations \u2014 a behaviour that is safe only when the translation source is fully trusted. Applications with partially-trusted sources (user-contributed locales, third-party CDN, MITM-exposed HTTP backend) can now wire a sanitizer (e.g. DOMPurify) via `i18next.options.sanitize`. Defaults to pass-through to preserve existing behaviour for the main use case.\n\n### Affected versions\n\nAll versions of `i18nextify` prior to **4.0.8**.\n\n### Patch\n\nFixed in **4.0.8**. The URL-scheme blocklist is `^\\s*(javascript|data|vbscript|file)\\s*:` (case-insensitive) applied to each translated value before it is joined back into the `href`/`src` attribute. Values matching the blocklist are replaced with an empty string so the attribute becomes harmless rather than leaving the attacker\u0027s URL in place.\n\n### Workarounds\n\nNo workaround short of upgrading. If you cannot upgrade immediately, audit every translation file for `javascript:`, `data:`, `vbscript:`, and `file:` prefixes in any value that may reach an `href`/`src` position, and restrict translation-file write access to trusted operators. Serving translations over HTTPS and pinning the translation backend to an internal origin reduce the MITM surface.\n\n### Credits\n\nDiscovered via an internal security audit of the i18next ecosystem.",
  "id": "GHSA-6457-mxpq-4fqq",
  "modified": "2026-05-11T13:29:23Z",
  "published": "2026-04-22T17:42:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41692"
    },
    {
      "type": "WEB",
      "url": "https://github.com/i18next/i18nextify/commit/16f23dbcdcf893673587f7a03355bf7ce0a0e49e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/i18next/i18nextify"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes"
}

{
  "affected": [],
  "aliases": [
    "CVE-2007-0854"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-02-08T18:28:00Z",
    "severity": "HIGH"
  },
  "details": "Remote file inclusion vulnerability in scripts2/objcache in cPanel WebHost Manager (WHM) allows remote attackers to execute arbitrary code via a URL in the obj parameter.  NOTE: a third party claims that this issue is not file inclusion because the contents are not parsed, but the attack can be used to overwrite files in /var/cpanel/objcache or provide unexpected web page contents.",
  "id": "GHSA-64c8-jxwr-fxq6",
  "modified": "2022-05-01T17:47:35Z",
  "published": "2022-05-01T17:47:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-0854"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32400"
    },
    {
      "type": "WEB",
      "url": "http://changelog.cpanel.net/index.cgi"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/32043"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/33240"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/35750"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/24097"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/459409/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/459449/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/22455"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2007/0545"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}