CWE-829 Inclusion of Functionality from Untrusted Control Sphere
baseThe product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (458)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-0770US | —OT kritisch | KEV | ||
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… | ||||
| CVE-2025-32463US | high7.8OT kritisch | KEV | ||
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. | ||||
| CVE-2023-48022US | critical9.8OT hoch | Exploit | ||
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ra… | ||||
| CVE-2018-17246US | critical9.8 | Exploit | ||
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that… | ||||
| CVE-1999-0661US | high10.0 | Exploit | ||
A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as (1) TCP Wrappers 7.6, (2) util-linux 2.9g, (3) wuarchive… | ||||
| CVE-2024-38476US | critical9.8 | Exploit | ||
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response head… | ||||
| CVE-2018-7422US | high7.5 | Exploit | ||
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor… | ||||
| CVE-2020-16152US | critical9.8 | Exploit | ||
The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user vi… | ||||
| CVE-2024-5762US | high8.1 | — | ||
Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installation… | ||||
| CVE-2023-2249US | high8.8 | — | ||
The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. This is du… | ||||
| CVE-2004-0285US | critical9.8 | Exploit | ||
PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyGuests allow remote attackers to execute arbitrary PHP code v… | ||||
| CVE-2004-0030US | critical9.8 | Exploit | ||
PHP remote file inclusion vulnerability in (1) functions.php, (2) authentication_index.php, and (3) config_gedcom.php for PHPGEDVIEW 2.61 allows remote attackers to execute arbitra… | ||||
| CVE-2025-54135US | critical9.8 | Exploit | ||
Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it… | ||||
| CVE-2024-38537US | critical9.8 | Exploit | ||
Fides is an open-source privacy engineering platform. `fides.js`, a client-side script used to interact with the consent management features of Fides, used the `polyfill.io` domain… | ||||
| CVE-2021-44223US | critical9.8OT hoch | — | ||
WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress… | ||||
| CVE-2008-1319US | high9.3 | Exploit | ||
Untrusted search path and argument injection vulnerability in the VersantD service in Versant Object Database 7.0.1.3 and earlier, as used in Borland CaliberRM and probably other p… | ||||
| CVE-2018-18387US | high8.8 | Exploit | ||
playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse. | ||||
| CVE-2017-14095US | high8.1 | Exploit | ||
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a local file inclusion on… | ||||
| CVE-2026-58116US | high8.8 | Exploit | ||
LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model p… | ||||
| CVE-2026-33075US | high8.8OT hoch | Exploit | ||
FastGPT is an AI Agent building platform. In versions 4.14.8.3 and below, the fastgpt-preview-image.yml workflow is vulnerable to arbitrary code execution and secret exfiltration b… | ||||
04
Angriffsmuster (13)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan