Advisories · Weakness
CWE-914.
Every Advisory and CVE whose sources give the weakness CWE-914, newest first.
- CVSS 7.3 High
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution
- Insecure deserialization
- CWE-914
- CVSS 9.1 CriticalCritical · CVSS 9+
toui allows user-specific variables to be shared between users
- CWE-914
>=2.0.1, <2.4.1 · fixed in 2.4.1
GHSA-hh7j-pg39-q563 · CVE-2023-33175 - CVSS 10.0 CriticalCritical · CVSS 9+
vm2 has a Sandbox Escape Vulnerability
- Code injection
- CWE-914
<3.11.0 · fixed in 3.11.0
GHSA-qcp4-v2jj-fjx8 · CVE-2026-44006 - CVSS 7.9 High
Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr
- Broken access control
- CWE-693
<=2.6 · no fixed version yet
GHSA-69v7-xpr6-6gjm · CVE-2026-34444 - CVSS 6.5 Medium
Chyrp Lite has an IDOR via Mass Assignment in Post Model
- xenocrat chyrp-lite
- Broken access control
- CWE-914
- CVSS 5.3 Medium
youlaitech youlai-mall orders improper control of dynamically-identified variables
- youlaitech youlai-mall
- CWE-913
- CWE-914
- CVSS 5.3 Medium
youlaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variables
- youlaitech youlai-mall
- CWE-913
- CWE-914
- CVSS 8.5 High
Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
- SAP_SE SAP NetWeaver Application Server ABAP
- CWE-914
- CVSS 8.0 High
Authenticated Gaia users can inject code or commands by global variables through special HTTP requests.
- checkpoint ClusterXL, Multi-Domain Security Management, Quantum Appliances, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Security Management
- CWE-914