CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- dataease DataEase SVG StaticResourceServer.java StaticResourceServer.validateSvgContent cross site scripting 5.3 Medium
- red hat build of keycloak, single sign-on 7 +1 more Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import 9.1 Critical
- wpvibes dynific addons for elementor (formerly anywhere elementor) Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer 6.5 Medium
- expresstech quiz and survey master (qsm) – quiz maker & survey maker Quiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter 6.5 Medium
- unknown fiber admin Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header 9.0 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.9 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.9 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 3.3 Low
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.5 High
- printcart store – web to print product designer for woocommerce Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter 9.8 Critical
- jupyterlab jupyterlab-desktop JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL 9.4 Critical
- jupyterlab jupyterlab-desktop JupyterLab Desktop: TCC Bypass via Misconfigured Node Fuses 5.5 Medium
- openbmb internet of agents OpenBMB Internet of Agents Code Executor Tool code_executor.py execute_code code injection 6.9 Medium
- mohammed kaludi amp for wp – accelerated mobile pages AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info 5.4 Medium
- wahid0003 product feed manager for woocommerce – ctx feed – support 220+ shopping, ai & social channels Product Feed Manager for WooCommerce <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2' Parameter 7.2 High
- unknown static snapshot Static Snapshot <= 0.2.1 - Unauthenticated RCE via 'name' Parameter 9.8 Critical
- signalwire freeswitch FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia 8.8 High
- suitecrm SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection 9.4 Critical
- tinyhumansai openhuman OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec` 9.0 Critical
- apache software foundation ofbiz Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading No score
- apache software foundation ofbiz Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE 8.8 High
- apache software foundation ofbiz Apache OFBiz: Unauthenticated RCE via login-page widget injection 9.8 Critical
- eosphoros-ai db-gpt eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection 6.9 Medium
- sourcecodester online food ordering system SourceCodester Online Food Ordering System Category Management add_category.php cross site scripting 4.8 Medium
- npc-worldwide npcpy NPC-Worldwide npcpy sft.py load_sft_model code injection 5.3 Medium
- empiresoft empirecms EmpireSoft EmpireCMS index.php cross site scripting 5.1 Medium
- infiniflow ragflow InfiniFlow RAGFlow Images API file_utils.py cross site scripting 5.1 Medium
- perforce puppet enterprise Report Deserialization Code Execution 9.4 Critical
- stanfordnlp stanza Stanza: RCE via pickle deserialization in the lemmatizer 7.8 High
- koxudaxi fastapi-code-generator fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator 9.3 Critical
- koxudaxi fastapi-code-generator fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict 9.3 Critical
- koxudaxi fastapi-code-generator fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring 9.3 Critical
- enspirit elo Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter 9.8 Critical
- enspirit elo Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels 9.8 Critical
- enspirit elo Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields 7.4 High
- ziroom zhome a0101 Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection 9.4 Critical
- azuracast AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone 8.7 High
- welcart e-commerce plugin Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting 5.3 Medium
- clavaque s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptions s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter 9.8 Critical
- avaya system manager CVE-2026-16306 9.8 Critical
- regularlabs.com articles anywhere extension for joomla, sourcerer free extension for joomla, sourcerer pro extension for joomla +2 more Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 8.9 High
- php-web-design.com stageit extension for joomla Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5 8.6 High
- dayrui xunruicms dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection 6.9 Medium
- dayrui xunruicms dayrui XunRuiCMS Email Template Rendering Notice.php _get_tpl_content code injection 6.9 Medium
- mathurvishal cloudclassroom-php-project mathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scripting 5.3 Medium
- mathurvishal cloudclassroom-php-project mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php cross site scripting 5.3 Medium
- beecue fastbee beecue FastBee Groovy Script Executor script code injection 5.1 Medium
- ruijie rg-es205gc, rg-es206gc-p, rg-es208gc +2 more +4 more Ruijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scripting 4.8 Medium
- prefecthq prefab-ui Prefab UI Pyodide sandbox escape to host RCE 10.0 Critical
- typemill Typemill SvgSanitizer.php saveImage cross site scripting 5.1 Medium
- Show olderLoading…