CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- chancmsA template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows...9.8 Critical
- aqara camera hub g3 firmware, hub m2 firmware, hub m3 firmware +2 moreAqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025...9.8 Critical
- neuron-ai neuron, neuron-core neuron-ai +1 moreMySQLSelectTool Read-Only Bypass via SELECT INTO OUTFILE Allows Arbitrary File Write8.2 High
- elysiajs elysiaElysia affected by arbitrary code injection through cookie config7.5 High
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution5.4 Medium
- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.13.1 - Arbitrary Shortocde Execution vulnerability6.5 Medium
- mozilla firefox, thunderbird +1 moreJIT miscompilation in the JavaScript Engine: JIT component9.8 Critical
- sap se solution managerCode Injection vulnerability in SAP Solution Manager9.9 Critical
- thinkinai deepchatDeepChat's Incomplete XSS Fix Allows RCE through Mermaid Content9.7 Critical
- vitejs vite-plugin-react@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server9.8 Critical
- njtech greencmsGreenCMS Menu Management CustomController.class.php cross site scripting4.8 Medium
- yealink sip-t21p e2Yealink SIP-T21P E2 Local Directory cross site scripting5.1 Medium
- oretnom23 banking system, sourcecodester online banking system +1 moreSourceCodester Online Banking System page cross site scripting5.1 Medium
- azuriomClient-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user...8.8 High
- code-projects chamber of commerce membership management systemcode-projects Chamber of Commerce Membership Management System Your Info membership_profile.php cross site scripting4.8 Medium
- alokjaiswal hotel-management-services-using-mysql-and-phpalokjaiswal Hotel-Management-services-using-MYSQL-and-php dishsub.php cross site scripting4.8 Medium
- alokjaiswal hotel-management-services-using-mysql-and-phpalokjaiswal Hotel-Management-services-using-MYSQL-and-php Request Pending usersub.php cross site scripting5.1 Medium
- carmelogarcia employee profile management systemcode-projects Employee Profile Management System view_personnel.php cross site scripting5.1 Medium
- ai-ql tuuiTUUI vulnerable to Remote Code Execution (RCE) via XSS in Markdown ECharts Rendering8.9 High
- jizhicmsJIZHICMS Comment addcomment.html cross site scripting4.8 Medium
- dayrui xunruicmsdayrui XunRuiCMS Domain Name Binding admin79f2ec220c7e.php cross site scripting2.0 Low
- dayrui xunruicmsdayrui XunRuiCMS Add Data Validation admind45f74adbd95.php cross site scripting5.1 Medium
- dayrui xunruicmsdayrui XunRuiCMS Add Display Name Field admind45f74adbd95.php cross site scripting4.8 Medium
- thinkinai deepchatDeepChat Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)9.7 Critical
- masacmsMasa CMS Vulnerable to Pre-Auth RCE via JSON API9.8 Critical
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form9.8 Critical
- industrial video & control longwatchIndustrial Video & Control Longwatch has a Code Injection vulnerability9.3 Critical
- vllmvLLM vulnerable to remote code execution via transformers_utils/get_config7.1 High
- getgrav gravSecurity Sandbox Bypass with SSTI (Server Side Template Injection) in the Grav CMS8.8 High
- getgrav gravGrav is vulnerable to RCE via SSTI through Twig Sandbox Bypass8.7 High
- jairiidriss restaurantwebsitejairiidriss RestaurantWebsite Make a Reservation cross site scripting5.3 Medium
- google androidIn U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the...6.8 Medium
- kerlink kerosThe service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’...8.1 High
- codingwithelias school management systemcodingWithElias School Management System Edit Student Info student-view.php cross site scripting4.8 Medium
- winston-dsouza ecommerce-websitewinston-dsouza Ecommerce-Website GET Parameter header_menu.php cross site scripting5.3 Medium
- No product listedQualitor getResumo.php eval code injection6.9 Medium
- taosir wtcmstaosir WTCMS index.php fetch code injection6.9 Medium
- yungifez skuul, skuul school management system +1 moreyungifez Skuul School Management System SVG File edit cross site scripting4.8 Medium
- orangehrmOrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection9.0 Critical
- salt project saltSalt junos module uses an unsafe YAML loader which may allow unintended code execution7.3 High
- apache cloudstackApache CloudStack: Potential remote code execution on Javascript engine defined rules4.7 Medium
- anyscale rayRay is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack9.4 Critical
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP and LLM components,...7.8 High
- sneeit frameworkSneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback9.8 Critical
- redaxoREDAXO CMS is vulnerable to RCE attack through its template management component7.2 High
- No product listedEigenfocus Description cross site scripting5.1 Medium
- phpgurukul hostel management systemPHPGurukul Hostel Management System register-complaint.php cross site scripting5.1 Medium
- campcodes complete online beauty parlor management system, online beauty parlor management system +1 moreCampcodes Complete Online Beauty Parlor Management System customer-list.php cross site scripting4.8 Medium
- simonhaenisch md-to-pdfmd-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter10.0 Critical
- lite xl xl, lite-xl lite xl +1 moreCVE-2025-121207.3 High
- Show moreLoading…