CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- lsc smart connect indoor ip camera firmwareLSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh.8.8 High
- campcodes complete online beauty parlor management systemCampcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scripting4.8 Medium
- carmelo simple stock systemcode-projects Simple Stock System chatuser.php cross site scripting5.3 Medium
- openagentplatform diveDive has Cross-Site Scripting vulnerability that can escalate to Remote Code Execution9.7 Critical
- world wide broadcast network avideoAVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt9.3 Critical
- gtedge gt edge aiAn issue in GT Edge AI Platform Versions before v2.0.10-dev allows attackers to execute arbitrary...9.8 Critical
- microsoft purviewMicrosoft Purview eDiscovery Remote Code Execution Vulnerability7.2 High
- microsoft azure container appsAzure Container Apps Remote Code Execution Vulnerability10.0 Critical
- alfonzm codigo markdown editorCodigo Markdown Editor 1.0.1 Electron Arbitrary Code Execution via Markdown File8.4 High
- ssw tinacms, tinacms\/cli, tinacms\/graphql +2 moretinacms vulnerable to arbitrary code execution7.3 High
- jetmonsters hotel booking liteWordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerability9.1 Critical
- don-themes mollaWordPress Molla - Multipurpose Responsive Shopify theme <= 1.5.13 - Arbitrary Code Execution vulnerability6.5 Medium
- javothemes javo coreWordPress Javo Core plugin <= 3.0.0.266 - Arbitrary Code Execution vulnerability6.5 Medium
- ruoyiy_project RuoYi getnames code injection5.3 Medium
- zzcmsZZCMS Backend Website Settings siteconfig.php stripfxg code injection5.1 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM has unauthenticated RCE in its Install Wizard10.0 Critical
- xiweicheng tms, teamwork management system +1 morexiweicheng TMS create createComment cross site scripting4.8 Medium
- ritecmsRiteCMS v3.1.0 was discovered to contain an authenticated remote code execution (RCE)...7.2 High
- pagekitPagekit CMS is vulnerable to OS Command Injection via Storage component9.9 Critical
- claris filemaker serverApache Commons Text versions prior to 1.10.0 included interpolation features that could be abused...9.8 Critical
- hewlett packard enterprise (hpe) hpe oneview, oneview +1 moreA remote code execution issue exists in HPE OneView.10.0 Critical
- thinkinai deepchatMermaid XSS vulnerability leads to Remote Code Execution9.7 Critical
- trailofbits ficklingFickling has Code Injection vulnerability via pty.spawn()7.1 High
- code-projects content management system, ctcms project ctcms +1 moreCTCMS Content Management System Backend System Configuration Ct_Config.php code injection5.1 Medium
- code-projects content management system, ctcms project ctcms +1 moreCTCMS Content Management System Backend App Configuration Ct_App.php save code injection5.1 Medium
- vion707 dmadminvion707 DMadmin Backend AddonsController.class.php add cross site scripting4.8 Medium
- zomp zomplogZomplog 3.9 Remote Code Execution via Authenticated File Manipulation8.6 High
- webedition cmsWebedition CMS v2.9.8.8 Remote Code Execution via PHP Page Creation8.6 High
- frappe erpnextA Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89...8.8 High
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method...8.8 High
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions...4.3 Medium
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method...4.3 Medium
- frappe erpnextAn SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text...8.8 High
- mayan edms, mayan-edms mayan edms +1 moreMayan EDMS authentication cross site scripting5.3 Medium
- code-projects student file management systemcode-projects Student File Management System update_student.php cross site scripting4.8 Medium
- code-projects student file management systemcode-projects Student File Management System Update User update_user.php cross site scripting4.8 Medium
- rang501 shortcode ajaxShortcode Loader <= 1.0 - Unauthenticated Arbitrary Shortcode Execution via 'code' Parameter5.4 Medium
- qualitorQualitor viewDocumento.php cross site scripting5.1 Medium
- flow-scanner lightning-flow-scannerLightning Flow Scanner is Vulnerable to Code Injection via Unsafe Use of new Function() in APIVersion Rule8.4 High
- waveterm, waveterm wave terminal +1 moreCode Injection in Wave Term v0.12.2 allowing TCC Bypass6.9 Medium
- parse-community parse-serverParse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management6.9 Medium
- ludwigyou wpmastertoolkit (wpmtk) – all in one pluginWPMasterToolKit (WPMTK) <= 2.13.0 - Authenticated (Contributor+) Code Injection5.3 Medium
- mineadminMineAdmin has an insecure default password9.8 Critical
- yangshare warehousemanager 仓库管理系统yangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scripting5.1 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 moreRemote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)9.1 Critical
- baowzh hflybaowzh hfly advtext add cross site scripting5.1 Medium
- foxit pdf editor, pdf reader +1 moreAn issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before...7.8 High
- popojicmsPopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings8.6 High
- xwiki xwiki-renderingXWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection8.7 High
- meatmeet pro wifi \& bluetooth meat thermometer firmwareThe ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack...6.8 Medium
- Show moreLoading…