CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- ligerosmartLigeroSmart index.pl cross site scripting5.1 Medium
- ligerosmartLigeroSmart index.pl cross site scripting5.1 Medium
- kidocode crawl4aiCrawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter10.0 Critical
- zalando skipperSkipper arbitrary code execution through lua filters8.8 High
- openagentplatform diveDive allows One-click Remote Code Execution through Deep Links for MCP Install9.7 Critical
- aveva process optimizationAVEVA Process Optimization Code Injection9.3 Critical
- aveva process optimizationAVEVA Process Optimization Code Injection10.0 Critical
- shopwareShopware Improper Control of Generation of Code in Twig rendered views7.2 High
- anysphere cursorCursor has a Terminal Tool Allowlist Bypass via Environment Variables7.2 High
- agentfront enclaveSandbox Escape via Host Error Prototype Chain in enclave-vm10.0 Critical
- kalyan02 nanocmsNanoCMS 0.4 - Remote Code Execution (RCE) (Authenticated)8.6 High
- 4homepages 4images4images 1.9 - Remote Command Execution (RCE)8.6 High
- eigentEigent Allows Arbitrary Code Execution via pull_request_target CI Workflow8.9 High
- made i.t. formsUmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation7.5 High
- phoenix contact cloud client 1101t-tx/tx, tc cloud client 1002-4g att, tc cloud client 1002-tx/tx +8 more +10 moreConfig-Upload Code Injection8.8 High
- sap introscope enterprise manager, sap se wily introscope enterprise manager (workstation) +1 moreRemote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)9.6 Critical
- sap se s/4hana (private cloud and on-premise), sap s\/4 hana +1 moreCode Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)9.1 Critical
- sap se landscape transformationCode Injection vulnerability in SAP Landscape Transformation9.1 Critical
- envoyproxy gateway, red hat connectivity link 1 +1 moreEnvoy Extension Policy lua scripts injection causes arbitrary command execution8.8 High
- luxul xwr-600Luxul XWR-600 Web Administration cross site scripting4.8 Medium
- questdb uiquestdb ui Web Console cross site scripting5.1 Medium
- salesforce uni2tsSalesforce Uni2TS has a Code Injection vulnerability9.8 Critical
- accessally, inc. accessallyAccessAlly < 3.3.2 Unauthenticated Arbitrary PHP Code Execution9.3 Critical
- phpgurukul staff leave management systemPHPGurukul Staff Leave Management System SVG File adminviews.py UPDATE_STAFF cross site scripting4.8 Medium
- dromara ruoyi-vue-plusThe snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job...9.4 Critical
- jeecg jimureportJimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user...9.8 Critical
- open-metadata openmetadataOpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE8.5 High
- pnpmpnpm vulnerable to Command Injection via environment variable substitution7.6 High
- carboneio carbonecarboneio carbone Formatter input.js prototype pollution2.3 Low
- projectworlds house rental and property listing, house rental and property listing project +1 moreprojectworlds House Rental and Property Listing complaint.php cross site scripting4.8 Medium
- n8nn8n is vulnerable to Remote Code Execution via Arbitrary File Write10.0 Critical
- muffonmuffon has One-click Remote Code Execution via XSS and Custom URL Handling8.8 High
- rockoa, xinhu rainrock rockoa +1 moreXinhu Rainrock RockOA API rockfun.php cross site scripting5.1 Medium
- rockoa, xinhu rainrock rockoa +1 moreXinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scripting5.1 Medium
- code-projects online product reservation systemcode-projects Online Product Reservation System prod.php cross site scripting5.3 Medium
- remyandrade api key manager appSourceCodester API Key Manager App Import Key cross site scripting5.1 Medium
- zhanglun letturazhanglun lettura RSS ContentRender.tsx cross site scripting2.3 Low
- wang.market wangmarketxnx3 wangmarket Backend Variable Search variableList.do variableList cross site scripting4.8 Medium
- wang.market wangmarketxnx3 wangmarket System Variables variableSave.do cross site scripting4.8 Medium
- qnap malware removerMalware Remover8.1 High
- ligerosmartLigeroSmart Environment Variable cross site scripting5.1 Medium
- wang.market wangmarketxnx3 wangmarket Add Global Variable save.do cross site scripting4.8 Medium
- signalk signal k server, signalk-server +1 moreSignal K Server Vulnerable to Remote Code Execution via Malicious npm Package7.3 High
- idreamsoft icmsiCMS POST Parameter ConfigAdmincp.php save code injection5.1 Medium
- kodicms-kohana kodicmsKohana KodiCMS Layout API Endpoint file.php save code injection5.3 Medium
- elinicksic razgoverelinicksic Razgover Chat Message send.php cross site scripting5.1 Medium
- eyoucmsEyouCMS Ask Module Ask.php cross site scripting5.1 Medium
- philipinho simple-php-blogPhilipinho Simple-PHP-Blog login.php cross site scripting5.3 Medium
- youlai vue3-element-adminyoulaitech vue3-element-admin Notice index.vue cross site scripting4.8 Medium
- mmaitre314 picklescanpicklescan - Remote Code Execution via _operator.attrgetter Detection Bypass7.6 High
- Show moreLoading…