CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- backstage, red hat developer hub 1.8, developer hub 1.9 +1 more +3 more@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks7.7 High
- orvalOrval has a code injection via unsanitized x-enum-descriptions uing JS comments9.3 Critical
- projectworlds house rental and property listing, house rental and property listing project +1 moreprojectworlds House Rental and Property Listing sms.php cross site scripting5.1 Medium
- ivanti endpoint manager mobile, endpoint manager mobile (epmm) +1 moreA code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated...9.8 Critical
- ivanti endpoint manager mobile, endpoint manager mobile (epmm) +1 moreA code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated...9.8 Critical
- bdtask bhojon, bhojon all-in-one restaurant management system +1 moreBdtask Bhojon All-In-One Restaurant Management System User Information profile cross site scripting5.1 Medium
- agpt autogpt platform, significant-gravitas autogpt +1 moreAutoGPT is Vulnerable to RCE via Disabled Block Execution8.6 High
- erugoAuthenticated Remote Code Execution via Arbitrary File Upload10.0 Critical
- No product listedrethinkdb Secondary Index cross site scripting4.8 Medium
- No product listedAn issue in Amidaware Inc Tactical RMM v1.3.1 and before allows a remote attacker to execute...8.8 High
- browserstack browserstack-local, red hat fuse 7 +1 moreBrowserStack Local vulnerable to Command Injection through logfile variable7.8 High
- linuxfoundation pytorch, red hat openshift ai (rhoai), openshift ai 2.25 +2 morePyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files8.8 High
- nyariv sandboxjsSandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor10.0 Critical
- pilgrimage233 minecraft-rcon-manageCode injection in Minecraft-Rcon-Manage10.0 Critical
- liuyueyi quick-mediaBuffer Write Security Vulnerability in liuyueyi/quick-media5.3 Medium
- fabian mobile shop management systemcode-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExAddNewUser...9.8 Critical
- ijason-liu books manageriJason-Liu Books_Manager add_book_check.php cross site scripting4.8 Medium
- patriksimek vm2vm2 has a Sandbox Escape9.8 Critical
- code-projects online examination systemcode-projects Online Examination System Add Pages cross site scripting5.1 Medium
- dioxuslabs componentsDioxus Components has JavaScript injection via user-supplied IDs5.3 Medium
- buddypressBuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution7.3 High
- moodleMoodle: moodle: remote code execution via insufficient restore input validation8.8 High
- langflowLangflow PythonFunction Code Injection Remote Code Execution Vulnerability7.1 High
- langflowLangflow code Code Injection Remote Code Execution Vulnerability9.8 Critical
- deepwisdom metagptFoundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability9.8 Critical
- orvalOrval Mock Generation Code Injection via const7.7 High
- beaver builder builderWordPress Beaver Builder plugin <= 2.9.4.1 - Arbitrary Code Execution vulnerability7.5 High
- shahjahan jewel fluentformWordPress FluentForm plugin <= 6.1.11 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- vollstart event tickets with ticket scannerWordPress Event Tickets with Ticket Scanner plugin <= 2.8.5 - Remote Code Execution (RCE) vulnerability9.0 Critical
- nelio software ab testingWordPress Nelio AB Testing plugin <= 8.1.8 - Arbitrary Code Execution vulnerability9.1 Critical
- 5ire5ire vulnerable to Remote Code Execution (RCE) via ECharts9.7 Critical
- get-simple my smtp contact plugin, getsimplecms +1 moreGetSimple CMS My SMTP Contact Plugin 1.1.2 - PHP Code Injection8.6 High
- autonomy openplcOpenPLC 3 - Remote Code Execution8.6 High
- tendenciTendenci has Authenticated Remote Code Execution via Pickle Deserialization6.8 Medium
- cisco unified communications manager, unity connection, unified communications manager im and presence service +2 moreCisco Unified Communications Products Remote Code Execution Vulnerability8.2 High
- vllm, red hat ai inference server, ai inference server 3.2 +6 more +8 morevLLM affected by RCE via auto_map dynamic module loading during model initialization8.8 High
- binary-parserCVE-2026-12456.5 Medium
- nvidia merlin transformers4recNVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could...7.8 High
- orvalOrval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation9.3 Critical
- iptime a1004 firmware, a1004ns firmware, a1004v firmware +160 more +162 moreipTIME routers A2003NS-MU 10.00.6 to 12.16.2 , N600 10.00.8 to 12.16.2, A604-V3 10.01.6 to 10.07...9.8 Critical
- b3log siyuanSiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attribute5.8 Medium
- frappe hrmspbrong hrms recruitment.go UpdateRecruitmentById cross site scripting5.1 Medium
- technical-laohu mpaytechnical-laohu mpay User Center cross site scripting4.8 Medium
- pamzey patients waiting area queue management systemSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_patient_schedule.php cross site scripting5.1 Medium
- pamzey patients waiting area queue management systemSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_register_patient.php cross site scripting5.1 Medium
- lcg0124 bootdolcg0124 BootDo ContentController save cross site scripting5.1 Medium
- angeljudesuarez society management systemitsourcecode Society Management System activity.php cross site scripting5.3 Medium
- angeljudesuarez society management systemitsourcecode Society Management System expenses.php cross site scripting5.3 Medium
- lobehub lobe-chatLobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)6.4 Medium
- n8nSandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.8.5 High
- Show moreLoading…