CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- ligerosmartLigeroSmart index.pl cross site scripting5.1 Medium
- ligerosmartLigeroSmart index.pl cross site scripting5.1 Medium
- shd101wyy markdown preview enhancedAn issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to...8.8 High
- formulahendry coderunnerAn issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0...7.8 High
- apache avro, apache software foundation avro java sdk +1 moreApache Avro Java SDK: Code injection on Java generated code7.3 High
- clamav clambcClamAV ClamBC < 0.103.0-rc - 'ClamBC' Executable Regular Expression Error8.6 High
- yokecd yokeArbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC8.8 High
- goauthentik authentikauthentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint9.1 Critical
- hashicorp shared libraryArbitrary code execution in React server-side rendering of untrusted MDX content8.8 High
- No product listedAn issue in filosoft Comerc.32 Commercial Invoicing v.16.0.0.3 allows a local attacker to execute...7.8 High
- chevere spa cheveretoChevereto 3.13.4 Core - Remote Code Execution9.3 Critical
- keepass password safeKeePass 2.44 - Denial of Service (PoC)4.6 Medium
- schneider eelctric ecostruxure building operation workstation, schneider electric ecostruxure building operation webstation +1 moreCWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of...7.0 High
- nko custom block builder – lazy blocksCustom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution8.8 High
- villatheme lucky wheel giveawayLucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter7.2 High
- red hat ai inference server, enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +2 more +4 moreDiskCache has unsafe pickle deserialization9.8 Critical
- microsoft visual studio 2022 version 17.14, visual studio 2026 version 18.3, visual studio 2022 +2 moreGitHub Copilot and Visual Studio Remote Code Execution Vulnerability8.8 High
- microsoft defender for endpoint, defender for endpoint for linux +1 moreMicrosoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability8.8 High
- taklaxbr zai-shell, zai shell +1 moreUnauthenticated Remote Code Execution via P2P Sharing in ZAI-Shell8.8 High
- code-projects online reviewer systemcode-projects Online Reviewer System btn_functions.php cross site scripting5.1 Medium
- code-projects online reviewer systemcode-projects Online Reviewer System btn_functions.php cross site scripting4.8 Medium
- red hat migration toolkit for virtualization, openshift pipelines, ansible automation platform 2 +8 more +10 morejsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions9.2 Critical
- code-projects for plugin, fabian online music site +1 morecode-projects for Plugin AdminAddAlbum.php cross site scripting4.8 Medium
- zerowdd studentmanagerZeroWdd studentmanager LeaveController.java addLeave cross site scripting4.8 Medium
- heyewei jfinalcmsheyewei JFinalCMS API Endpoint save cross site scripting4.8 Medium
- oretnom23 simple responsive tourism websiteSourceCodester Simple Responsive Tourism Website Master.php cross site scripting5.3 Medium
- oretnom23 simple responsive tourism websiteSourceCodester Simple Responsive Tourism Website Registration Master.php cross site scripting5.3 Medium
- code-projects online student management systemcode-projects Online Student Management System Announcement Management index.php cross site scripting4.8 Medium
- pamzey patients waiting area queue management systemSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System Patient Registration registration.php cross site scripting5.3 Medium
- pamzey patients waiting area queue management systemSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System checkin.php cross site scripting5.3 Medium
- pamzey patients waiting area queue management systemSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System appointments.php cross site scripting5.3 Medium
- cym1102 nginxwebuicym1102 nginxWebUI Web Management check cross site scripting5.1 Medium
- calibre-ebook calibrecalibre has a Path Traversal Leading to Arbitrary File Corruption and Code Execution8.2 High
- portabilis i-educarPortabilis i-Educar User Data meusdadod.php cross site scripting5.1 Medium
- abhiphile fermat, fermat-mcp +1 moreabhiphile fermat-mcp eqn_chart.py eqn_chart code injection5.3 Medium
- isaacwasserman mcp-vegalite-serverisaacwasserman mcp-vegalite-server visualize_data eval code injection5.3 Medium
- edimax br-6288acl, br-6288acl firmware +1 moreEdimax BR-6288ACL wiz_WISP24gmanual.asp wiz_WISP24gmanual cross site scripting4.8 Medium
- nyariv sandboxjsSandboxJS has a Sandbox Escape10.0 Critical
- php fusion fusion, php-fusion phpfusion +1 morePHP-Fusion 9.03.50 - 'panels.php' Eval Injection8.6 High
- go toolchain cmd/cgo, golang go, red hat enterprise linux 10 +31 more +33 morePotential code smuggling via doc comments in cmd/cgo8.6 High
- 1000mz chestnutcmsAn issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via...7.2 High
- nvidia megatron-lmNVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data...7.8 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code has a Command Injection in find Command Bypasses User Approval Prompt7.7 High
- frangoteam fuxaFUXA allows Remote Code Execution (RCE) via the project import functionality.9.8 Critical
- ci4-cms-erp ci4msCI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor10.0 Critical
- langroidLangroid has WAF Bypass Leading to RCE in TableChatAgent9.4 Critical
- nyariv sandboxjsSandboxJS Prototype Pollution -> Sandbox Escape -> RCE10.0 Critical
- d-link dsl-6641k, dlink dsl-6641k firmware +1 moreD-Link DSL-6641K sp_pppoe_user.js doSubmitPPP cross site scripting4.8 Medium
- ubiquiti, inc. aircontrolAirControl 1.4.2 - PreAuth Remote Code Execution9.3 Critical
- d-link dsl-6641kD-Link DSL-6641K Web ad_virtual_server_vdsl cross site scripting4.8 Medium
- Show moreLoading…