CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- spip interface traduction objetsSPIP interface_traduction_objets < 2.2.2 Authenticated RCE8.7 High
- apache airflowApache Airflow: SSTI to Code Execution in Airflow through Shared DB Information8.4 High
- remyandrade modern image gallery appSourceCodester Modern Image Gallery App upload.php cross site scripting5.3 Medium
- alinto sogoAlinto SOGo cross site scripting5.3 Medium
- horillahorilla-opensource horilla Leads global.js cross site scripting5.1 Medium
- imagemagickImageMagick vulnerable to Code injection via PostScript header in ps coders5.7 Medium
- opentext™ carbonite safe server backupRCE vulnerability has been discovered in OpenText™ Carbonite Safe Server Backup.8.6 High
- admerc event management systemitsourcecode Event Management System navbar.php cross site scripting5.3 Medium
- xingfuggz baykeshopxingfuggz BaykeShop Article Sidebar custom.html cross site scripting4.8 Medium
- erzhongxmu jeewmserzhongxmu JEEWMS JeecgListDemoController.java doAdd cross site scripting5.3 Medium
- erzhongxmu jeewmserzhongxmu JEEWMS UEditor getContent.jsp cross site scripting5.3 Medium
- a466350665 smart-ssoa466350665 Smart-SSO Role Edit UserController.java save cross site scripting4.8 Medium
- a466350665 smart-ssoa466350665 Smart-SSO Login login.html cross site scripting5.3 Medium
- No product listed07FLYCMS/07FLY-CMS/07FlyCRM System Extension edit.html cross site scripting4.8 Medium
- higuma web-audio-recorder-js, webaudiorecorder.js +1 morehiguma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollution2.3 Low
- totolink x6000r firmwareTOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the...8.8 High
- rymcu forestrymcu forest User Profile UserInfoController.java updateUserInfo cross site scripting5.1 Medium
- rymcu forestrymcu forest Article Content/Comments/Portfolio XssUtils.java XssUtils.replaceHtmlCode cross site scripting5.1 Medium
- itsourcecode student management systemSapneshNaik Student Management System index.php cross site scripting5.3 Medium
- itsourcecode student management systemitsourcecode Student Management System Add Student add_student cross site scripting4.8 Medium
- statamic cms, yifangcms yifang +1 moreYiFang CMS Extended Management D_friendLinkGroup.php update cross site scripting4.8 Medium
- statamic cms, yifangcms yifang +1 moreYiFang CMS Extended Management D_adManage.php update cross site scripting4.8 Medium
- statamic cms, yifangcms yifang +1 moreYiFang CMS Extended Management D_adPosition.php update cross site scripting4.8 Medium
- funadminfunadmin Backend index.html cross site scripting4.8 Medium
- hackerbay oneuptimeOneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE10.0 Critical
- metabaseMetabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE7.7 High
- moodleMoodle: moodle: improper validation in file restore functionality leading to remote code execution7.2 High
- cradle e-commercedetronetdip E-commerce function.php get_safe_value cross site scripting5.1 Medium
- gsheetconnector by westerndeal wpforms google sheet connectorWordPress WPForms Google Sheet Connector plugin <= 4.0.1 - Remote Code Execution (RCE) vulnerability9.9 Critical
- inpersttion for themeWordPress Inpersttion For Theme plugin <= 1.0 - Arbitrary Code Execution vulnerability7.7 High
- rachelos werss we-mp-rssrachelos WeRSS we-mp-rss Article fix.py fix_html cross site scripting5.1 Medium
- microsoft semantic kernel, semantic-kernel +1 moreMicrosoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution10.0 Critical
- spip saisies, saisies pour formulaire +1 moreSPIP Saisies Plugin < 5.11.1 Remote Code Execution9.3 Critical
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF has PDF Object Injection via Unsanitized Input in addJS Method8.1 High
- wso2 identity serverServer-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution8.4 High
- invoiceplaneInvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning9.1 Critical
- mjdm majordomoMajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval9.3 Critical
- nltk, nltk nltk/nltk, red hat openshift lightspeed +2 more +4 moreZip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution10.0 Critical
- opencfd openfoamAn arbitrary code execution vulnerability exists in the Code Stream directive functionality of...7.8 High
- nvidia megatron-bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious...7.8 High
- nvidia megatron-bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge contains a vulnerability in a data merging tutorial, where malicious input...7.8 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code...7.8 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code...7.8 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains a vulnerability where malicious data created by an attacker could...7.8 High
- acowebs product addons for woocommerce – product options with custom fieldsProduct Addons for Woocommerce – Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter7.2 High
- wangyunf blossomBlossom Article Title ArticleController.java content cross site scripting5.1 Medium
- clawdbot, openclaw +1 moreOpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions3.7 Low
- No product listedA Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart...9.9 Critical
- cskefucskefu File Upload MediaController.java upload cross site scripting5.1 Medium
- ligerosmartLigeroSmart index.pl AgentDashboard cross site scripting5.1 Medium
- Show moreLoading…