CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- chartbrewChartbrew: Remote Code Execution (RCE) via Vulnerable API8.8 High
- chartbrewChartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query7.2 High
- hsc cybersecurity mailinspectorHSC Cybersecurity Mailinspector URL mliUserValidation.php cross site scripting5.3 Medium
- crocoblock jetengineWordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability8.5 High
- marketing fire widget optionsWordPress Widget Options plugin <= 4.1.3 - Remote Code Execution (RCE) vulnerability9.0 Critical
- builderall builder for wordpressWordPress Builderall Builder for WordPress plugin <= 3.0.1 - Remote Code Execution (RCE) vulnerability9.9 Critical
- No product listedAn issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to...8.8 High
- dgtlmoon changedetection.io, webtechnologies changedetection +1 morechangedetection.io: XPath - Arbitrary File Read via unparsed-text()8.8 High
- locutus, red hat logging subsystem for red hat openshift +1 moreLocutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection8.1 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos-10 & aos-8) +1 moreClient Isolation Bypass via GTK Manipulation5.4 Medium
- app-auto-patchInsecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to...7.8 High
openclawnpmOpenClaw hook transform path containment missed symlink-resolved escapes7.3 High- craftcms cms, craft cms +1 moreCraft has a Twig Function Blocklist Bypass9.4 Critical
- craftcms cms, craft cms +1 moreCraft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget7.5 High
- apache rangerApache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator9.8 Critical
- weintek easyweb, cmt-3072xh2 firmware +1 moreWeintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated...8.8 High
- nokia impact mobileAn issue was discovered in Nokia Impact before Mobile 23_FP1. In Impact DM 19.11 onwards, a...2.0 Low
- affineAFFiNE: One-click Remote Code Execution through Custom URL Handling8.8 High
- jewel theme master addons for elementor premiumMaster Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview8.8 High
- angeljudesuarez university management systemitsourcecode University Management System att_single_view.php cross site scripting5.3 Medium
- eosphoros-ai db-gpteosphoros-ai db-gpt Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection6.9 Medium
- phpgurukul student record management system, student record system +1 morePHPGurukul Student Record Management System edit-subject.php cross site scripting4.8 Medium
- phpgurukul student record management system, student record system +1 morePHPGurukul Student Record Management System edit-course.php cross site scripting4.8 Medium
- twentyAn issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via...9.8 Critical
- jon-remus-sevellejo personnel property equipment systemsourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution...7.2 High
- tenda w20e firmwareAn issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the value of ...9.8 Critical
- tenda ac15 firmwareAn issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The...9.8 Critical
- max-3000 maxsite cms, maxsite cms +1 moreMaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection6.9 Medium
- statamic cms, statamic +1 moreStatamic vulnerable to remote code execution via Antlers-enabled control panel inputs8.0 High
- openclawOpenClaw Skill Env applySkillConfigenvOverrides code injection5.3 Medium
- johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 moreJohnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution8.8 High
- johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 moreJohnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution8.8 High
- johnson controls frick controls quantum hd, johnsoncontrols frick controls quantum hd firmware +1 moreJohnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution8.8 High
- remyandrade doctor appointment systemSourceCodester Doctor Appointment System Sign Up register.php cross site scripting5.3 Medium
- langflowLangflow has Remote Code Execution in CSV Agent9.8 Critical
- agenta-ai agenta-api, agentatech agenta +1 moreAgenta has Python Sandbox Escape, Leading to Remote Code Execution (RCE)8.8 High
- xjd2020 fastcmsAn issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the...7.8 High
- n8nn8n: Expression Sandbox Escape Leads to RCE9.4 Critical
- n8nn8n has Arbitrary Command Execution via File Write and Git Operations9.0 Critical
- n8nn8n has Potential Remote Code Execution via Merge Node9.4 Critical
- n8nn8n has a Sandbox Escape in its JavaScript Task Runner9.4 Critical
- n8nn8n has Unauthenticated Expression Evaluation via Form Node9.5 Critical
- swaldman c3p0, red hat build of apache camel - hawtio 4, build of apache camel 4.14.4 for spring boot 3.5.11 +15 more +17 morec3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property8.9 High
- budibaseBudibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)9.9 Critical
- live-codes livecodesLiveCodes vulnerable to JavaScript Injection via untrusted PR title in i18n-update-pull workflow8.8 High
- pamzey patients waiting area queue management systemSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System queue.php cross site scripting5.1 Medium
- mihail-barinov advanced woo labels – product labels & badges for woocommerceAdvanced Woo Labels <= 2.37 - Authenticated (Contributor+) Remote Code Execution via 'callback' Parameter8.8 High
- pamzey patients waiting area queue management systemSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System patient-search.php cross site scripting4.8 Medium
- agentfront enclave@enclave-vm/core is vulnerable to Sandbox Escape10.0 Critical
- spip ticketsSPIP tickets < 4.3.3 Unauthenticated RCE9.3 Critical
- Show moreLoading…