CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import4.2 Medium
- danthedeckie simpleeval, red hat openshift ai (rhoai), openshift ai 2.25 +1 more +3 more(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.8.7 High
- nyariv sandboxjsSandboxJS has a Sandbox Escape10.0 Critical
- illid advanced woo labelsWordPress Advanced Woo Labels plugin <= 2.36 - Remote Code Execution (RCE) vulnerability7.2 High
- yannick lefebvre modal dialogWordPress Modal Dialog plugin <= 3.5.16 - Remote Code Execution (RCE) vulnerability9.1 Critical
- beghelli sicuroweb (sicuro24), gvectors wpdiscuz +1 moreBeghelli Sicuro24 SicuroWeb AngularJS Template Injection5.1 Medium
- google chrome, chromium v8 +1 moreInappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote...8.8 High
- locutus, red hat logging subsystem for red hat openshift +1 moreLocutus: RCE via unsanitized input in create_function()9.8 Critical
- veeam software appliance, backup \& replication +1 moreA vulnerability allowing an authenticated user with the Backup Administrator role to perform...9.1 Critical
- veeam backup and replication, backup \& replication +1 moreA vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on...10.0 Critical
- itsourcecode payroll management systemitsourcecode Payroll Management System manage_employee_deductions.php cross site scripting5.3 Medium
- cesiumgs cesiumjsCesiumGS CesiumJS standalone.html cross site scripting5.3 Medium
- campcodes division regional athletic meet game result matrix systemCampcodes Division Regional Athletic Meet Game Result Matrix System save_up_athlete.php cross site scripting5.1 Medium
- campcodes division regional athletic meet game result matrix systemCampcodes Division Regional Athletic Meet Game Result Matrix System save-games.php cross site scripting5.1 Medium
- itsourcecode university management systemitsourcecode University Management System view_result.php cross site scripting5.3 Medium
- autohomecorp frostmourneAutohomeCorp frostmourne Oracle Nashorn JavaScript ExpressionRule.java scriptEngine.eval code injection5.3 Medium
- No product listedHMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and...8.8 High
- jcharis machine-learning-web-appsJcharis Machine-Learning-Web-Apps Jinja2 Template app.py render_template cross site scripting5.3 Medium
- elecv2 elecv2pelecV2P jsfile Endpoint wbjs.js runJSFile code injection5.3 Medium
- lockerproject lockerLockerProject Locker Error Response registry.js authIsAwesome cross site scripting5.3 Medium
- netgain systems em plusNetGain EM Plus 10.1.68 Remote Code Execution via script_test.jsp9.3 Critical
- No product listedPHPEMS index.php cross site scripting5.1 Medium
- craftcms cms, craft cms +1 moreCraftCMS has an RCE vulnerability via relational conditionals in the control panel8.1 High
- micro research ltd. mr-gm5a-l1, mr-gm5l-s1 +1 moreCode injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker...8.6 High
- openclawA remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers...9.8 Critical
- lantronix eds5000, e210 series, e213f102s firmware +36 more +38 moreLantronix EDS5000, G520, and X300 OS Command Injection9.3 Critical
- lantronix eds5000 series, eds5008 firmware, eds5016 firmware +3 more +5 moreLantronix EDS5000, G520, and X300 OS Command Injection8.6 High
- lantronix eds5000 series, eds5008 firmware, eds5016 firmware +3 more +5 moreLantronix EDS5000, G520, and X300 OS Command Injection8.6 High
- lantronix eds5000 series, eds5008 firmware, eds5016 firmware +1 more +3 moreLantronix EDS5000 OS Command Injection8.6 High
- lantronix eds5000 series, eds5008 firmware, eds5016 firmware +3 more +5 moreLantronix EDS5000, G520, and X300 OS Command Injection8.6 High
- cloudcli cloud cli, siteboon claudecodeui +1 moreShell Command Injection in Git Routes [CloudCLI UI]8.7 High
- schneider electric ecostruxure™ automation expert, schneider-electric ecostruxure automation expert +1 moreCWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could...7.2 High
- azuracastAzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation8.6 High
- oretnom23 resort reservation systemSourceCodester Resort Reservation System Reservation Management page cross site scripting5.1 Medium
- angeljudesuarez payroll management systemitsourcecode Payroll Management System manage_employee_allowances.php cross site scripting5.3 Medium
- senior-walter web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System edit-profile.php cross site scripting5.1 Medium
- carmelo simple flight ticket booking systemcode-projects Simple Flight Ticket Booking System showhistory.php cross site scripting5.3 Medium
- statamic cms, yifangcms yifang +1 moreYiFang CMS D_singlePageGroup.php update cross site scripting5.1 Medium
- statamic cms, yifangcms yifang +1 moreYiFang CMS D_singlePage.php update cross site scripting5.1 Medium
- statamic cms, yifangcms yifang +1 moreYiFang CMS D_friendLink.php update cross site scripting5.1 Medium
- apich-organization rssnRSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface9.4 Critical
- 1024-lab smartadmin1024-lab/lab1024 SmartAdmin Help Documentation HelpDocAddForm.java cross site scripting5.1 Medium
- 1024-lab smartadmin1024-lab/lab1024 SmartAdmin Notice notice-form-drawer.vue cross site scripting5.1 Medium
- wavlink wl-wn579x3-c, wl-wn579x3-c firmware +1 moreWavlink WL-WN579X3-C adm.cgi sub_401AD4 cross site scripting4.8 Medium
- oretnom23 loan management systemSourceCodester Loan Management System index.php cross site scripting5.3 Medium
- hackerbay oneuptimeOneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE10.0 Critical
- shahadul878 easy php settingsEasy PHP Settings <= 1.0.4 - Authenticated (Administrator+) PHP Code Injection via 'wp_memory_limit' Setting7.2 High
- mesaMesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner8.3 High
- wpallimport wp all import – drag & drop import for csv, xml, excel & google sheetsWP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'6.1 Medium
- natroteam natro macro, natromacro +1 moreNatro Macro: Code Injection through Pattern/Path files6.6 Medium
- Show moreLoading…