CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- code-projects exam form submissioncode-projects Exam Form Submission update_s4.php cross site scripting4.8 Medium
- code-projects exam form submissioncode-projects Exam Form Submission update_s5.php cross site scripting4.8 Medium
- code-projects exam form submissioncode-projects Exam Form Submission update_s2.php cross site scripting4.8 Medium
- reviewx – multi-criteria reviews for woocommerce with google reviews & schemaReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Limited Remote Code Execution7.3 High
github.com/digitalocean/droplet-agentGo,govulncheck-vulndbopenSUSE +1 moreDigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint8.8 High- yangzongzhuan ruoyiyangzongzhuan RuoYi Quartz Job job code injection5.1 Medium
- code-projects exam form submissioncode-projects Exam Form Submission update_s1.php cross site scripting5.3 Medium
- wavlink wl-wn578w2, wl-wn578w2 firmware +1 moreWavlink WL-WN578W2 POST Request login.cgi cross site scripting4.8 Medium
- deepwisdom metagptFoundation Agents MetaGPT operator.py code_generate code injection5.3 Medium
- No product listedPbootCMS Parameter MemberController.php alert_location cross site scripting5.3 Medium
- agence web eoxia - montpellier task managerTask Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter6.5 Medium
- reputeinfosystems contact form, survey, quiz & popup form builder – arformsContact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode Execution5.6 Medium
- mindinventory mindsqlMindinventory MindSQL mindsql_core.py ask_db code injection5.3 Medium
- wpchill kali forms — contact form & drag-and-drop builderKali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process9.8 Critical
- wwbn avideoAVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin8.8 High
- atjiu pybbsatjiu pybbs CommentApiController.java create cross site scripting5.1 Medium
- atjiu pybbsatjiu pybbs TopicApiController.java create cross site scripting5.1 Medium
- angeljudesuarez university management systemitsourcecode University Management System admin_single_student_update.php cross site scripting4.8 Medium
- anolis sysakSysAK v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd.9.8 Critical
- suitecrmSuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass9.1 Critical
- suitecrmSuiteCRM has Authenticated RCE in Modules7.2 High
- intakeIntake has a Command Injection via shell() Expansion in Parameter Defaults8.8 High
- langflowLangflow has an Arbitrary File Write (RCE) via v2 API10.0 Critical
- dedecmsAn issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via...9.8 Critical
- wgstart wgcloudAn issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the...9.8 Critical
- No product listedOS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi...9.8 Critical
- dynaconfdynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver7.5 High
- mesop-dev mesopMesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py9.8 Critical
- itsourcecode university management systemitsourcecode University Management System add_result.php cross site scripting4.8 Medium
- aapanelAn arbitrary file upload vulnerability in aaPanel v7.57.0 allows attackers to execute arbitrary...9.8 Critical
- portabilis i-educarPortabilis i-Educar Endpoint educar_servidor_curso_lst.php cross site scripting5.1 Medium
- trendnet tew-824druTRENDnet TEW-824DRU Web apply_sec.cgi sub_420A78 cross site scripting5.1 Medium
- langflowLangflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint9.3 Critical
- atlassian bamboo, bamboo data center +1 moreThis High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0,...8.6 High
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF has a PDF Object Injection via FreeText color8.1 High
- chamilo lms, chamilo-lms +1 moreChamilo LMS: Authenticated RCE via H5P Import8.8 High
- librechat, librechat rag api +1 moreLibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries.7.5 High
- lagom whmcs templateLagom WHMCS Template Datatables prototype pollution5.1 Medium
- raythaAuthenticated RCE in Raytha CMS8.6 High
- 3ds solidworks, dassault systèmes solidworks desktop +1 moreCode Injection vulnerability affecting SOLIDWORKS Desktop from Release 2025 through Release 20267.8 High
- cmsmadesimple cms made simpleCMS Made Simple User Management listusers.php cross site scripting4.8 Medium
- No product listedA command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2...9.8 Critical
- No product listedThe `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is...8.8 High
- No product listedUEditor JSONP Callback controller.php cross site scripting5.1 Medium
- aureus erpAureus ERP Chatter Message content-text-entry.blade.php cross site scripting5.1 Medium
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 moreCommand Injection in mlflow/mlflow7.5 High
- tecnick tcexamTecnick TCExam XML Export tce_xml_users.php F_xml_export_users cross site scripting4.8 Medium
- tecnick tcexamTecnick TCExam Group tce_edit_group.php cross site scripting4.8 Medium
- wavlink wl-nu516u1Wavlink WL-NU516U1 login.cgi sub_404F68 cross site scripting5.1 Medium
- worksuite hr, crm and project managementWorksuite HR, CRM and Project Management create cross site scripting4.8 Medium
- Show moreLoading…