CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- hkuds nanobotZero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling8.9 High
- shopify ruby-lsp, ruby lsp, shopify.ruby-lsp +2 moreRuby LSP has arbitrary code execution through branch setting7.1 High
- code-projects online reviewer systemcode-projects Online Reviewer System btn_functions.php cross site scripting4.8 Medium
- code-projects social networking sitecode-projects Social Networking Site Alert home.php cross site scripting5.1 Medium
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +11 more +13 moreHandlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options8.3 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +10 more +12 moreHandlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial8.1 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 moreHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block8.1 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 moreHandlebars.js has JavaScript Injection via AST Type Confusion9.8 Critical
- lettaletta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injection6.9 Medium
- huggingface smolagentshuggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection5.3 Medium
- wazuh, wazuh wazuh-agent, wazuh-manager +2 moreWazuh Agent and Manager OS Command Injection and Untrusted Search Path7.1 High
- grafana, red hat enterprise linux 10, enterprise linux 8 +1 more +3 moreRCE on Grafana via sqlExpressions9.1 Critical
- buffalo inc. wi-fi router products, buffalo fs-m1266 firmware, fs-s1266 firmware +44 more +46 moreCode injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is...8.7 High
- spring ai, vmware spring ai +1 moreSpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution9.8 Critical
- code-projects exam form submissioncode-projects Exam Form Submission update_s7.php cross site scripting4.8 Medium
- capricorn86 happy-dom, happy dom, red hat ansible automation platform 2 +1 more +3 moreHappy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code8.8 High
- code-projects online food ordering systemcode-projects Online Food Ordering System food.php cross site scripting4.8 Medium
- code-projects online food ordering systemcode-projects Online Food Ordering System contact.php cross site scripting5.3 Medium
- edgelesssys contrastContrast before 1.18.0 AML Injection Remote Code Execution8.4 High
- langflowLangflow has Authenticated Code Execution in Agentic Assistant Validation9.3 Critical
- itsourcecode payroll management systemitsourcecode Payroll Management System index.php cross site scripting5.3 Medium
- code-projects simple laundry systemcode-projects Simple Laundry System Parameter modify.php cross site scripting5.3 Medium
- bentomlBentoML has Dockerfile Command Injection via system_packages in bentofile.yaml7.8 High
- dameng100 muucmfdameng100 muucmf list.html cross site scripting5.3 Medium
- dameng100 muucmfdameng100 muucmf list.html cross site scripting5.3 Medium
- dameng100 muucmfdameng100 muucmf autoReply.html cross site scripting5.3 Medium
- dameng100 muucmfdameng100 muucmf index.html cross site scripting5.3 Medium
- code-projects accounting systemcode-projects Accounting System Web Application add_costumer.php cross site scripting5.1 Medium
- thedaylightstudio dwoo, fuel cms +1 moreAn issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to...9.8 Critical
- n8nn8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode9.4 Critical
- nelio software ab testingWordPress Nelio AB Testing plugin <= 8.2.7 - Remote Code Execution (RCE) vulnerability9.1 Critical
- jetmonsters jetformbuilderWordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability9.9 Critical
- totalsuite total poll liteWordPress Total Poll Lite plugin <= 4.12.0 - Remote Code Execution (RCE) vulnerability9.9 Critical
- jonathan daggerhart widget wranglerWordPress Widget Wrangler plugin <= 2.3.9 - Remote Code Execution (RCE) vulnerability9.1 Critical
- themeisle woody ad snippetsWordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerability9.9 Critical
- saad iqbal post snippetsWordPress Post Snippets plugin <= 4.0.12 - Remote Code Execution (RCE) vulnerability8.5 High
- mmahrous thumblerthumbler allows OS Command Injection9.8 Critical
- dbashford textracttextract is vulnerable to OS Command Injection9.8 Critical
- pdf-image project pdf-imagepdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter9.8 Critical
- pinchtabA PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution6.1 Medium
- go-vikunja vikunjaVikunja Desktop vulnerable to Remote Code Execution via same-window navigation6.5 Medium
- go-vikunja vikunjaVikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration6.5 Medium
- dendibakh perf-ninjaArbitrary Code Execution via Crafted Bytecode in dendibakh/perf-ninja10.0 Critical
- projectworlds lawyer management system, online lawyer management system +1 moreprojectworlds Lawyer Management System lawyer_booking.php cross site scripting5.1 Medium
- No product listedbolo-blog Article Title article cross site scripting4.8 Medium
- ptc flexplm, windchill pdmlink +1 moreCritical Remote Code Execution vulnerability reported in Windchill9.3 Critical
- opensource-workshop connect-cmsConnect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin8.8 High
- projectworlds lawyer management system, online lawyer management system +1 moreprojectworlds Lawyer Management System lawyers.php cross site scripting5.1 Medium
- code-projects exam form submissioncode-projects Exam Form Submission update_s6.php cross site scripting4.8 Medium
- code-projects exam form submissioncode-projects Exam Form Submission update_s3.php cross site scripting4.8 Medium
- Show moreLoading…