CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- badlogic pi-monobadlogic pi-mono SVG Artifact SvgArtifact.ts cross site scripting5.3 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fi…6.5 Medium
- infiniflow ragflowRAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component8.7 High
- casbin casdoorCasdoor dangerouslySetInnerHTML cross site scripting5.1 Medium
- kedro-org kedroArbitrary Code Execution via Malicious Logging Configuration in Kedro9.8 Critical
- krayin laravel-crmkrayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting5.1 Medium
- convoypanel panelXiaopi Panel WAF Firewall demo.php cross site scripting5.1 Medium
- progress sharefile storage zones controllerRCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)9.1 Critical
- sourcecodester simple customer relationship management systemSourceCodester Simple Customer Relationship Management System Create Ticket create-ticket.php cross site scripting5.1 Medium
- unknown spam protect for contact form 7Spam Protect for Contact Form 7 < 1.2.10 - Editor+ Remote Code Execution7.2 High
- itsourcecode payroll management systemitsourcecode Payroll Management System navbar.php cross site scripting5.3 Medium
- dbgatedbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration8.3 High
- freedesktop libinput, fedoraproject fedora, red hat enterprise linux 10 +3 more +5 moreLibinput: libinput: unauthorized code execution and information disclosure through lua bytecode plugins8.8 High
- metinfo, metinfo cms cms +1 moreMetInfo CMS Unauthenticated PHP Code Injection RCE9.3 Critical
- code-projects simple laundry systemcode-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting5.3 Medium
- welovemedia ffmatewelovemedia FFmate Webhook AppJsonTreeView.vue cross site scripting5.1 Medium
- bufanyun hotgobufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting5.1 Medium
- z-9527 adminz-9527 admin Message Create Endpoint message.js cross site scripting5.1 Medium
- No product listedgougucms Record Endpoint record.html cross site scripting5.1 Medium
- xenforoXenForo Remote Code Execution via Authenticated Admin8.6 High
- xenforoXenForo Template Method Call Restriction Bypass8.7 High
- dedecmsAn issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup...9.8 Critical
- jeecg bootThere is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character...9.8 Critical
- code-projects bloodbank managing systemcode-projects BloodBank Managing System admin_state.php cross site scripting5.3 Medium
- b3log siyuanSiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution8.6 High
- b3log siyuanSiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client9.1 Critical
- lodash, lodash lodash-amd, lodash-es +105 more +107 morelodash vulnerable to Code Injection via `_.template` imports key names8.1 High
- sourcecodester leave application systemSourceCodester Leave Application System User Management cross site scripting4.8 Medium
- wpeverest everest forms proEverest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field9.8 Critical
- code-projects online food ordering systemcode-projects Online Food Ordering System Order order.php cross site scripting5.3 Medium
- supsysticcom contact form by supsysticContact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality9.8 Critical
- tautulliTautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check7.5 High
- crewaiCVE-2026-22879.8 Critical
- code-projects exam form submissioncode-projects Exam Form Submission update_fst.php cross site scripting4.8 Medium
- clineDSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability...9.8 Critical
- presidio hai buildIn its design for automatic terminal command execution, HAI Build Code Generator offers two...9.8 Critical
- roocode roo codeRoo Code's command auto-approval module contains a critical OS command injection vulnerability...9.8 Critical
- rahmanazhar sakadevIn its design for automatic terminal command execution, SakaDev offers two options: Execute safe...9.8 Critical
- orangecat syntxSyntx's command auto-approval module contains a critical OS command injection vulnerability that...9.8 Critical
- elecv2 elecv2pelecV2 elecV2P Endpoint logs cross site scripting5.3 Medium
- elecv2 elecv2pelecV2 elecV2P JSON webhook runJSFile code injection5.3 Medium
- sinaptik ai pandasaiSinaptik AI PandasAI Chat Message code_executor.py CodeExecutor.execute code injection6.9 Medium
- wandb openuiwandb OpenUI Window Message Event index.html cross site scripting5.1 Medium
- zcashfoundation zebra, zebra-chain +1 moreZebra node crash — V5 transaction hash panic (P2P reachable)9.2 Critical
- wandb openuiwandb OpenUI HTMLAnnotator server.py get_share HTML injection5.3 Medium
- qdocs smart school management systemQDOCS Smart School Management System Admission Enquiry enquiry cross site scripting5.1 Medium
- streetwriters notesnook web/desktop, notesnook desktop +1 moreNotesnook vulnerable to RCE via stored XSS in Note History diff viewer8.6 High
- streetwriters notesnook ios/android, notesnook web/desktop, notesnook desktop +1 more +3 moreNotesnook vulnerable to RCE via stored XSS in Web Clipper rendering9.7 Critical
- windmillWindmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor7.3 High
- sourcecodester online quiz systemSourceCodester Online Quiz System add-question.php cross site scripting5.1 Medium
- Show moreLoading…