CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedclassroombookings User Display Name layout.php read cross site scripting5.1 Medium
- b3log siyuanSiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE9.1 Critical
- protobufjs project protobufjs, protobufjs protobuf.js, red hat cryostat 4 +20 more +22 moreprotobufjs has an arbitrary code execution issue9.4 Critical
- flowiseai flowise, flowise-components +1 moreFlowise: Code Injection in CSVAgent leads to Authenticated RCE9.4 Critical
- flowiseai flowiseFlowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas.8.3 High
- home-assistant-ecosystem home assistant command-line interface, home-assistant-cli +1 morehass-cli: Handling of user-supplied Jinja2 templates5.6 Medium
- renovatebot renovateRenovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance6.8 Medium
- luanti-org luanti, minetest +1 moreLuanti has a mod security sandbox escape9.0 Critical
- luantiLuanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.9.3 Critical
- froxlorFroxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)9.1 Critical
- owasp bltOWASP BLT has RCE in Github Actions via untrusted Django model execution in workflow8.8 High
- weblateWeblate: Remote code execution during backup restoration8.1 High
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution5.4 Medium
- apache airflowApache Airflow: RCE by race condition in example_xcom dag8.1 High
- No product listedSlah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability...9.8 Critical
- microsoft kiotaKiota: Code Generation Literal Injection7.3 High
- wwbn avideoWWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks10.0 Critical
- openremoteOpenRemote is Vulnerable to Expression Injection10.0 Critical
- containers podman, red hat enterprise linux 10, enterprise linux 8 +3 more +5 morePowerShell Command Injection in Podman HyperV Machine4.0 Medium
- octobercms octoberOctober CMS: Environment Variable Exfiltration via INI Parser Interpolation4.9 Medium
- vendidero germanized for woocommerceGermanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution6.5 Medium
- kimaiKimai before 2.53.0 API Token Leakage via Invoice Template2.0 Low
- 1panel-dev maxkbMaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect6.3 Medium
- sap se landscape transformationCode Injection vulnerability in SAP Landscape Transformation2.0 Low
- sap netweaver application server java, sap se netweaver application server java (web dynpro java) +1 moreCode Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)6.1 Medium
@openai/codexnpmOpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files9.8 Critical- aandrew-me ytdownloaderaandrew-me ytDownloader Error Details Panel createTextNode cross site scripting5.3 Medium
dbgate-webnpmDbGate SVG Icon String FontIcon.svelte cross site scripting5.1 Medium- code-projects simple content management systemcode-projects Simple Content Management System welcome.php cross site scripting4.8 Medium
- 1panel-dev maxkb1Panel-dev MaxKB MdPreview chat.ts cross site scripting5.1 Medium
- phpgurukul company visitor management systemPHPGurukul Company Visitor Management System bwdates-reports-details.php cross site scripting5.1 Medium
- code-projects simple chatboxcode-projects Simple ChatBox Endpoint insert.php cross site scripting5.3 Medium
- code-projects simple laundry systemcode-projects Simple Laundry System checkupdatestatus.php cross site scripting5.3 Medium
pyroUbuntu,pyro4Ubuntu,pyro5Ubuntu +2 moreAn issue in the <code>pickle</code> protocol of Pyro v3.x allows attackers to execute arbitrary code via supplying a crafted pickled string message.9.8 Critical- cloudark kubeplusThe `/registercrd` endpoint in KubePlus 4.14 in the kubeconfiggenerator component is vulnerable...8.8 High
- No product listedIn Phpgurukul Online Course Registration v3.1, an arbitrary file upload vulnerability was...8.8 High
- dromara warm-flowDromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection5.3 Medium
- deepwisdom metagptFoundationAgents MetaGPT Tree-of-Thought Solver tot.py generate_thoughts code injection6.9 Medium
- 1panel-dev maxkb1Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scripting5.1 Medium
- 1panel-dev maxkb1Panel-dev MaxKB Public Chat static_headers_middleware.py StaticHeadersMiddleware cross site scripting5.1 Medium
- josdejong mathjs, red hat cryostat 4, developer hub +6 more +8 moreUnsafe array index getter in mathjs8.8 High
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI: Critical RCE via `type: job` workflow YAML9.8 Critical
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI has RCE via Automatic tools.py Import8.4 High
- mervinpraison praisonaiPraisonAI has Improper Control of Generation of Code ('Code Injection') and Protection Mechanism Failure in praisonai8.6 High
- mervinpraison praisonaiPraisonAI Affected by Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading7.8 High
- berriai litellm, red hat lightspeed core, ansible automation platform 2.6 +2 more +4 moreDuplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrail8.8 High
- code-projects vehicle showroom management systemcode-projects Vehicle Showroom Management System ServiceAndSalesReport.php cross site scripting5.3 Medium
- code-projects vehicle showroom management systemcode-projects Vehicle Showroom Management System ProfitAndLossReport.php cross site scripting5.3 Medium
- code-projects simple laundry systemcode-projects Simple Laundry System checkcheckout.php cross site scripting5.3 Medium
- code-projects simple it discussion forumcode-projects Simple IT Discussion Forum user.php cross site scripting4.8 Medium
- Show moreLoading…