CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- maxsite cmsMaxSite CMS Redirect Plugin cross site scripting4.8 Medium
- maxsite cmsMaxSite CMS Antispam Plugin plugin_antispam cross site scripting4.8 Medium
- datacom dm4100Datacom DM4100 Ethernet Configuration cross site scripting4.8 Medium
- datacom dm4100Datacom DM4100 VLAN Page cross site scripting4.8 Medium
- bivocom tr321BIVOCOM TR321 Wireless Setting cross site scripting4.8 Medium
- bdcom p3310dBDCOM P3310D New RMON Statistics cross site scripting4.8 Medium
- bdcom p3310dBDCOM P3310D New RMON History cross site scripting4.8 Medium
- bdcom p3310dBDCOM P3310D rmon event Tab cross site scripting4.8 Medium
- bdcom p3310dBDCOM P3310D New User index.asp cross site scripting4.8 Medium
- projeto-siga sigaprojeto-siga novo cross site scripting5.1 Medium
- simple-git project simple-git, red hat enterprise linux 8, enterprise linux 9 +3 more +5 moresimple-git is vulnerable to Remote Code Execution9.2 Critical
- skim-rs skimSkim: Arbitrary code execution via pull_request_target fork checkout in pr.yml7.4 High
- anyscale rayRay: Remote Code Execution via Parquet Arrow Extension Type Deserialization8.9 High
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 moreLiteLLM: Server-Side Template Injection in /prompts/test endpoint8.6 High
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia8.8 High
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI8.8 High
- th30d4y openlearnxOpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment8.8 High
- projectcontour contour, red hat externaldns operator +1 moreContour: Lua code injection via Cookie Path Rewrite Policy8.1 High
- funnelforms llc funnelformsproWordPress FunnelFormsPro plugin <= 3.8.1 - Remote Code Execution (RCE) vulnerability9.9 Critical
- h2o, h2oai h2oai/h2o-3 +1 moreRemote Code Execution in h2oai/h2o-35.9 Medium
- ntfyntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function6.4 Medium
- i18next i18nextifyi18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes4.7 Medium
- powerdns authoritativeIncomplete domain name sanitization during7.4 High
bagisto/bagistoPackagistBagisto Custom Scripts cross site scripting5.1 Medium- websystems webtotumWebSystems WebTOTUM Calendar cross site scripting5.1 Medium
- dolibarr erp\/crmDolibarr Allows Code Injection through its Website Module8.8 High
- linuxfoundation spinnakerSpinnaker vulnerable to RCE via expression parsing due to unrestricted context handling10.0 Critical
- pagekit cmsPagekit CMS StringStorage Template PhpEngine.php evaluate eval injection5.1 Medium
- givanz vvvebVvveb < 1.0.8.1 Code Injection via Installation Endpoint9.2 Critical
- devs palace erp onlineerponline.xyz ERP Online Inventory Edit Item cross site scripting4.8 Medium
- lmsys sglangCVE-2026-57609.8 Critical
- qibo cmsQibo CMS Internal Message cross site scripting5.1 Medium
- statamic cmsYifang CMS Extended Management L_rbac_admin.php store cross site scripting5.1 Medium
- bichitrogan isp billing softwareBichitroGan ISP Billing Software Pool List add cross site scripting4.8 Medium
- bichitrogan isp billing softwareBichitroGan ISP Billing Software Profile users-view cross site scripting4.8 Medium
- bichitrogan isp billing softwareBichitroGan ISP Billing Software Customer edit cross site scripting4.8 Medium
- 1024bit extend-deep1024bit extend-deep index.js prototype pollution6.9 Medium
- langgenius difylanggenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting5.1 Medium
- projectdiscovery nucleiNuclei: Environment variable disclosure via Response-Derived DSL Expressions5.3 Medium
- projectdiscovery nucleiProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env...4.0 Medium
- modelscope agentscopemodelscope agentscope _python.py execute_shell_command code injection6.9 Medium
- langflow-ai langflowlangflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scripting5.1 Medium
- brikcss mergebrikcss merge prototype pollution6.9 Medium
- No product listedComfyUI View Endpoint server.py cross site scripting5.1 Medium
- No product listedComfyUI userdata Endpoint user_manager.py getuserdata cross site scripting5.1 Medium
- rclone, red hat openshift api for data protection, advanced cluster management for kubernetes 2 +2 moreRClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution9.2 Critical
- wavlink wl-wn579a3Wavlink WL-WN579A3 login.cgi sub_401F80 cross site scripting5.3 Medium
- mauriciopoppe math-codegenRemote Code Execution (RCE) via String Literal Injection into math-codegen9.8 Critical
- firebirdsql firebirdFirebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution10.0 Critical
- lukevella ralllylukevella rallly Reset Password reset-password-form.tsx cross site scripting5.1 Medium
- Show moreLoading…