CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- devs palace erp onlineDevs Palace ERP Online item-save cross site scripting4.8 Medium
- devs palace erp onlineDevs Palace ERP Online customer-save cross site scripting4.8 Medium
- devs palace erp onlineDevs Palace ERP Online supplier-save cross site scripting4.8 Medium
- devs palace erp onlineDevs Palace ERP Online purchase_return_save cross site scripting4.8 Medium
- codelibs fesscodelibs Fess JSP File AdminDesignAction.java update code injection5.1 Medium
- No product listedJeecgBoot SVG File CommonController.java cross site scripting5.3 Medium
- gitroom postiz, gitroomhq postiz-app +1 morePostiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev10.0 Critical
- @babel plugin-transform-modules-systemjs, babel +1 moreImproper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs8.2 High
- webpros cpanel, cpanel (cloudlinux 6, centos 6), wp squared +2 moreInsufficient input validation of the `plugin` parameter of the `create_user` plugin allows...5.3 Medium
- siyuan-note siyuanSiYuan: Stored XSS via Attribute View name to Electron renderer RCE in SiYuan9.4 Critical
- 0din-ai ai-scanner, mozilla 0din scanner +1 moreRemote code execution via JavaScript injection in `BrowserAutomation::PlaywrightService`9.9 Critical
- mervinpraison praisonaiPraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injection9.4 Critical
- apache cloudstackApache CloudStack: Unauthenticated Command Injection in Direct Download Templates8.8 High
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System index.php users cross site scripting4.8 Medium
- electermelecterm: dangerous code can be run through links or command line9.4 Critical
- No product listed1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE...9.8 Critical
- yeti-platform yetiA SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server.7.3 High
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System index.php cross site scripting5.3 Medium
- neorazorx facturascriptsFacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images6.3 Medium
- dail8859 notepad next, notepadnext +1 moreImproper Control of Generation of Code ('Code Injection') in dail8859/NotepadNext7.8 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 moreOther issue in the WebRTC component9.8 Critical
- hitachi virtual storage platform e390, e590, e790, e990, e1090, e390h, e590h, e790h, e1090h, virtual storage platform g130, g150, g350, g370, g700, g900, f350, f370, f700, f900, virtual storage platform one block 23, one block 24, one block 26, one block 28 +20 more +22 moreRemote Code Execution Vulnerability in Hitachi Storage Navigator and the maintenance console8.3 High
- huggingface diffusers, red hat ai inference server, enterprise linux ai (rhel ai) 3 +2 more +4 moreDiffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components8.8 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox escape10.0 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox Escape10.0 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox Escape10.0 Critical
- huggingface diffusersDiffusers: None.py Trust Remote Code Bypass8.8 High
- No product listedChestnutCMS v1.5.10 has a SQL injection vulnerability. The content parameter of the cms_content...9.8 Critical
@jswork/next-npm-versionnpmnext-npm-version is vulnerable to Command injection9.8 Critical- mervinpraison praisonaiPraisonAI: Unauthenticated RCE via `tool_override.py`8.4 High
- gitpython-developers gitpythonGitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath7.8 High
- com.ritense.valtimo case, contract, document +1 more +3 moreValtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users9.1 Critical
- dedoc scrambleScramble: Remote code execution via evaluation of user-controlled input in validation rules9.4 Critical
- google chromeScript injection in UI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who...4.2 Medium
- oracle cloud native environment command line interfaceVulnerability in the Oracle Cloud Native Environment Command Line Interface product of Oracle...6.6 Medium
- geovision inc. asmanagerGV-ASWeb Remote Code Execution (RCE) vulnerability8.8 High
org.jdbi:jdbi3-freemarkerMavenjdbi3-freemarker Vulnerable to Improper Neutralization of Special Elements Used in FreeMarker Template Engine7.5 High- getgrav gravGrav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature9.1 Critical
- wwbn avideoWWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass7.2 High
- openclawOpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working Directory8.4 High
- frappe erpnext, erpnext frappe framework (erpnext), frappe technologies framework (erpnext) +2 moreFrappe Framework ERPNext 13.4.0 Remote Code Execution8.7 High
- frappe erpnextERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker...9.8 Critical
- azuracastAzuraCast before 0.23.6 Code Injection via Remote Relay Password8.7 High
- befeleme pyp2specImproper Input Validation leading to Improper Control of Generation of Code ('Code Injection') in pyp2spec7.8 High
- 0xjacky nginx-ui, nginxui nginx ui +1 moreUnauthenticated Remote Code Execution via Backup Restore in nginx-ui9.0 Critical
- openmrs openmrs-coreOpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRange9.1 Critical
- streetwriters notesnook, notesnook desktop, notesnook mobile +2 moreNotesnook: RCE via stored XSS in note export rendering9.6 Critical
- patriksimek vm2, red hat developer hub, self-service automation portal 2 +2 morevm2: WASM Sandbox Escape (Node 25 only)9.8 Critical
- patriksimek vm2, red hat developer hub, self-service automation portal 2 +2 morevm2: Sandbox Escape9.8 Critical
- patriksimek vm2, red hat developer hub, developer hub 1.10 +1 more +3 morevm2: Sandbox Breakout Through Inspect9.8 Critical
- Show moreLoading…