CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- code-projects employee management systemcode-projects Employee Management System empproject.php cross site scripting5.3 Medium
- code-projects employee management systemcode-projects Employee Management System changepassemp.php cross site scripting5.3 Medium
- code-projects employee management systemcode-projects Employee Management System myprofileup.php cross site scripting5.3 Medium
- code-projects employee management systemcode-projects Employee Management System myprofile.php cross site scripting5.3 Medium
- code-projects employee management systemcode-projects Employee Management System eloginwel.php cross site scripting5.3 Medium
- sourcecodester indian invoicing systemSourceCodester Indian Invoicing System Invoice Template Render Database-Backed add_order.php cross site scripting5.1 Medium
- sourcecodester indian invoicing systemSourceCodester Indian Invoicing System category.php cross site scripting5.3 Medium
- sourcecodester sup online shoppingSourceCodester SUP Online Shopping productedit.php cross site scripting4.8 Medium
- vbulletinvBulletin Login cross site scripting5.1 Medium
- dolibarr erp crm, erp\/crm +1 moreDolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php9.3 Critical
- 546669204 vps-inventory-monitoring546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection5.3 Medium
- trimble sketchupCross-Site Scripting in SketchUp Dynamic Components9.3 Critical
- symfony twigTwig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation8.7 High
- symfony twigTwig: PHP code injection via `{% use %}` template name8.7 High
- internlm lmdeployLMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out7.8 High
- internlm lmdeployLMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization7.8 High
- powerdns authoritativeInsufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail4.9 Medium
- triliumnext triliumTrilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments6.8 Medium
- phenixdigital phoenix storybookUnauthenticated remote code execution via HEEx template injection in phoenix_storybook playground9.5 Critical
- eclipse glassfishGlassFish's Administration Console is Vulnerable to RCE9.1 Critical
- apache ofbizApache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution8.8 High
- apache ofbizApache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services6.5 Medium
- apache ofbizApache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager6.1 Medium
- significant-gravitas autogptAutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries7.6 High
- No product listedscalar/astro v0.1.13 was discovered to contain an arbitrary file upload vulnerability in the the...9.8 Critical
- red hat openshift ai (rhoai)ModelScope is vulnerable to arbitrary code injection via a crafted module7.3 High
- aws amazon redshift connector for pythonRemote Code Execution via eval() Injection in amazon-redshift-python-driver9.3 Critical
- budibaseBudibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API6.5 Medium
- verbb formieFormie: Pre-authenticated server-side template injection in Hidden fields9.8 Critical
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability8.8 High
- chroma chromadb, red hat enterprise linux ai (rhel ai) 3 +1 moreChromaDB Python project has a pre-authentication code injection vulnerability10.0 Critical
- vim, red hat enterprise linux 10, enterprise linux 10.2 extended update support +9 more +11 moreVim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution7.8 High
- perforce p4 (helix core)Code Injection in Perforce P4 (Helix Core)7.7 High
- acl analyticsACL Analytics 11.x - 13.0.0.579 Arbitrary Code Execution9.3 Critical
- jsonpickle python jsonpickle, red hat ansible automation platform 2 +1 morepython jsonpickle 2.0.0 Remote Code Execution via py/repr9.3 Critical
- schlix cmsSchlix CMS 2.2.6-6 Remote Code Execution via core.blockmanager8.7 High
- 611711dark mcp calculate serverMCP Calculate Server: Prompt Injection to RCE9.8 Critical
- apache flinkApache Flink: Remote code execution via SQL injection in code generation8.1 High
- No product listedOinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner. The method...6.5 Medium
- No product listedORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote...6.3 Medium
- electermelecterm: Local code through electerm's single-instance socket9.3 Critical
- hmbown codewhaleCodeWhale: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files9.6 Critical
- hmbown codewhaleCodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approval9.6 Critical
- electermelecterm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark9.4 Critical
- google chromeScript injection in SanitizerAPI in Google Chrome on Android prior to 148.0.7778.168 allowed a...5.4 Medium
- openclaw crabboxCrabbox < v0.12.0 Environment Variable Information Disclosure9.3 Critical
- siyuan-note siyuanSiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code execution8.3 High
- yordam information technology consulting, training and electronic systems industry and trade inc. library automation systemRCE in Yordam Informatics' Library Automation System8.8 High
- flowiseai flowiseFlowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape9.4 Critical
- richardhbtz soundcloud-rpcsoundcloud-rpc: Remote Code Execution via XSS in Track Title9.6 Critical
- Show moreLoading…