CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting5.1 Medium
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector8.1 High
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia `addNetworkConnector` Discovery Wrapper Bypass8.8 High
- mettle sendportalMettle sendportal Campaign webview cross site scripting5.1 Medium
- raisulislamg4 student management system by phpraisulislamg4 student_management_system_by_php admission_form_check.php cross site scripting5.1 Medium
- aider-ai aiderAider-AI Aider Architect Mode auth.py editor_coder.run code injection5.3 Medium
- orthanc explorer 2Orthanc Explorer 2 URL StudyList.vue cross site scripting5.3 Medium
- westboy cicadascmswestboy CicadasCMS AbstractCacheManager.java search cross site scripting5.3 Medium
- cyber-iii student-management-systemsambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting4.8 Medium
- home-assistant home assistant coreHome Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore9.3 Critical
- mervinpraison praisonaiPraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-443348.1 High
- labring fastgptFastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassable6.3 Medium
- axios, red hat cryostat 4, gatekeeper 3 +79 more +81 moreAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge7.0 High
- home assistant companion app (android), companion app (ios), home-assistant core +2 moreHome Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection8.3 High
- marcelroozekrans roslyn-codelens-mcpRoslyn CodeLens MCP Server: Untrusted Roslyn Analyzer Execution via get_diagnostics Leads to Arbitrary Code Execution7.8 High
- google chromeInappropriate implementation in USB in Google Chrome prior to 148.0.7778.216 allowed a remote...8.8 High
- google chromeInappropriate implementation in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote...8.8 High
- oscal-compass compliance-trestlecompliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)7.8 High
- gitbutlerapp gitbutlerGitButler: Link injection via forge integration enables arbitrary script execution9.3 Critical
- webpros comet backupInsufficient character filtering in backup agent signing module on Comet Backup server allows...9.1 Critical
- spaceapplications yamcsYamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection9.1 Critical
- spaceapplications yamcsYamcs: Remote Code Execution via Mission Database algorithm override9.8 Critical
- langroidLangroid has Prompt to SQL Injection, Leading to RCE9.8 Critical
- leiweibau pi.alertUnauthenticated RCE via Python Config File Injection in SaveConfigFile() (Path)9.8 Critical
- leiweibau pi.alertUnauthenticated RCE via Python Config File Injection in SaveConfigFile() (Interger)9.8 Critical
- harttle liquidjsLiquidJS is Vulnerable to Remote Code Execution10.0 Critical
- cservit affiliate-toolkit – multi-network affiliate & amazon product displayaffiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution7.2 High
- smub wpcode – insert headers and footers + custom code snippets – wordpress code managerWPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost8.8 High
- pmqs io::compress, red hat enterprise linux 10, enterprise linux 10.0 extended update support +17 more +19 moreIO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob7.3 High
- qianfox foxcmsQianFox FoxCMS Administrator Backend edit cross site scripting4.8 Medium
- spaceapplications yamcsYamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`9.1 Critical
dolibarrUbuntuAn issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote...7.3 HighdolibarrUbuntuAn issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote...7.3 HighdolibarrUbuntuAn issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote...7.3 High- frangoteam fuxaFUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection8.9 High
- thingsboardThingsBoard YAML provision getGatewayDockerComposeFile code injection2.3 Low
- ibm http serverIBM HTTP Server is affected by multiple vulnerabilities9.8 Critical
- ibm web server plug-ins for websphere application server and websphere liberty, websphere application server +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins9.8 Critical
- teableio teableteableio teable Sign-up LoginPage.tsx cross site scripting5.3 Medium
- ibm http serverIBM HTTP Server is affected by multiple vulnerabilities8.1 High
- oretnom23 hospitals patient records management systemSourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting4.8 Medium
- openkm community edition, professional edition +1 moreOpenKM 6.3.12 Remote Code Execution via Administrative Scripting8.6 High
- itsourcecode electronic judging systemitsourcecode Electronic Judging System judges.php cross site scripting5.3 Medium
- blitz-js blitzblitz-js blitz Sign-in LoginForm.tsx cross site scripting5.3 Medium
- stonith404 pingvin-sharestonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting5.3 Medium
- hemant6488 codeigniter-studentmanagementsystemhemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent cross site scripting5.3 Medium
- videowhisper broadcast live videoWordPress Broadcast Live Video plugin < 7.1.3 - Remote Code Execution (RCE) vulnerability7.2 High
- sourcecodester student grades management systemSourceCodester Student Grades Management System students.php cross site scripting5.1 Medium
- yashpokharna2555 studentmanagementsystemyashpokharna2555 StudentManagementSystem student.php cross site scripting5.1 Medium
- code-projects employee management systemcode-projects Employee Management System applyleave.php cross site scripting5.3 Medium
- Show moreLoading…