CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- apache ofbizApache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution8.8 High
- roxy-wiRoxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section save9.9 Critical
- microsoft visual studio code, visual studio code - mssql extension +1 moreVisual Studio Code MSSQL Extension Remote Code Execution Vulnerability7.8 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Remote Code Execution Vulnerability7.5 High
- netgear rbe970, rbe970 firmware +1 moreInsufficient Input Validation Allows Unauthorized Modification of Router Software in certain NETGEAR Routers4.3 Medium
- themeisle woody code snippetsWordPress Insert PHP Plugin < 2.5.1 PHP Code Injection via REST API9.3 Critical
- rapid7 velociraptorA YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7...7.8 High
- google chromeInappropriate implementation in SVG in Google Chrome prior to 149.0.7827.103 allowed a remote...8.8 High
- juev nebula-meshnebula-mesh: Host advanced overrides allow YAML injection into agent config.yml8.7 High
- julien040 anyquery, anyquery github.com/julien040/anyquery/plugins/brave, github.com/julien040/anyquery/plugins/chrome +3 more +5 moreAnyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari)9.0 Critical
- aws agentcore cliCode injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import8.8 High
- yeswikiYesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)9.8 Critical
- actualbudget actualactual Allows Electron to Run As Node4.8 Medium
- openbullet openbullet2OpenBullet2 0.3.2 Authenticated RCE via Job Configuration Interface8.7 High
- imvks786 student management systemimvks786 student_management_system add.php cross site scripting5.1 Medium
- sourcecodester inventory systemSourceCodester Inventory System header.php cross site scripting5.1 Medium
- sourcecodester inventory systemSourceCodester Inventory System User Management users.php cross site scripting5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System billing.php cross site scripting5.3 Medium
- codeastro human resource management systemCodeAstro Human Resource Management System Notice Board Management All_notice cross site scripting4.8 Medium
- sourcecodester hospitals patient records management systemSourceCodester Hospitals Patient Records Management System page room_types cross site scripting4.8 Medium
- No product listedMage AI Sign-in Flow index.tsx useMutation cross site scripting5.3 Medium
- fluentcmsFluentCMS Blocks Plugin blocks cross site scripting4.8 Medium
- shd101wyy markdown preview enhancedMarkdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()8.6 High
- dbgateDbGate: Remote Code Execution via functionName injection in loadReader endpoint8.8 High
- dbgateDbGate: Unauthenticated Remote Code Execution via JSON Script Runner10.0 Critical
- sourcecodester ship ferry ticket reservation systemSourceCodester Ship Ferry Ticket Reservation System manage_user cross site scripting4.8 Medium
- tittuvarghese collegemanagementsystemtittuvarghese CollegeManagementSystem fetch.php cross site scripting5.3 Medium
- google chromeInappropriate implementation in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.53...8.1 High
- google chromeInappropriate implementation in PlatformIntegration in Google Chrome on Windows prior to 149.0...6.8 Medium
- google chromeScript injection in Accessibility in Google Chrome prior to 149.0.7827.53 allowed an attacker who...5.4 Medium
- google chromeScript injection in Headless in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to...8.8 High
- google chromeInappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote...8.8 High
- itsourcecode fees management systemitsourcecode Fees Management System navbar.php cross site scripting5.3 Medium
- docling, red hat openshift ai (rhoai) +1 moreDocling: Unsafe Playwright-based HTML Rendering8.2 High
- ahujasid blender-mcpahujasid blender-mcp server.py execute_blender_code code injection5.1 Medium
- browserstack browserstack-runnerBrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler8.7 High
- jhorowitz content visibility for divi builderContent Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution8.8 High
- maziyarpanahi openmedOpenMed < 1.5.2 Remote Code Execution via PII Model Loading9.3 Critical
- 1panel-dev cordyscrm1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting5.1 Medium
- westboy cicadascmswestboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting4.8 Medium
- 1panel-dev cordyscrm1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting4.8 Medium
- itsourcecode fees management systemitsourcecode Fees Management System index.php cross site scripting5.3 Medium
- code-projects hotel and tourism reservation systemcode-projects Hotel and Tourism Reservation System tour.php cross site scripting5.3 Medium
- ibm websphere application serverIBM WebSphere Application Server is affected by remote code execution9.0 Critical
- cloudpirates-io helm-chartsCloudPirates Open Source Helm Charts: GitHub Actions pull_request_target workflow allows secret exfiltration via fork pull requests10.0 Critical
- cloudpirates-io helm-chartsCloudPirates Open Source Helm Charts: GitHub Actions workflow leaks PAT and SSH signing key via unsafe credential handling10.0 Critical
- disig web signerCritical RCE vulnerability in Disig Web Signer9.4 Critical
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting5.1 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting5.1 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting5.1 Medium
- Show moreLoading…