CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- mervinpraison praisonaiPraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool9.8 Critical
- mervinpraison praisonaipraisonai: Jobs API exposes agent-execution endpoints with no authentication9.8 Critical
- piscinajs piscinapiscina: Prototype Pollution Gadget → RCE via inherited options.filename8.1 High
- fgmacedo python statemachine, python-statemachine +1 morePython StateMachine 3.0.0 < 3.2.0 RCE via SCXML eval() Injection9.3 Critical
- monetizemore advanced adsWordPress Advanced Ads plugin <= 2.0.21 - Remote Code Execution (RCE) vulnerability7.5 High
- creative themes blocksy companion proWordPress Blocksy Companion Pro plugin <= 2.1.37 - Remote Code Execution (RCE) vulnerability9.9 Critical
- No product listedJimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper...9.1 Critical
- acpt (pro) - custom post types plugin for wordpressWordPress ACPT (Pro) - Custom Post Types plugin for WordPress plugin < 2.0.52 - Remote Code Execution (RCE) vulnerability10.0 Critical
- themeco cornerstoneWordPress Cornerstone plugin < 7.8.8 - Arbitrary Code Execution vulnerability8.5 High
- crawl4aiCrawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints9.2 Critical
- crawl4aiCrawl4AI - Authentication Bypass via Hardcoded JWT Signing Key9.3 Critical
- crawl4aiCrawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint9.2 Critical
- crawl4aiCrawl4AI - Stored Cross-Site Scripting in Monitor Dashboard5.3 Medium
- crawl4aiCrawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server6.9 Medium
- crawl4aiCrawl4AI - Server-Side Request Forgery via Webhook URLs9.2 Critical
- crawl4aiCrawl4AI - Arbitrary File Write via output_path Parameter8.8 High
- kidocode crawl4aiCrawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API9.8 Critical
- oracle corporation peoplesoft enterprise cs campus community, oracle peoplesoft enterprise campus software campus community +1 moreVulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft ...8.1 High
- oracle mysql shellVulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The...9.9 Critical
- langflowLangflow: Unauthenticated RCE in Shareable Playgrounds9.6 Critical
- vllm, red hat ai inference server, ai inference server 3.2 +5 more +7 morevLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution7.5 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful...7.8 High
- filipe nasc rd stationWordPress RD Station plugin <= 5.6.0 - Remote Code Execution (RCE) vulnerability9.9 Critical
- mantrabrain easy invoiceWordPress Easy Invoice plugin <= 2.1.19 - Remote Code Execution (RCE) vulnerability10.0 Critical
- metaslider responsive slider by metasliderWordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability9.1 Critical
- protobufjs protobufjs-cliprotobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names8.2 High
- cursorCursor Desktop sandbox escape via Claude hook configuration8.5 High
- edgar rojas woocommerce pdf invoice builderWordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability10.0 Critical
- opensolution quick.cmsInsecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS7.5 High
- rubylouvre avalonRubyLouvre avalon Template Filter index.js prototype pollution6.9 Medium
- jsonata-js jsonatajsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution6.9 Medium
- intelliants subrion cmsIntelliants Subrion CMS Blocks Endpoint cross site scripting4.8 Medium
youtransfernpmYouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution9.8 Critical- No product listedAn issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows...9.8 Critical
- No product listedAn OS command injection vulnerability in the media archiving and export pipeline component of...9.8 Critical
- remotionRemotion: remote code execution (RCE) vulnerability9.8 Critical
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics index.php cross site scripting5.3 Medium
- codeastro human resource management systemCodeAstro Human Resource Management System Projects Management Add_Projects cross site scripting5.1 Medium
- codeastro human resource management systemCodeAstro Human Resource Management System Dashboard add_tod cross site scripting5.1 Medium
- kitty project kittyKitty vulnerable to command injection via unsanitized OSC 21 query reply7.3 High
- kitty project kitty@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE7.8 High
- chroma chromadb, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +2 moreChromaDB has a code injection vulnerability9.4 Critical
- jmespath, jmespath jmespath.php +1 morejmespath.php has CompilerRuntime code injection via unescaped function names9.8 Critical
- openclawOpenClaw < 2026.5.18 - Arbitrary Code Execution via Unscanned Marketplace Runtime Extension Metadata7.7 High
- vim, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreVim: Arbitrary Code Execution via Python Omni-Completion7.5 High
- vimVim: Arbitrary Code Execution via Python Omni-Completion7.3 High
- vim, red hat enterprise linux 10, enterprise linux 10.0 extended update support +9 more +11 moreVim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name7.3 High
- vimVim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex5.1 Medium
- openzeppelin contracts-wizardOpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri8.8 High
- pdm-project pdmpdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing8.4 High
- Show moreLoading…