CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- snowflake cliSnowflake CLI Arbitrary Code Execution via Snowpark Annotation Processor Template Injection8.8 High
- code-projects inventory management systemSourceCodester Inventory Management System User Registration Endpoint users_handler.php cross site scripting5.1 Medium
- code-projects online music sitecode-projects Online Music Site POST Request Feedback.php cross site scripting5.3 Medium
- codeastro complaint management systemCodeAstro Complaint Management System Report addreport cross site scripting5.1 Medium
- itsourcecode online hotel management systemitsourcecode Online Hotel Management System POST Request controller.php add cross site scripting5.3 Medium
- itsourcecode online hotel management systemitsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting5.3 Medium
- itsourcecode online hotel management systemitsourcecode Online Hotel Management System POST Request controller.php add cross site scripting5.3 Medium
- No product listedGotoHTTP reg.12x cross site scripting5.3 Medium
- No product listedAn issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the...9.1 Critical
- code-projects project management systemcode-projects Project Management System Mail Compose mail.php cross site scripting5.1 Medium
- antlr antlr4antlr ANTLR4 Grammar Action Block OutputFile.java code injection6.9 Medium
- yashpokharna2555 restaurent-management-systemyashpokharna2555 restaurent-management-system Registration login_register.php cross site scripting5.3 Medium
- kovidgoyal calibrecalibre: Arbitrary Code Execution in Template Formatter via Book Metadata8.5 High
- kestraKestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass10.0 Critical
- fluent fluentdFluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder9.8 Critical
- creative themes blocksy companion proWordPress Blocksy Companion Pro plugin <= 2.1.45 - Remote Code Execution (RCE) vulnerability8.5 High
- trellix network security nx, ex, fx, ax, and cmsA Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally...7.1 High
- revive adserver, revive-adserver revive adserver +1 moreBypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio...8.8 High
- tooljetToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution9.4 Critical
- vimVim: Arbitrary Code Execution via Python Omni-Completion Docstrings8.4 High
- post snippets snippets, saad iqbal post snippets +1 moreWordPress Post Snippets plugin <= 4.0.19 - Remote Code Execution (RCE) vulnerability8.5 High
- marketing fire widget optionsWordPress Widget Options plugin <= 4.2.3 - Remote Code Execution (RCE) vulnerability9.9 Critical
- gitlabImproper Control of Generation of Code ('Code Injection') in GitLab4.3 Medium
- siyuan-note siyuanSiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)9.0 Critical
- adegans adrotate banner managerAdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute8.8 High
- jdx misemise: Arbitrary command execution via task-include files in an untrusted, config-less repository8.6 High
- revive adserverA missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0...8.8 High
- revive adserverA missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and...8.8 High
- silentmatt expr-evalexpr-eval vulnerable to Code Execution9.2 Critical
- jdx misemise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)9.6 Critical
- autodesk fusionMCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop9.6 Critical
- angular, angular language service, angular.ng-template +2 moreAngular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension8.7 High
- angular, angular language service +1 moreAngular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension8.7 High
- ibm i, websphere application server +1 moreWebSphere Application Server Remote Code Execution8.1 High
- ibm i, websphere application server +1 moreWebSphere Application Server Remote Code Execution7.5 High
- ibm langflow oss, langflow +1 moreUnauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection10.0 Critical
- vimVim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename5.7 Medium
- mispAuthenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP8.7 High
- langflowlangflow-ai langflow Bundle URL Loader code injection4.8 Medium
- kortix-ai sunakortix-ai suna Auth Endpoint page.tsx router.push cross site scripting5.3 Medium
- craftcms cmsCraft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController8.6 High
- prefect, prefecthq prefecthq/prefect +1 moreGit Argument Injection in prefecthq/prefect9.9 Critical
- automattic woocommerceWooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php9.3 Critical
- tinacms@tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels7.8 High
- @openzeppelin wizard, wizard-cairo, wizard-stellar +2 more +4 moreOpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source3.3 Low
- q00 ouroborosOuroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)8.4 High
- cedar-policy cedar-javaCedarJava has a policy injection vulnerability8.8 High
- microsoft .net, .net framework, .net 8.0 runtime +10 more +12 more.NET Framework Elevation of Privilege Vulnerability7.8 High
- kidocode crawl4aiCrawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args10.0 Critical
- mervinpraison praisonaiPraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml7.8 High
- Show moreLoading…