CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- siyuan-note siyuanSiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)8.6 High
- metabaseMetabase: Arbitrary Code Execution via Database Connection Detail Bypass9.1 Critical
- No product listedYzmCMS Header yzmphp.php get_url cross site scripting5.3 Medium
- apidevtools json-schema-ref-parserapidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution5.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id7.7 High
- citeum openctiOpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter operator allows authenticated user to exfiltrate data and cause DoS6.5 Medium
- dspaceDSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN8.0 High
- berriai litellmLiteLLM: Custom Code Guardrails production endpoints bypass code safety checks2.1 Low
- copier-org copierCopier: trust-prefix bypass via path traversal runs tasks unprompted8.8 High
- No product listedAn issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute...9.8 Critical
- koodo-readerKoodo Reader: Remote code execution via malicious epub file8.4 High
- dataeaseDataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)8.7 High
- egroupwareRemote Code Execution Vulnerability in EGroupware8.7 High
- fossbillingFOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization8.9 High
- langroidLangroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent10.0 Critical
- pleskAn improper authorization vulnerability in the Plesk XML API allows an authenticated user to...9.9 Critical
- crater-invoice-inc cratercrater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting5.1 Medium
- mjperpinosa stumasymjperpinosa stumasy add_into_dictionary.php add_definition cross site scripting5.1 Medium
- mjperpinosa stumasymjperpinosa stumasy calculate.php eval code injection6.9 Medium
- tiddly-gittly tidgi-desktoptiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injection6.9 Medium
- stephen-kruger blueboxstephen-kruger bluebox cross site scripting5.3 Medium
- sourcecodester multi-vendor online grocery management systemSourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code injection5.3 Medium
- code-projects assessment managementcode-projects Assessment Management remove-user.php cross site scripting5.3 Medium
- code-projects assessment managementcode-projects Assessment Management view-users.php cross site scripting4.8 Medium
- codeigniter ecommerce-codeigniter-bootstrapkirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site scripting5.3 Medium
- codeigniter ecommerce-codeigniter-bootstrapkirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site scripting5.3 Medium
- vimVim: Arbitrary Code Execution via C Omni-Completion8.4 High
- vimVim: Arbitrary Code Execution via PHP Omni-Completion8.4 High
- No product listedenquirer Public Package API Enquirer.set prototype pollution5.3 Medium
- nltk, nltk nltk/nltk +1 moreUntrusted JAR Code Execution in Multiple Stanford Interface Classes in nltk/nltk7.8 High
- villatheme curcy – multi currency for woocommerce – smoothly on woocommerce 9.xCURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter5.4 Medium
- creative themes blocksy companion proWordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability10.0 Critical
- rustaurius five star business profile and schemaWordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability9.1 Critical
- craftcms cmsCraft CMS: Potential authenticated Remote Code Execution via referrer redirect8.7 High
- altium 365, enterprise server +1 morePath Traversal in Altium Git Service Allows Remote Code Execution9.4 Critical
- google chromeInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote...8.8 High
- google chromeInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote...8.8 High
- anyscale rayRay < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader8.6 High
- jaiotlink c492a-w6 wi-fi ip cameraJAIOTlink C492A-W6 4.8.30.57701411 RCE via /Anyka/config Endpoint7.7 High
- mediawikiRemote Code Execution via Unsafe Deserialization in LogItem Import5.9 Medium
- wikimedia foundation timeline, mediawiki +1 moreFull RCE using EasyTimeline Extension0.0 None
- nvidia megatron-bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause...7.8 High
- nvidia megatron-bridge, nemo megatron bridge +1 moreNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper...7.8 High
- neuml txtaitxtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function Parameter9.3 Critical
- ibm db2IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling9.8 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows10.0 Critical
- ibm langflow oss, langflow +1 moreCode Injection Vulnerability in Code Validation Endpoint9.9 Critical
- conductor-oss conductorOrkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators9.3 Critical
- siemens mendix studio pro 10.11, mendix studio pro 10.12, mendix studio pro 10.13 +23 more +25 moreA vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro...6.8 Medium
- hiyouga llama-factory, llamafactory +1 moreLLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path9.3 Critical
- Show moreLoading…