CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft kiotaKiota: Code Generation Literal Injection in the PHP Generator8.7 High
- microsoft kiotaKiota: Code Generation Literal Injection in the Python Generator7.5 High
- microsoft kiotaKiota: Code Generation Literal Injection in Kiota Ruby Generator7.5 High
- microsoft kiotaKiota: XML Doc-Comment Newline Breakout Code Injection8.7 High
django-haystackDebiandjango-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection5.1 Medium- maaassistantarknightsMaaAssistantArknights: PR-title expression injection in release-preparation.yml8.8 High
- dataeaseDataEase: RCE Vulnerability9.0 Critical
- taosdata tdengineTDengine: UDF lead to RCE7.2 High
- mervinpraison praisonaiPraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery8.6 High
- mervinpraison praisonaiPraisonAI before 4.6.78 Code Injection via API deployment generator8.5 High
- getgrav gravGrav Flex Objects - Server-Side Template Injection via Dynamic Titles8.7 High
- No product listedxszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server...9.8 Critical
- skylot jadxjadx: RCE Via Groovy Code Injection in Gradle Export8.4 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)9.9 Critical
- sonicwall sma1000, sma1000 appliances, sma6210 firmware +2 more +4 morePost-authentication improper control of generation of code ('Code Injection') vulnerability has...7.2 High
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System exam.php cross site scripting5.3 Medium
- microsoft windows admin centerWindows Admin Center Information Disclosure Vulnerability6.5 Medium
- No product listedtamagui config.ts updateConfig prototype pollution5.3 Medium
- spencermountain compromisespencermountain compromise Public Root API extend.js nlp.extend prototype pollution5.3 Medium
- kofrasa mingokofrasa mingo Update API updateMany prototype pollution5.3 Medium
- svgdotjs svg.jssvgdotjs svg.js npm Package API EventTarget.on prototype pollution5.3 Medium
- code-projects online job portalcode-projects Online Job Portal DetailJob.php cross site scripting5.1 Medium
- No product listedAn issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute...9.8 Critical
- clickhouse dbtanstack db Alias Path select.ts select prototype pollution5.3 Medium
- antv layoutantv layout object.js setNestedValue prototype pollution5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System subject.php cross site scripting5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System forsubject.php cross site scripting5.3 Medium
- cedar-policy cedar-javaCedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilities8.8 High
- servicenow ai platformSandbox Escape in ServiceNow AI Platform9.5 Critical
- decidimDecidim: HTML content blocks allow stored script execution4.8 Medium
- mura software cmsRemote code execution in Mura Software’s CMS9.3 Critical
- thales cert suspiciousRemote Code Execution vulnerability in "Suspicious" application9.2 Critical
- realtyna organic idx pluginWordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability10.0 Critical
- centreon infra monitoringA user with low privileges can inject SSTI templates that can lead to RCE in open-tickets9.6 Critical
- primefaces primereactprimefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution5.3 Medium
- No product listedDedeCMS Column Management search.php code injection5.1 Medium
- sourcecodester online book store systemSourceCodester Online Book Store System User Management cross site scripting4.8 Medium
- pig-mesh pigpig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection5.3 Medium
- vnotex vnotevnotex vnote YAML Frontmatter markdownit.js cross site scripting5.1 Medium
- soniccloudorg sonic-agentSonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injection6.9 Medium
- akpali9 attendance-management-systemAkpali9 Attendance-Management-System absent.php cross site scripting5.1 Medium
- igweze wizgradeigweze wizgrade studentConductManager.php cross site scripting5.3 Medium
- mervinpraison praisonaiPraisonAI before 1.6.78 Remote Code Execution via CodeAgent10.0 Critical
- smackcoders wp ultimate csv importer – wordpress import & export for csv, xml & excelWP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter8.8 High
- getgrav gravGrav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)6.5 Medium
- getgrav gravGrav before 2.0.2 Config Exfiltration via offsetGet Filter7.1 High
- mervinpraison praisonaiPraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation9.1 Critical
- mervinpraison praisonaiPraisonAI before 4.6.78 Code Injection via f-string9.4 Critical
- No product listedMyEMS Admin Backend svg.py on_post cross site scripting4.8 Medium
- nousresearch hermes-agentNousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scripting5.1 Medium
- Show moreLoading…