CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible9.1 Critical
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was...8.8 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer...8.1 High
- jetbrains golandIn JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project...7.8 High
- jetbrains golandIn JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project...7.8 High
- wplake advanced viewsWordPress Advanced Views plugin <= 3.8.11 - Remote Code Execution (RCE) vulnerability9.9 Critical
- emarket-design customer support ticket system & helpdeskCustomer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter9.8 Critical
- n8nn8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape8.7 High
- fujitsu linux openft, oracle solaris openft +1 moreUnauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris9.3 Critical
- shepherdwind velocity.jsVelocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix)9.8 Critical
- sevenspark dtx – dynamic text extension for contact form 7Contact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution6.5 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System BSIS.php cross site scripting5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System class.php cross site scripting5.3 Medium
- typeormTypeORM: migration:generate template-literal code injection5.7 Medium
- autel maxicharger single, maxicharger single charger firmware +1 moreUnauthenticated RCE10.0 Critical
- atlassian sourcetree, sourcetree for mac +1 moreThis High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of...7.1 High
- getgrav gravGrav: Remote code execution via unrestricted callable in Blueprint::dynamicData()8.7 High
- getgrav gravGrav before 2.0.7 Remote Code Execution via Blueprint dynamicData9.3 Critical
- themexpert.com quix page builder pro extension for joomlaJoomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.18.9 High
- No product listedAn issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C...9.8 Critical
- No product listedAn issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to...6.9 Medium
- meshtastic firmwareMeshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow10.0 Critical
- itsourcecode courier management systemitsourcecode Courier Management System index.php cross site scripting5.3 Medium
- code-projects online examination systemcode-projects Online Examination System account.php cross site scripting5.3 Medium
- pluck cmsPluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting4.8 Medium
- zevorn rt-clawzevorn rt-claw Telegram-to-AI Tool Execution Flow script.c tool_run_script_execute code injection5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System forCYS.php cross site scripting5.1 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System CYS.php cross site scripting5.1 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System forexam.php cross site scripting5.1 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting5.1 Medium
- cartodb carto-api-clientCartoDB carto-api-client filters.ts addFilter prototype pollution5.3 Medium
- robinherbots inputmaskRobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution5.3 Medium
- scikit-hep uprootuproot 5.7.4 and prior Code Injection via TStreamerInfo Metadata8.5 High
- broadcom vmware avi load balancer, vmware avi load balancer +1 moreVMware Avi Load Balancer Remote Code Execution Vulnerability8.7 High
- broadcom vmware avi load balancer, vmware avi load balancer +1 moreVMware Avi Load Balancer Remote Code Execution Vulnerability8.7 High
- ibm langflow oss, langflow +1 moreParameter Injection Vulnerability in API Graph Execution Engine8.8 High
- ibm langflow oss, langflow +1 moreRemote Code Execution via Code Validation Endpoint9.9 Critical
- ibm langflow oss, langflow +1 moreArbitrary Code Execution in Python Interpreter Component9.9 Critical
- ibm langflow oss, langflow +1 morePolicies Component Dynamic CodeInput Fields Bypass Custom Component Validation9.9 Critical
- astrbotdevs astrbotAstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting5.1 Medium
- ibm langflow, langflow oss +1 moreUnauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation9.8 Critical
- ibm db2IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control7.8 High
- sagold json-schema-librarysagold json-schema-library propertyDependencies.ts parsePropertyDependencies prototype pollution5.3 Medium
- No product listedAn issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute...9.1 Critical
- arcadedata arcadedbArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts8.6 High
- nuclioNuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE8.0 High
- mwtcmi frogmanFrogman: Dialplan template parameters interpolated into extensions_custom.conf without escaping9.9 Critical
- microsoft promptyPrompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader8.7 High
- microsoft kiotaKiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName9.3 Critical
- microsoft kiotaKiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`9.3 Critical
- Show moreLoading…