CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- flowiseai flowiseFlowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified9.2 Critical
- flowiseai flowiseFlowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override9.4 Critical
- dromara lamp-cloudLAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution8.7 High
- vibesurf-ai vibesurfvibesurf-ai VibeSurf Python Validation code code injection6.9 Medium
- flowiseai flowise, flowise-components +1 moreFlowise RCE via TypeORM DataSource9.0 Critical
- unknown create block themeCreate Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)8.0 High
- vimAn issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code...7.7 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability6.1 Medium
- tenable, inc. sensor proxySensor Proxy Version 1.4.2 Fixes One Vulnerability9.3 Critical
- No product listedOpenAkita File Upload API upload cross site scripting2.3 Low
- websitebaker org e.v. cmsWebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor8.6 High
- getgrav gravGrav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint8.6 High
- wpchill kali forms — contact form & drag-and-drop builderKali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter8.1 High
- hugging face sentence-transformerssentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False9.3 Critical
- savonrb savonSavon::Model evaluates WSDL operation names as Ruby source8.1 High
- innotim software, telecommunications and consulting trade ltd. co. logsign siemUnauthenticated RCE in Innotim Software's Logsign SIEM9.8 Critical
- unknown elementskit elementor addonsElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)7.2 High
- No product listedAn issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary...9.8 Critical
- ibm langflow oss, langflow +1 moreRemote Code Execution in CUGA Component CodeAgent9.9 Critical
- amazon amplify codegen uiIncomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react6.4 Medium
- masci banksBanks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE7.5 High
- ibm langflow oss, langflow +1 morePython Interpreter Sandbox Bypass Leading to Sensitive Data Exposure9.9 Critical
- unknown remote apiRemote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter9.0 Critical
- google chromeInappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a...8.8 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies8.3 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped enum string values8.3 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template8.3 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template8.3 High
- stylemixthemes cost calculator builder proCost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter9.8 Critical
- iqonicdesign streamitStreamit < 4.5.2 - Unauthenticated Remote Code Execution via Arbitrary Function Call9.8 Critical
- koxudaxi datamodel-code-generator`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field8.8 High
- koxudaxi datamodel-code-generator`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data7.8 High
- koxudaxi datamodel-code-generatordatamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements7.5 High
- koxudaxi datamodel-code-generator`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description7.8 High
- koxudaxi datamodel-code-generator`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator7.8 High
- koxudaxi datamodel-code-generator`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field7.8 High
- artica tech proxy, articatech artica proxy +1 moreArtica Proxy 4.50 Session Fixation via fw.login.php7.5 High
- owen2345 camaleon-cmsCamaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field8.7 High
- balbooa.com balbooa forms component for joomlaJoomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.310.0 Critical
- cribl streamCode Injection in JSON Pointer Processing Component in Cribl Stream8.7 High
- unknown facturaone para woocommerce con verifactuWP FacturaONE < 5.37 - Unauthenticated Remote Code Execution9.0 Critical
- koxudaxi datamodel-code-generatordatamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field7.5 High
- jandedobbeleer oh-my-poshOh My Posh: Arbitrary command execution via template injection in the path segment7.8 High
- openidentityplatform openamOpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback9.8 Critical
- microsoft promptyPrompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer10.0 Critical
- microweberMicroweber CMS 2.0.20 Server-Side Template Injection via Mail Templates8.6 High
- devolutions powershell universalImproper control of generation of code ('Code Injection') in the variables feature in Devolutions...8.8 High
- devolutions powershell universalImproper control of generation of code ('Code Injection') in the schedule feature in Devolutions...8.8 High
- calcom cal.diyCal.com before 5.9.9 Remote Code Execution via RSC10.0 Critical
- gpsdgpsd gpsprof Code Injection via SKY.satellites used Field8.5 High
- Show moreLoading…