CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- vimVim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`8.4 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreDbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute8.8 High
- sap se commerce cloud (data hub adapter)Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)10.0 Critical
- sap se manufacturing integration and intelligenceCode Injection vulnerability in Manufacturing Integration and Intelligence9.1 Critical
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.4 +2 moreFeast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalation5.5 Medium
- firecrawlFirecrawl: Arbitrary file read via JSON Schema $ref expansion9.3 Critical
- spipSPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite7.7 High
- aaif-goose goosegoose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor7.0 High
- apache rangerApache Ranger: Remote Code Execution via JDBC URL Injection9.8 Critical
- apache rangerApache Ranger: Remote Code Execution via Arbitrary Class Instantiation9.8 Critical
- apache rangerApache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator9.8 Critical
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.210.0 Critical
- code-projects task management systemcode-projects Task Management System CommentSave.php cross site scripting5.3 Medium
- openyakOpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution9.6 Critical
- sourcecodester photo share websiteSourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scripting5.1 Medium
- sonatype nexus repository 3, nexus repository manager +1 moreNexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API8.7 High
- sourcecodester photo share websiteSourceCodester Photo Share Website index.php home cross site scripting5.1 Medium
- gitpython-developers gitpythonGitPython before 3.1.58 Remote Code Execution via Repo.init7.7 High
- phpgurukul company visitor management systemPHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting4.8 Medium
- No product listedDataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting4.8 Medium
- mermaid-js mermaidMermaid allows CSS injection applying to sibling elements of the diagram5.3 Medium
- foundationagents metagptFoundationAgents MetaGPT code injection4.8 Medium
- foundationagents metagptFoundationAgents MetaGPT data_interpreter.py DataInterpreter code injection4.8 Medium
- webappick ctx feedWordPress CTX Feed plugin <= 6.6.42 - Remote Code Execution (RCE) vulnerability9.1 Critical
- wbolt.com spider analyser – wordpress搜索引擎蜘蛛分析插件WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability10.0 Critical
- muffingroup bethemeWordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability9.9 Critical
- ttttonyhe oblogttttonyhe OBlog tags.php cross site scripting5.3 Medium
- agentfront frontmcpFrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool9.3 Critical
- @clerk nuxtNuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props8.1 High
- nuxt devtoolsNuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution9.6 Critical
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code7.8 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling8.5 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling8.5 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling8.8 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling8.1 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling8.8 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling8.8 High
- jenkins project multijob pluginJenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that...8.8 High
- electronElectron: DevTools JavaScript Injection via Unsanitized Dock State Parameter5.7 Medium
- iot-ecology rust-iot-platformrust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation9.8 Critical
- eclipse mojarraIn Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not...7.5 High
- absmach magistralaMagistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine8.8 High
- magicblack maccms10MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE7.2 High
- maxsite cmsMaxSite CMS Unauthenticated RCE via Install Endpoint9.3 Critical
- flowiseai flowiseFlowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability9.5 Critical
- flowiseai flowiseFlowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation9.4 Critical
- flowiseai flowiseFlowise RCE via SQLite Record Manager Node9.4 Critical
- samsung open source oneA vulnerability allowing remote unauthenticated code execution on the agent host.10.0 Critical
- samsung open source oneA vulnerability allowing a high-privileged user to execute arbitrary code on the server.8.6 High
- flowiseai flowiseFlowise: Remote Code Execution Vulnerability in CSVAgent9.4 Critical
- Show moreLoading…