CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- code-projects online shopping systemcode-projects Online Shopping System offersmail.php cross site scripting5.3 Medium
- webkul bagistoWebkul Bagisto RMA Message send-message cross site scripting5.1 Medium
- belkin ax1800, gl.inet a1300, axt1800 +14 more +16 moreGL.iNet XE3000 Language Update ui.update_langs code injection5.3 Medium
- No product listedAn issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox...7.8 High
- No product listedAn issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the...9.8 Critical
- No product listedAn issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files...9.8 Critical
- No product listedAn issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint...9.8 Critical
- No product listedAn issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code...9.8 Critical
- No product listedA Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine...9.8 Critical
- jij-inc jij-mcp-serverJij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection5.1 Medium
- iatsiuk pptr-mcpiatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection5.3 Medium
- kilbot wcpos – point of sale (pos) plugin for woocommerceWCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine7.2 High
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name…5.4 Medium
- defaultfuction notice-system-managentDefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection5.3 Medium
- code-projects online shopping systemcode-projects Online Shopping System checkout.php cross site scripting5.1 Medium
- code-projects online food order systemcode-projects Online Food Order System edit_food_items.php cross site scripting5.1 Medium
- sourcecodester online book store systemSourceCodester Online Book Store System System Settings index.php site_settings cross site scripting4.8 Medium
- impresscmsImpressCMS Authenticated RCE via PHP Custom Tag eval()8.6 High
- mindsdb minds platformMindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()10.0 Critical
- devolutions powershell universalImproper control of generation of code ('Code Injection') in the settings feature in Devolutions...8.1 High
- getgrav gravGrav CMS before 2.0.13 Remote Code Execution via ZIP Upload8.7 High
- elastic fleet server, kibana +1 moreImproper Control of Generation of Code in Fleet Server Leading to Code Injection6.5 Medium
- hakan ozevin wp base bookingWordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability10.0 Critical
- quarka qa analyticsWordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability10.0 Critical
- flowiseai flowiseFlowise before 3.1.3 Prompt Injection RCE via CSV Agent9.0 Critical
- flowiseai flowiseFlowise before 3.1.3 Code Injection via CSV Agent customReadCSV9.0 Critical
- flowiseai flowiseFlowise before 3.1.3 Remote Code Execution via Airtable Agent9.0 Critical
- palo alto networks globalprotect app, paloaltonetworks globalprotect +1 moreGlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)5.2 Medium
ruby-amazing-printDebianamazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby...8.4 High- ibm i access client solutionsIBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities7.8 High
- sepinetam mcp-for-stataMCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`8.4 High
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreCluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection9.9 Critical
- progress whatsup goldWhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.9.8 Critical
- progress whatsup goldWhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI8.0 High
- seerr-team seerrSeerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag7.1 High
- fabrikar.com fabrik extension for joomlaJoomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.810.0 Critical
- unknown wpmudev-updatesWPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action9.8 Critical
- kovidgoyal calibrecalibre: Bypass of Python template restrictions via nested `template()` leading to RCE8.5 High
- sonicwall email securityImproper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email...7.8 High
- sonicwall email securityImproper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email...7.8 High
- sonicwall gmsAn authenticated command injection vulnerability was identified in GMS Command-Line Interface ...6.3 Medium
- sonicwall gmsAn unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service...9.4 Critical
- sonicwall gmsAn unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510...9.1 Critical
- freecadFreeCAD: FEM formula incomplete escape8.5 High
- papersgpt papersgpt-for-zoteroPapersGPT for Zotero 0.6.1 RCE via Unsanitized LLM Response eval()9.4 Critical
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes5.3 Medium
- microsoft powershell, powershell 7.6, microsoft powershell 7.4 +1 more +3 moreMicrosoft PowerShell Security Feature Bypass Vulnerability7.8 High
- microsoft visual studio codeVisual Studio Code Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint, sharepoint server, sharepoint enterprise server 2016 +2 more +4 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability8.8 High
- activepiecesActivepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint6.1 Medium
- Show moreLoading…