CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- facebookresearch hydraHydra: hydra.utils.instantiate with untrusted config can lead to code execution7.8 High
- omnigent-ai omnigentOmnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools8.8 High
- omnigent-ai omnigentOmnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE9.0 Critical
- spipSPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as...9.8 Critical
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass8.1 High
- spipSPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as...9.8 Critical
- aeonAeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability7.8 High
- aeonAeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerability7.8 High
- baserproject basercmsbaserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php8.6 High
- jonathan daggerhart query wranglerWordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability9.9 Critical
- n8nn8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution7.2 High
- n8nn8n before 1.123.69 Expression Injection via Resource Locator8.4 High
- n8nn8n before 1.123.69 SSRF via Edit Image Node6.0 Medium
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder6.6 Medium
- chenhg5 cc-connectchenhg5 cc-connect webhook.go authenticate code injection6.9 Medium
- splunk, splunk enterprise +1 moreRemote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise8.8 High
- splunk, splunk enterprise +1 moreCode Injection through Splunk Web Manager Configuration in Splunk Enterprise8.8 High
- splunk, splunk enterprise +1 moreRemote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise8.8 High
- logto-io logtoLogto: OS command injection vulnerability exists in the Commitlint workflow6.3 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreVolsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription6.2 Medium
- marimo-team marimomarimo < 0.23.15 Code Injection via MCP Server Configuration8.7 High
- orval-labs orvalOrval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)9.3 Critical
- orval-labs orvalOrval: Import-time RCE via schema default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: Import-time RCE via enum-typed default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli9.3 Critical
- orval-labs orvalOrval: Import-time RCE via array-items default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client9.3 Critical
- orval-labs orvalOrval: Import-time RCE via header-parameter default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)9.3 Critical
- trueconf serverA remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server...9.5 Critical
- sgoudelis ground-stationGround Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code execution9.8 Critical
- poxenstudio talebookMyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File9.4 Critical
- arcadedata arcadedbArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback8.7 High
- balbooa.com balbooa forms extension for joomlaJoomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.210.0 Critical
- unknown broken link checkerBroken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection9.0 Critical
- elct9620 kobakoKobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)10.0 Critical
- mybbMyBB: Installer database configuration RCE9.8 Critical
- vimVim: Arbitrary Ex Command Execution in C Omni-Completion7.1 High
- hmbown codewhaleCodeWhale before 0.8.64 Remote Code Execution via allow_shell8.5 High
- hmbown codewhaleCodeWhale rlm_eval before 0.8.64 Remote Code Execution8.5 High
- ohmyzshOh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files8.8 High
- aresit wp compressWordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability10.0 Critical
- cwiclyWordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability9.9 Critical
- getgrav gravGrav before 2.0.15 Arbitrary File Write via error_log9.3 Critical
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting5.3 Medium
- freecadFreeCAD: Arbitrary code execution via unsandboxed PyImport_ImportModule in PropertyPythonObject::Restore7.0 High
- gitlabImproper Control of Generation of Code ('Code Injection') in GitLab9.4 Critical
- andialbrecht sqlparsesqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes6.2 Medium
- regularlabs.com sourcerer extension for joomlaJoomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.010.0 Critical
- Show moreLoading…