CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets9.1 Critical
- jenkinsIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their...8.8 High
- unknown watchman-site7WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console9.9 Critical
- opencartOpenCart Autocomplete Workflow edit.php cross site scripting5.1 Medium
- opencartOpenCart Autocomplete Workflow address.php cross site scripting5.1 Medium
- arubanetworks fabric composerUnauthenticated Remote Code Execution in HPE Networking Fabric Composer9.0 Critical
- dell powerstore 1000t, powerstore 1200t, powerstore 3000t +10 more +12 moreDell PowerStore contains a Code Injection vulnerability. An authenticated user with limited...8.8 High
- klemsan electrical electronics inc. kio (klemsan internet objects)Unauthenticated Remote Code Execution via Code Injection in Klemsan's KIO9.8 Critical
- lutece coreCode injection in the Lutece Core9.4 Critical
- No product listedAn eval() injection vulnerability in the get_list function in modules/meta_parser.py in...8.8 High
- pnpmpnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install7.5 High
- unknown typoraTypora Mermaid Rendering cross site scripting5.3 Medium
- code-projects online shopping systemcode-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting5.3 Medium
- yaojingang geoflowyaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection5.1 Medium
- yaojingang geoflowyaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting5.3 Medium
- code-projects simple inventory systemcode-projects Simple Inventory System User Registration register.php cross site scripting5.3 Medium
- code-projects employee leave managing systemcode-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting5.1 Medium
- seacmsSeaCMS err.php cross site scripting5.3 Medium
- ash-project ash aiEEx template evaluation of prompt content in AshAi enables remote code execution8.9 High
- seacmsSeaCMS Template search.php parseIf code injection6.9 Medium
- codekernel queue management systemSourceCodester Queue Management System add_customer.php cross site scripting5.3 Medium
- beetel 450tc3Beetel 450TC3 User Management cross site scripting5.1 Medium
- coppermine photo gallery photo gallery, coppermine-gallery coppermine photo gallery +1 morecoppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting5.1 Medium
- coppermine photo gallery photo gallery, coppermine-gallery coppermine photo gallery +1 morecoppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scripting5.1 Medium
- helge17 tuxguitarTuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file8.5 High
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement9.8 Critical
- ibm langflow oss, langflow +1 moreLangflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement8.8 High
- pimcorePimcore: Remote Code Execution via DataObject Class-Definition Field Name9.9 Critical
- yamcsYamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)9.9 Critical
- yamcsYamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)9.8 Critical
- flextypeFlextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint7.1 High
- yamcsYamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`9.1 Critical
- dataelement bishengBISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once8.7 High
- budibase serverBudibase before 3.41.3 Remote Code Execution via Plugin eval()9.4 Critical
- roocodeinc roo-codeRooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection5.1 Medium
- roocodeinc roo-codeRooCodeInc Roo-Code README File ExecaTerminalProcess code injection5.3 Medium
- roocodeinc roo-codeRooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection5.1 Medium
- triliumnext triliumTrilium: Note Import to RCE via Book Note9.3 Critical
- triliumnext triliumTrilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml9.3 Critical
- servicenow ai platformUnauthenticated Remote Code Execution in GraphQL Composite Data API10.0 Critical
- servicenow ai platformSandbox Escape in ServiceNow AI Platform10.0 Critical
- triliumnext triliumTrilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client9.3 Critical
- silverstripe silverstripe-userformsSilverstripe UserForms: Remote code execution via userforms email subject8.8 High
- triliumnext triliumTrilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)8.6 High
- jahlives openssl encryptopenssl_encrypt before 1.4.9 Remote Code Execution via Plugin9.3 Critical
- mims-harvard tooluniverseToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape9.3 Critical
- flowintelFlowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection7.5 High
- flowintelFlowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys8.6 High
- unknown defender securityDefender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite6.6 Medium
- unknown smushSmush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite7.2 High
- Show moreLoading…