CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- auth0 ad/ldap connectorLocal Privilege Escalation in Auth0 AD/LDAP Connector7.8 High
- okta access gatewayInsufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration6.7 Medium
- okta access gatewayImproper Input Sanitization in Okta Access Gateway Application Label Configuration6.6 Medium
- adobe animate, animate 2023, animate 2024 +2 moreAnimate | Improper Control of Generation of Code ('Code Injection') (CWE-94)8.2 High
- instantsoft icms2InstantCMS has Remote Code Execution in package installer5.5 Medium
- microsoft remote desktop client, remote desktop client for windows desktop +1 moreRemote Desktop Client Remote Code Execution Vulnerability8.8 High
- microsoft dynamics 365, dynamics 365 customer engagement v9.1 +1 moreMicrosoft Dynamics 365 On-Premises Remote Code Execution Vulnerability8.8 High
- aircheng-org iwebshop-5aircheng-org iWebShop-5 pic.php uploadFile cross site scripting5.3 Medium
- craftcms cmsCraft CMS before 5.10.12 Remote Code Execution via element-index8.7 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE8.7 High
- star7th showdocstar7th showdoc API Page Save Endpoint editormd.js cross site scripting5.1 Medium
- beaverbuilder beaver builder page builder – drag and drop website builderBeaver Builder Page Builder <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution6.5 Medium
- siemens desigo cc clickonce client v6, desigo cc clickonce client v7, desigo cc family v8 +5 more +7 moreA vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC...8.6 High
- No product listedAn issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via...9.8 Critical
- No product listedIn Halo <= 2.25.4, the plugin management feature allows users to install/update malicious plugins...4.6 Medium
- No product listedA code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. An authenticated...8.8 High
- microsoft .net, .net 10.0 runtime, .net 11.0 runtime +5 more +7 more.NET Elevation of Privilege Vulnerability7.0 High
- knowns-dev knownsknowns before 0.30.0 Arbitrary Code Execution via LSP Binary8.5 High
- icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpressEmail Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field6.5 Medium
- code-projects hospital information systemcode-projects Hospital Information System Patient Management editPatient.php cross site scripting5.1 Medium
- sourcecodester simple traffic offense systemSourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting5.3 Medium
- sourcecodester syllabus-aligned learning management & examination systemSourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting5.3 Medium
- sfturing ssm prosfturing ssm_pro Order Endpoint OrderController.java cross site scripting5.3 Medium
- No product listedFastAdmin User Controller User.php login cross site scripting5.3 Medium
- code-projects online examination systemprojectworlds Online Examination System Feedback Form feedback.php cross site scripting5.3 Medium
- projectwolds online attendance systemProjectwolds Online Attendance System profile.php cross site scripting5.1 Medium
- code-projects hotel and tourism reservation in phpcode-projects Hotel and Tourism Reservation in PHP details.php cross site scripting5.3 Medium
- brokercap bifrostUnauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds8.1 High
- code-projects task management systemcode-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting5.1 Medium
- pickplugins post gridPost Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection9.8 Critical
- wpmudev hummingbird performance – cache & page speed optimization for core web vitals | critical css | minify css | defer css javascript | cdnHummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log9.8 Critical
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint8.8 High
- lavague-ai lavagueLaVague 0.2.35 Remote Code Execution via eval extraction9.2 Critical
- aider-ai aideraider 0.86.2 Remote Code Execution via .aider.conf.yml8.5 High
- aaif-goose goosegoose 1.37.0 Arbitrary Command Execution via Recipe Extensions8.7 High
- openpanel-dev openpanelOpenPanel before 2.3.0 Remote Code Execution via chart formulas8.7 High
- getgrav gravGrav before 2.0.18 Remote Code Execution via sort filter8.7 High
- unknown hummingbird performanceHummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite7.2 High
- eleveo quality managementEleveo Quality Management Conversation Review cross site scripting5.1 Medium
- eleveo call recording softwareEleveo Call Recording Software roleAddAction.do cross site scripting5.1 Medium
- light0011 cmslight0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting5.3 Medium
- No product listedAn issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core...9.8 Critical
- No product listedIn DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users...9.8 Critical
- itsourcecode online medicine delivery systemitsourcecode Online Medicine Delivery System index.php cross site scripting5.1 Medium
- elastic kibanaImproper Control of Generation of Code in Kibana Leading to Privilege Escalation4.3 Medium
- geonetwork core-geonetworkGeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter9.1 Critical
- seacmsSeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection6.9 Medium
- n8nn8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak8.7 High
- langgenius difylanggenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting5.1 Medium
- langgenius difylanggenius dify Splash Layout splash.tsx router.replace cross site scripting5.3 Medium
- Show moreLoading…