CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- code-projects inventory management systemSourceCodester Inventory Management System Product Management products_handler.php cross site scripting5.1 Medium
- code-projects inventory management systemSourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting5.1 Medium
- code-projects inventory management systemSourceCodester Inventory Management System Customer Management customers_handler.php cross site scripting5.1 Medium
- regularlabs.com conditional content pro extension for joomlaJoomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.09.4 Critical
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System subject1.php cross site scripting5.3 Medium
- totolink a3002muTotolink A3002MU Anchor Tag cross site scripting5.1 Medium
- anil-matcha open-generative-aiAnil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting5.1 Medium
- kagisearch smallwebkagisearch smallweb Query String Rendering sw.py index cross site scripting5.3 Medium
- cym1102 nginxwebuicym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection5.3 Medium
- exrick xmallExrick xmall Order Printing order-print.jsp cross site scripting5.3 Medium
- linlinjava litemalllinlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting4.8 Medium
- linlinjava litemalllinlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting4.8 Medium
- moxi624 mogu blog v2moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting5.1 Medium
- quequnlong shiyi-blogquequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting5.1 Medium
- quequnlong shiyi-blogquequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scripting5.1 Medium
- maliangnansheng bbs-springbootmaliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting5.1 Medium
- dataeaseDataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting5.1 Medium
- tduckapp tduck-platformTDuckApp tduck-platform Form Write View index.vue cross site scripting5.1 Medium
- quequnlong shiyi-blogquequnlong shiyi-blog Add Message API index.vue cross site scripting5.3 Medium
- stilleshan serverstatusstilleshan ServerStatus Stats Generation main.cpp cross site scripting5.1 Medium
- fengoffice feng officeFengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting5.1 Medium
- sanjevirau gsubssanjevirau gsubs Electron index.js showQuerySuccessPage code injection5.3 Medium
- xuxueli xxl-jobXuxueli xxl-job insert cross site scripting5.1 Medium
- xuxueli xxl-jobXuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection5.3 Medium
- vllmvLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor8.5 High
- stellarwp the events calendarThe Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation9.8 Critical
- sgl-project sglangCVE-2026-867939.8 Critical
- unknown teddy-bear-customize-addonTeddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload10.0 Critical
- No product listedCertain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1.23 and...8.8 High
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards8.8 High
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards8.8 High
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards9.8 Critical
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards8.8 High
- ibm websphere application serverIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities6.7 Medium
- diegosouzapw omnirouteOmniRoute ACP Custom-Agent Remote Code Execution (RCE)9.5 Critical
- ateeq rafeeq repairbuddyWordPress RepairBuddy plugin <= 4.1224 - Remote Code Execution (RCE) vulnerability7.5 High
- elliot sowers/ relywp simple cloudflare turnstileWordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability6.5 Medium
- apache camel, apache software foundation camel k +1 moreApache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects9.8 Critical
- rapid7 velociraptorVelociraptor VQL injection during notebook restore from backup7.7 High
- flowiseai flowiseAn issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1...9.8 Critical
- No product listedAn issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the...6.8 Medium
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system Login Page index.php cross site scripting5.3 Medium
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system List DBOperation.php cross site scripting5.3 Medium
- gitpython-developers gitpythonGitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation8.7 High
- apache nutchApache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)8.8 High
- perforce akanaUnauthenticated Remote Code Execution in Akana API Platform10.0 Critical
gpacUbuntuAn issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary...8.4 High- No product listedAn issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46 allows a physically...9.8 Critical
- n8nn8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution8.7 High
- n8nn8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution7.7 High
- Show moreLoading…