CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- mongodb mongoidServer-side JavaScript injection via string query criteria bypassing the strict operator allowlist8.8 High
- icinga icinga2Icinga 2 DSL Injection via Unescaped Import Template Name7.2 High
- interchangeIn the interchange/interchange project, a critical remote code execution (RCE) vulnerability was...9.8 Critical
- No product listedSveltyCMS SVG Media Upload media-service.server.ts cross site scripting5.1 Medium
- patriksimek vm2vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function10.0 Critical
- unknown af companionAF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE9.1 Critical
- givanz vvvebVvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global8.8 High
- caddyserver caddyCaddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation6.3 Medium
- caddyserver caddyCaddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS6.9 Medium
- caddyserver caddyCaddy: rewrite placeholder re-expansion6.5 Medium
- grafana enterprise, oss +1 moreCVE-2026-15815 CVE Record8.8 High
- wavelogWavelog: Unauthenticated Remote Code Execution9.3 Critical
- chamilo chamilo-lmsChamilo LMS CStudio upload flow allows unauthenticated remote code execution9.8 Critical
- patriksimek vm2vm2 3.11.6 Remote Code Execution via Promise call/apply10.0 Critical
- superweby migratico liteWordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability10.0 Critical
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 8 +10 more +12 moreFlatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)7.8 High
- maennchen1.de wpshopgermany it-recht kanzleiwpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token9.0 Critical
- craftcms cmsCraft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution8.7 High
- refinedev @refinedev/inferencer@refinedev/inferencer through 7.0.0 Code Injection via API Field Names7.7 High
- hp inc ac print & scan, output central +1 moreHP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write9.3 Critical
- hp inc ac print & scan, output central +1 moreHP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write9.3 Critical
- redocly redocly-cliRedocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`7.8 High
- arista networks eosUnder certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised swit…9.2 Critical
- changeweder crmChangeWeDer crm Save Endpoint customer.serve.js cross site scripting5.1 Medium
- functional software, inc. sentry seerSentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment9.8 Critical
- sourcecodester online food ordering systemSourceCodester Online Food Ordering System Category Update update_category.php cross site scripting4.8 Medium
- scada-ltsScada-LTS Authenticated Remote Code Execution via Scripting Sandbox Bypass8.8 High
- No product listedPbootCMS Template Rendering ContentController.php decode_string cross site scripting5.1 Medium
- jenkins script security, jenkins project script security plugin +1 moreJenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the...8.0 High
- jenkins script security, jenkins project script security plugin +1 moreJenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder...8.5 High
- jenkins script security, jenkins project script security plugin +1 moreJenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the ...8.8 High
- advantech eki-1242eims, eki-1242ieims +1 moreNozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection...8.6 High
- advantech eki-1242ieims, eki-1242eims +1 moreNozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection...8.6 High
- arista networks eosSecurity Advisory 01749.5 Critical
- arista networks eosSecurity Advisory 01668.7 High
- unknown wp import export liteWP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function7.2 High
- unknown wp import export liteWP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal7.2 High
- a2ui-project a2uia2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting5.1 Medium
- No product listedAn issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote...9.8 Critical
- oracle corporation graalvm for jdk, oracle graalvmVulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component:...8.1 High
- google chromeCode injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass...8.1 High
- code-projects record management systemcode-projects Record Management System reg.php cross site scripting5.3 Medium
- phpgurukul hostel management systemPHPGurukul Hostel Management System manage-students.php cross site scripting4.8 Medium
- governikus ausweisapp desktopGovernikus AusweisApp Desktop StartPAOSResponse cross site scripting5.3 Medium
- phpgurukul daily expense tracker systemPHPGurukul Daily Expense Tracker System sidebar.php cross site scripting5.1 Medium
- michaelliao itranswarpmichaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting5.1 Medium
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software8.8 High
- itsourcecode loan management systemitsourcecode Loan Management System navbar.php cross site scripting5.3 Medium
- apache software foundation syncopeApache Syncope: Groovy Sandbox escape for empty CommandArgs6.5 Medium
- statamic cmsYot CMS Admin Console admin.php eval code injection5.1 Medium
- Show moreLoading…