CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- orval-labs orvalorval @orval/hono before 8.29.0 Code Injection via OpenAPI Path9.3 Critical
- gnu emacs emacs, open source gnu emacs, red hat enterprise linux 10 +4 more +6 moreEmacs: emacs: arbitrary code execution in flymake mode7.8 High
- unknown yahman add-onsYAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache9.0 Critical
- onsite internet gmbh auktion ng auktionssoftwareonSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting5.3 Medium
- sourcecodester smart attendance system with qr code scannerSourceCodester Smart Attendance System with QR Code Scanner Self-Registration student_signup.php prepend cross site scripting5.3 Medium
webpyDebianwebpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can...8.5 High- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities9.8 Critical
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)8.3 High
- dgtlmoon changedetection.iodgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting5.1 Medium
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)9.9 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)10.0 Critical
- mtrano apencmsmtrano APENCMS Template weasel.php eval code injection4.8 Medium
- sfturing hosp ordersfturing hosp_order Public Search Handlers HospitalController.java cross site scripting5.3 Medium
- roxnor wp ultimate reviewWP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter8.1 High
- xuxueli xxl-jobxuxueli xxl-job insert cross site scripting5.1 Medium
- openstack octaviaIn OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and...9.4 Critical
- openstack octaviaIn OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters...9.4 Critical
- hyve5 leantimeHyve5 Leantime Project Dashboard show.blade.php cross site scripting4.8 Medium
- hyve5 leantimeHyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting5.1 Medium
- omega solution hrm osOmega Solution HRM OS SVG File Upload view cross site scripting4.8 Medium
- xuxueli xxl-jobxuxueli xxl-job Task Management JobInfoController.java cross site scripting5.1 Medium
- No product listedRooCMS Frontend Rendering site_pagePHP.php eval code injection5.1 Medium
- No product listedA remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (...9.8 Critical
- No product listedA remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (...9.8 Critical
- No product listedIncorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote...9.8 Critical
- newbee-ltd newbee-mallnewbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting5.1 Medium
- ordasoft.com ordasoft joomla gallery extension for joomla, ordasoft joomla gallery free extension for joomla +1 moreJoomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.79.4 Critical
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System index.php cross site scripting5.3 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System Password Change change_password cross site scripting5.1 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System User Management add_user cross site scripting5.1 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System add_symptom cross site scripting4.8 Medium
- vanderbilt redcapAn unauthenticated Remote Code Execution vulnerability was found in the survey passthrough...9.8 Critical
- No product listedDedeCMS mytag_js.php code injection6.9 Medium
- code-projects assessment managementcode-projects Assessment Management add-single-mark.php cross site scripting5.1 Medium
- code-projects assessment managementcode-projects Assessment Management add-user.php cross site scripting4.8 Medium
- code-projects assessment managementcode-projects Assessment Management User Editing edit-user.php cross site scripting4.8 Medium
- unknown forminator formsForminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection8.5 High
- olivier-ls php-ftsolivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting5.1 Medium
- openpanel-dev openpanelOpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE9.4 Critical
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Fie…8.1 High
- sebwordpress the welcomizerThe Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter8.8 High
- pdfcrowd save as pdf plugin by pdfcrowdSave as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute8.8 High
- brechtvds wp recipe makerWP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content9.1 Critical
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter9.1 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.9.8 Critical
- Show moreLoading…