CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedOpen GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other...9.8 Critical
- No product listedAn issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0...9.8 Critical
- No product listedAn issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote...9.8 Critical
- open source robotics foundation robot operating system 2 (ros 2)Unsafe use of eval() method in ros2 topic hz tool8.6 High
- eleveo call recording softwareEleveo Call Recording Software Play Audio audio.jsp cross site scripting5.1 Medium
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)8.6 High
- sangoma freepbx, freepbx security-reporting +1 moreAuthenticated Remote Code Execution via Path Traversal in FreePBX Backup Module8.6 High
- langflow-ai langflowLangflow Code Execution via eval() in Component Input Schema2.1 Low
- unslothai unsloth, unsloth-zoo +1 moreUnsloth Zoo Code Injection via model_type in config.json8.6 High
- innotim software, telecommunications and consultancy trade ltd. co. logsign siemCode Injection in Innotim Software's Logsign SIEM8.8 High
- syed balkhi wpformsWPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation6.5 Medium
- amirsanni mini-inventory-and-sales-management-systemamirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting5.1 Medium
- krayin laravel-crmKrayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting4.8 Medium
- zhistaredu startrainingzhistaredu StarTraining application.yml cross site scripting2.1 Low
- zhistaredu startrainingzhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting5.1 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting5.3 Medium
- ad inserter inserter, unknown ad inserter +1 moreAd Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields7.5 High
- heymrun heymHeym before 0.0.53 Authentication Bypass via Telegram Webhook8.3 High
- heymrun heymHeym before 0.0.53 Slack Webhook Signature Verification Bypass8.3 High
- heymrun heymHeym before 0.0.53 Remote Code Execution via eval() Sandbox Escape8.7 High
- heymrun heymheym before 0.0.91 Remote Code Execution via Expression Engine8.7 High
- lomart up, lomart.fr up plugin for joomla +1 moreJoomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.299.4 Critical
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting5.3 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting5.1 Medium
- horilla horilla-hrHorilla: Authenticated RCE in Horilla List-View Export8.8 High
- horilla horilla-hrHorilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata6.5 Medium
- krayin laravel-crmKrayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting5.1 Medium
- krayin laravel-crmkrayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting5.1 Medium
- zammadZammad: AI Agent template sanitizer bypass leads to remote code execution8.6 High
- zhonglun cloudposZhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injection6.9 Medium
- sheshbabu zensheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scripting5.1 Medium
- ail project frameworkStored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names5.1 Medium
- clavaque s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptionss2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return8.8 High
- cyber-iii student-management-systemningzichun student-management-system addLog.php echo cross site scripting5.3 Medium
- yunaiv ruoyi-vue-proYunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting5.3 Medium
- volotat anagnorisisvolotat Anagnorisis Media Filename PlaylistManager.js html cross site scripting5.1 Medium
- hcl software compassShell script injection via server-supplied database name in Open MongoDB shell7.3 High
- No product listedDbGate JSON Runner runners.js code injection5.3 Medium
- excalidrawExcalidraw Imported File restore.ts cross site scripting5.3 Medium
- papercut ng/mfPaperCut NG/MF: Remote Code Execution via Scripting Subsystem7.5 High
- huanzi-qch base-adminhuanzi-qch base-admin Add User CommonController.java save cross site scripting5.1 Medium
- No product listedAn issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary...8.8 High
- No product listedAn issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary...9.8 Critical
- No product listedSEMCMS KindEditor Upload upload_json.php cross site scripting5.3 Medium
- openc3 cosmosOpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)9.9 Critical
- orval-labs orvalorval before 8.29.0 Code Injection via operationId9.3 Critical
- orval-labs orvalorval @orval/core before 8.28.0 Code Injection via Form-Data9.3 Critical
- orval-labs orvalorval before 8.29.0 Code Injection via unescaped OpenAPI media-type9.3 Critical
- orval-labs orvalorval before 8.30.0 Code Injection via Factory Generation9.2 Critical
- orval-labs orvalorval @orval/effect 8.14.0 through 8.28.1 Code Injection9.3 Critical
- Show moreLoading…