CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- code-projects human resource managementcode-projects Human Resource Management Event Creation EventStore.php cross site scripting5.1 Medium
- No product listedWookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project...9.8 Critical
- No product listedNorthstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but...9.8 Critical
- internlm mindsearchInternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection10.0 Critical
- omega solution coinex cryptoOmega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting5.1 Medium
- beaverbuilder beaver builder page builder – drag and drop website builderBeaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output9.1 Critical
- roxnor wp ultimate reviewWP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)6.5 Medium
- roxnor wp ultimate reviewWP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter5.4 Medium
- smub all in one seo – ai seo plugin to boost seo rankings & traffic (schema, local seo, sitemap & seo insights)All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter6.5 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection vi…8.8 High
- hkuds vibe-tradingHKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool8.7 High
- fsspec filesystem specfsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution8.8 High
- tinylibs tinypoolTinypool: Prototype Pollution Gadget to RCE in run() options9.5 Critical
- sourcecodester student result management systemSourceCodester Student Result Management System Announcement new_announcement.php cross site scripting5.3 Medium
- tryghost ghostGhost: Remote Code Execution via Theme Translation Files7.2 High
- tryghost ghostGhost from 6.10.3 before 6.64.0 RCE via Theme Translation Files8.6 High
- ctx feed proCTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution7.2 High
- No product listedagentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding...9.8 Critical
- No product listedFinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().9.8 Critical
- No product listedFinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code.7.3 High
- No product listedvanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna...9.8 Critical
- No product listedsinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.9.8 Critical
- netbox-community devicetype-libraryNetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files6.5 Medium
- theforeman foreman, red hat satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +4 more +6 moreForeman: foreman: arbitrary code execution via safemode sandbox bypass8.8 High
- rhukster dom-sanitizerrhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting5.1 Medium
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field9.1 Critical
langflowPyPIDuplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description9.8 Critical- No product listeddeeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket...9.8 Critical
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway Remote Code Execution7.2 High
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway Improper Handling of Case Sensitivity7.2 High
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway remote code execution7.2 High
- taskclusterTaskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)8.7 High
- siteskiteWordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability10.0 Critical
- acymailing newsletter team smtp newsletterWordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability9.0 Critical
- gedelumbung hospitalmanagementgedelumbung HospitalManagement Guest Book buku_tamu.php kirim cross site scripting5.3 Medium
- No product listedDevika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner...9.8 Critical
- No product listedDevika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner...9.8 Critical
- No product listedIn DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can...9.8 Critical
- No product listedbisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api...9.8 Critical
- No product listedIn camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt...9.8 Critical
- No product listedIn camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced...9.8 Critical
- No product listedIn agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes...9.8 Critical
- watchguard fireware, fireware os +1 moreFireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution9.2 Critical
- jupyterlab, jupyterlab jupyterlite-core +1 moreJupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)6.8 Medium
- balbooa forms, balbooa.com balbooa forms extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.49.5 Critical
- dassault systèmes geovia geospatial data managerCode Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x9.9 Critical
- coolbeans1212 mateishomepage-websitecoolbeans1212 MateisHomePage-Website users.php cross site scripting5.3 Medium
- codecanyon rocket lmsCodeCanyon Rocket LMS Student Profile Image Upload cross site scripting5.1 Medium
- mwasikz robo-cafe-rmsmwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting5.1 Medium
- No product listedmetatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal...9.8 Critical
- Show moreLoading…