CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite9.4 Critical
- No product listedAn issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary...9.8 Critical
- sumatrapdfreader sumatrapdfSumatraPDF: Markup/command-link injection into UI notification text8.4 High
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access6.4 Medium
- ntharim dot-accessdot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument9.3 Critical
- openprinting cupsCUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)2.5 Low
- cisco license on-premCisco License On-Prem Security Hardening Release8.8 High
- imagemagickImageMagick: Code Injection in the postscript coders5.3 Medium
- six apart ltd. movable type, movable type cloud edition, movable type premium +1 more +3 moreA code injection vulnerability exists in the upgrade script of Movable Type, which may allow an...9.3 Critical
- unknown wp coderWP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP7.2 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.8 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities7.5 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.5 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.1 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities9.8 Critical
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.1 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.8 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.8 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.8 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities9.8 Critical
- @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 moreBackstage: Improper validation of MkDocs theme configuration in TechDocs7.7 High
- aws bedrock-agentcore-starter-toolkitCode injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import8.8 High
- handlebars-lang handlebars.jsHandlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)9.8 Critical
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Authenticated Remote Code Execution Vulnerabilities in HPE Networking ClearPass Policy Manager7.2 High
- hydra-ecosystem hydraHydra logging configuration permits unsafe callable resolution7.8 High
- google chromeCode injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...5.4 Medium
- google chromeCode injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote...7.3 High
- payloadcms payloadPayload: Remote Code Execution through first-register8.1 High
- payloadcms payloadPayload: RCE in Payload Form Builder10.0 Critical
- getformwork formworkgetformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting5.1 Medium
- openapi-generators openapi-python-clientopenapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation8.4 High
- microsoft kiota, microsoft.openapi.kiota, microsoft.openapi.kiota.builder +2 moreKiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators8.8 High
- smarty-php smartySmarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache9.2 Critical
- billy bryant tabsWordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability8.0 High
- jma plugins woocommerce designer proWordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability9.9 Critical
- campcodes simple student information systemSourceCodester Simple Student Information System Profile Field register.php cross site scripting5.3 Medium
- campcodes simple student information systemSourceCodester Simple Student Information System searchresults.php clean cross site scripting5.1 Medium
- imgproxyimgproxy SVG svg.go sanitizeElement cross site scripting5.3 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System add_drug.php cross site scripting5.3 Medium
- immich-app immichImmich: Authenticated SVG upload reaches ImageMagick coders and enables RCE7.7 High
- tryghost ghostGhost: Remote Code Execution via Bookmark Card Images8.8 High
- cookpete auto-changelogauto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF8.4 High
- No product listedTallCMS PluginManager ThemeManager.php code injection5.3 Medium
- feelec-yishu feelcrm-osfeelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting5.3 Medium
- feelec-yishu feelcrm-osfeelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting5.1 Medium
- feelec-yishu feelcrm-osfeelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting5.3 Medium
- mitel mivoice office 400Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution8.4 High
- oscommerce oscommerce2osCommerce osCommerce2 Newsletter Management newsletters.php include code injection5.1 Medium
- oscommerce oscommerce2osCommerce osCommerce2 Payment payment.php include code injection4.8 Medium
- code-projects human resource management systemcode-projects Human Resource Management System Live Event History liveEventHistory.php cross site scripting5.1 Medium
- Show moreLoading…