CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- heymrun heymheym Python Tool Sandbox Escape8.8 High
- storyicon comfyui segment anythingstoryicon comfyui_segment_anything GroundingDINO Model Loading slconfig.py SLConfig._file2dict code injection5.3 Medium
- paddlepaddle paddlexPaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.__init__ code injection5.3 Medium
- tinyllava factoryTinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_tinyllava.py _load_text_config code injection5.3 Medium
- imoonlab yolov13iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection4.8 Medium
- repository raerepository RAE Config-Driven Model Instantiation model_utils.py get_obj_from_str code injection2.4 Low
- sap se s/4hana (manage substitution/validation rules)Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)9.9 Critical
- modeltc lightx2vModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained code injection4.8 Medium
- philz1337x clarity-upscalerphilz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting5.1 Medium
- No product listedAn issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3...9.8 Critical
- microsoft .net 10.0 installed on linux, .net 10.0 installed on mac os, .net 10.0 installed on windows +10 more +12 moreASP.NET Core Remote Code Execution Vulnerability8.8 High
- linketic citygaussianLinketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection2.4 Low
- ibm iIBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI9.9 Critical
- edimax br-6208acEdimax BR-6208AC QoS Page formQoS cross site scripting4.8 Medium
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data Code Injection8.8 High
- edimax br-6208acEdimax BR-6208AC Port Forwarding formPortFw cross site scripting4.8 Medium
- edimax br-6208acEdimax BR-6208AC HTTP Blocking formUrlb cross site scripting4.8 Medium
- edimax br-6208acEdimax BR-6208AC formFilter cross site scripting4.8 Medium
- ibm maximo ai serviceMaximo AI Service Code Injection9.8 Critical
- netcore nr268Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting5.3 Medium
- ibm maximo application suite - location service for esri componentIBM Maximo Application Suite - Location Service for Esri Component Code Execution6.5 Medium
- ibm maximo application suite - location service for esri componentIBM Maximo Application Suite - Location Service for Esri Component Code Execution8.7 High
- netcore nr268Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting5.3 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting5.3 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System Student Registration add_student.php cross site scripting5.3 Medium
- netcore nr268Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting4.8 Medium
- vrana adminerAdminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass8.6 High
- craftcms cmsCraft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection8.7 High
- theliaCVE-2026-1072488.8 High
- netis wf2409eNetis WF2409E Wireless Settings cross site scripting5.1 Medium
- theliaCVE-2026-1035375.4 Medium
- theliaCVE-2026-1035358.8 High
- logicaldoc community editionLogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template8.7 High
- cairo-dock glx-dockCairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting5.3 Medium
- zen cart cartZen Cart Administrative Module Management general.php zen_call_function code injection2.1 Low
- agnoagno-agi agno PythonTools python.py run_python_code code injection5.3 Medium
- No product listedidcCMS member_deal.php cross site scripting5.1 Medium
- y project ruoyiy_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting5.1 Medium
- instantsoft icms2InstantSoft icms2 Private Message index.tpl.php index cross site scripting5.1 Medium
- kutethemes boutiqueWordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability6.5 Medium
- royal plugins sitevault – backup, restore, migration & cloningWordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability10.0 Critical
- everestthemes everest backupWordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability8.1 High
- floci-io flociFloci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates9.3 Critical
- decolua 9router9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint7.3 High
- villatheme thank you page customizer for woocommerceWordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability7.5 High
- ferdikoomen openapi-typescript-codegenopenapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates9.3 Critical
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field9.1 Critical
- hostspa fastcache by host.itFastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting7.2 High
- @tinacms cli, tinacms +1 moreTina: Code injection via unescaped Git branch name in generated client source8.2 High
- smartertools smartermailSmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount8.6 High
- Show moreLoading…