CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- storybookjs storybookStorybook dev server: devices on the same network can obtain the WebSocket token and write code into story files8.7 High
- mindsdbMindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability8.8 High
- storybookjs storybookStorybook: Missing origin validation in Storybook preview allows code injection from malicious websites8.6 High
- cisco telepresence video communication server (vcs) expresswayCisco Expressway Series Software Hardening Release: October 2026 - Code Injection Vulnerabilities7.8 High
- itsourcecode online cake ordering systemitsourcecode Online Cake Ordering System 404.php cross site scripting5.3 Medium
- vllmvLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision9.2 Critical
- pypa virtualenvvirtualenv activation scripts run code from a path that contains a placeholder name7.8 High
- pypa virtualenvvirtualenv: Xonsh activation literals depend on the script decoding codec7.1 High
- vitest-dev vitest, @vitest mocker +1 moreVitest: Code injection via unauthenticated manual mock registration4.7 Medium
- opensource-socialnetworkopensource-socialnetwork Cache Settings dynamic.php input code injection4.8 Medium
- optimal idm optimalcloudOptimal IdM OptimalCloud Login cross site scripting5.3 Medium
- advantech adam-3600A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution...8.6 High
thefuckDebianAn issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the...7.8 High- h3c magic nx15H3C Magic NX15 RPC esps write code injection9.4 Critical
- craftcms cmsCraft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout8.7 High
- craftcms cmsCraft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection8.7 High
- craftcms cmsCraft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection8.7 High
- craftcms cmsCraft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable8.7 High
- grandnode grandnode2grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting4.8 Medium
- wuxi wubang security software five-in-one safety production management information systemWuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting5.3 Medium
- wso2 api manager, carbon identity application authentication framework, carbon identity recovery management +8 more +10 moreExpression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations2.7 Low
- andialbrecht sqlparsesqlparse through 0.6.0 PHP Code Injection via output_format='php'8.4 High
- llsourcell doctor-dignityllSourcell Doctor-Dignity chat_module.py _get_lib_module code injection5.3 Medium
- apache software foundation camelApache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages8.8 High
- axa group nlp.jsAXA Group NLP.js Condition Expression Pipeline evaluator.js Evaluator.walkFunction code injection5.3 Medium
- No product listedDeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ code injection5.1 Medium
- hivepressWordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability9.9 Critical
- No product listedDeepPavlov Config Reference Resolver params.py resolve code injection5.3 Medium
- sourcecodester inventory systemSourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting5.1 Medium
- sourcecodester inventory systemSourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting5.1 Medium
- sourcecodester inventory systemSourceCodester Inventory System Product Management products_handler.php save cross site scripting5.1 Medium
- subhajitkhan online-clinic-management-systemsubhajitkhan online-clinic-management-system feedback.php cross site scripting5.3 Medium
- subhajitkhan online-clinic-management-systemsubhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting5.3 Medium
- llamachinese llama-chineseLlamaChinese Llama-Chinese Adapter Config chat_gradio_no_merge.py get_class_from_dynamic_module code injection5.3 Medium
- rvc-project retrieval-based-voice-conversion-webuiRVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection5.3 Medium
- diem-project diemdiem-project diem dmWidget dmBaseLinkTag.php text cross site scripting5.1 Medium
- diem-project diemdiem-project diem Administrative Console actions.class.php append cross site scripting4.8 Medium
- diem-project diemdiem-project diem Version Check Service dmAdminCtrl.js html cross site scripting4.8 Medium
- chamilo lmsChamilo LMS Ticket TicketManager.php addProject cross site scripting5.1 Medium
- wongkinyiu yolov9WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code injection5.3 Medium
- automatic1111 stable-diffusion-webuiAUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting5.3 Medium
- automatic1111 stable-diffusion-webuiAUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection5.3 Medium
- automatic1111 stable-diffusion-webuiAUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting5.3 Medium
- hivepressWordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability6.5 Medium
- hrisikeshpal blood bank management systemhrisikeshpal Blood_Bank_Management_System abs.php cross site scripting5.3 Medium
- dext34-morgan books4cashdext34-morgan Books4Cash search.php cross site scripting5.3 Medium
- thu-mig yoloeTHU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection4.8 Medium
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag8.1 High
- apache software foundation kylinApache Kylin: JDBC URL Whitelist Verification Bypass8.8 High
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendere…5.4 Medium
- Show moreLoading…