CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- adobe campaign classicAdobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)9.9 Critical
- adobe connect android mobile app, connect desktop app +1 moreAdobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)9.6 Critical
- saruf-ratul hr-payroll-management-systemSaruf-Ratul HR-Payroll-Management-System chat.php cross site scripting5.1 Medium
- md-mafujul-hasan online-payroll-management-systemMD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting5.1 Medium
- No product listedAidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and...9.8 Critical
- openpanel-dev openpanelOpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template8.7 High
- No product listedArgilla TextField.vue cross site scripting4.8 Medium
- No product listedArgilla Sandbox.vue cross site scripting4.8 Medium
- No product listedArgilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting5.1 Medium
- itsourcecode airline reservation systemitsourcecode Airline Reservation System book_flight.php cross site scripting5.3 Medium
- lxsmnsyc serovalSeroval: Code injection through a typed array's own constructor property5.3 Medium
- subhajitkhan online-clinic-management-systemsubhajitkhan online-clinic-management-system patientregistration.php cross site scripting5.1 Medium
- bdtask garage 24 garage management softwareBdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting5.1 Medium
- No product listedAn unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicl…9.9 Critical
- allenai allennlpAllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection5.3 Medium
- No product listedDedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection6.9 Medium
- ffxiv-teamcraft ffxiv teamcraftffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting5.1 Medium
- edimax br-6208acEdimax BR-6208AC Virtual Server cross site scripting4.8 Medium
- sony neural network librariesSony Neural Network Libraries NNP Converter utils.py func_set_nnabla_version_decorate code injection5.3 Medium
- sony neural network librariesSony Neural Network Libraries Encode Param encode_decode_param.py load_param_in_txt code injection5.3 Medium
- No product listedgougucms User Level Level.php add cross site scripting4.8 Medium
- No product listedAn issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to...7.8 High
- mathurvishal cloudclassroom-php-projectCloudClassroom-PHP-Project addnewstudent.php cross site scripting5.3 Medium
- No product listedDedeCMS update_guide.php require_once code injection5.1 Medium
- alfresco activitiAlfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection5.3 Medium
- privoce vocechatPrivoce Vocechat Query Parameter widget.html cross site scripting5.3 Medium
- onyx-dot-app onyxonyx-dot-app Onyx PreviewTab.tsx cross site scripting5.1 Medium
- No product listedphpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting5.3 Medium
- No product listedphpIPAM index.php cross site scripting4.8 Medium
- travisun opptrixTravisun Opptrix Import Endpoint import code injection6.9 Medium
- paolo geodirectoryGeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export7.2 High
- craftcms cmsControl panel only API response emulation replaces "securityKey" and reaches server RCE8.7 High
- capricorn86 happy-domHappy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution8.8 High
- conda infrastructureConda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN9.9 Critical
- cgm clininetRemote Code Execution in CGM CLININET9.4 Critical
- cgm clininetCode Injection in CGM CLININET8.6 High
- hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 moreAdvanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action9.0 Critical
- okta access gatewayCommand Execution via Admin Console Input in Okta Access Gateway9.1 Critical
- gedelumbung hospitalmanagementgedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting5.3 Medium
- gedelumbung hospitalmanagementgedelumbung HospitalManagement Settings sistem.php simpan cross site scripting4.8 Medium
@rog0x/mcp-git-toolsnpm@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function7.5 High- No product listedAn issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute...7.3 High
- gedelumbung hospitalmanagementgedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting5.3 Medium
- lepture mistuneMistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option5.3 Medium
- hewlett packard enterprise (hpe) arubaos (aos)Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)8.1 High
- hewlett packard enterprise (hpe) arubaos (aos)Unauthenticated Adjacent Remote Code Execution Vulnerability in AOS-108.8 High
- subhajitkhan online-clinic-management-systemsubhajitkhan online-clinic-management-system patdocmsg.php cross site scripting5.1 Medium
- dedecmsDedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php9.3 Critical
- roxnor wp ultimate reviewWP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email4.8 Medium
- splunk, splunk enterprise +1 moreRemote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise7.2 High
- Show moreLoading…