CWE-94: Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Also known as Code Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- No product listedPostyBirb Plus Submission Description Editor DescriptionInput.tsx cross site scripting5.1 Medium
- showdocShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates8.7 High
- No product listedKonflux-ci: remote code execution via eval() in manifest scripts8.4 High
- No product listedKonflux-ci: jq filter injection in github workflow issue management8.8 High
- kstover ninja forms – contact form builder with calculators, quizzes, signatures & ai form builderNinja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag6.5 Medium
- kstover ninja forms – contact form builder with calculators, quizzes, signatures & ai form builderNinja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name5.4 Medium
- fctr-id okta-ai-agentTAKO AI Agent for Okta: Authenticated Python execution through validator bypass8.8 High
- christianhelle refitterRefitter: C# source injection through OpenAPI header parameter names8.6 High
- christianhelle refitterRefitter: C# source injection through OpenAPI content-type map keys8.6 High
- christianhelle refitterRefitter: C# source injection through OpenAPI path keys8.6 High
- mqttsnet thinglinksThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks9.9 Critical
- osac-project osac-operatorOSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy8.6 High
- marketing fire widget optionsWordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability9.1 Critical
- spacetime ad inserter – ad manager & adsense adsAd Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter6.5 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter6.5 Medium
- up9inc pybars4, wbond pybars3 +1 morepybars3 through 0.9.7 and pybars4 through 0.9.13 Code Injection via Bracketed Path Segments9.3 Critical
- joedolson my calendar - accessible event managerMy Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter6.9 Medium
- socfortress copilotSOCFortress CoPilot: Stored case-report template injection permits backend code execution9.0 Critical
- progress software ws ftp serverServer-Side Script Injection in Manager Web UI in Progress WS_FTP Server6.6 Medium
- ajax load more ajaxloadmore cacheWordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability10.0 Critical
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities6.5 Medium
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.8 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.8 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities9.8 Critical
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities9.9 Critical
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities9.9 Critical
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities9.8 Critical
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.8 High
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.8 High
- oapi-codegenoapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values8.7 High
- oapi-codegenoapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension7.7 High
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block7.2 High
- nvm-sh nvmnvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed7.1 High
- No product listedAn issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in...7.8 High
- No product listedAn issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in...7.8 High
retroarchUbuntuAn issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading...9.8 Critical- configuroweb inventariobasicoconfiguroweb inventariobasico Add Product addlist.php cross site scripting5.1 Medium
- opencatsOpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)7.2 High
- wwbn avideo-encoderAVideo-Encoder: unauthenticated installer PHP code injection10.0 Critical
- project-monai monaiMONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf8.6 High
- ultralyticsUltralytics parse_model Code Injection Remote Code Execution Vulnerability7.8 High
- ultralyticsUltralytics parse_model Code Injection Remote Code Execution Vulnerability7.8 High
- ultralyticsUltralytics check_det_dataset Code Injection Remote Code Execution Vulnerability7.8 High
- jenkinsJenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission...8.8 High
- hcl software bigfix aexHCL BigFix AEX is affected by multiple security vulnerabilities.9.1 Critical
- dell idrac service module for esxi, idrac service module for linux, idrac service module for windows +2 moreDell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell...4.2 Medium
- eaglecloud aquilaCode injection in EagleCloud Aquila on-premises version9.4 Critical
- jeromedevome grrGRR vulnerable to Remote Code Execution Via PHP Code Injection9.1 Critical
- mlflowMLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules9.8 Critical
- reduxjs redux-devtoolsreduxjs redux-devtools Remotedev Server evalAction code injection4.8 Medium
- Show moreLoading…