CWE-94
Improper Control of Generation of Code ('Code Injection')
Description
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-242 · CAPEC-35 · CAPEC-77
CVEs mapped to this weakness (7,295)
page 166 of 365| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-1773 | Med | 0.41 | 6.3 | 0.02 | Mar 31, 2023 | A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the component Configuration File Handler. The manipulation leads to code injection. The attack can be initiated remotely. The… | ||
| CVE-2022-25926 | Hig | 0.41 | 7.4 | 0.01 | Jan 4, 2023 | Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization. | ||
| CVE-2022-4300 | Med | 0.41 | 6.3 | 0.01 | Dec 6, 2022 | A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit of the component Template Handler. The manipulation leads to injection. The attack may be initiated remotely. The exploit has been disclosed… | ||
| CVE-2022-21797 | Hig | 0.41 | 7.3 | 0.02 | Sep 26, 2022 | The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement. | ||
| CVE-2022-36069 | Hig | 0.41 | 7.3 | 0.01 | Sep 7, 2022 | Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as `git clone`. These commands are constructed using user input (e.g. the repository URL). When building the commands,… | ||
| CVE-2022-35847 | Med | 0.41 | 6.3 | 0.01 | Sep 6, 2022 | An improper neutralization of special elements used in a template engine vulnerability [CWE-1336] in FortiSOAR management interface 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.4 may allow a remote and authenticated attacker to execute arbitrary code via a crafted payload. | ||
| CVE-2022-2073 | Hig | 0.41 | 7.2 | 0.11 | Jun 29, 2022 | Code Injection in GitHub repository getgrav/grav prior to 1.7.34. | ||
| CVE-2017-20095 | Med | 0.41 | 6.3 | 0.01 | Jun 24, 2022 | A vulnerability classified as critical was found in Simple Ads Manager Plugin. This vulnerability affects unknown code. The manipulation leads to code injection. The attack can be initiated remotely. | ||
| CVE-2017-20086 | Med | 0.41 | 6.3 | 0.01 | Jun 23, 2022 | A vulnerability, which was classified as critical, was found in VaultPress Plugin 1.8.4. This affects an unknown part. The manipulation leads to code injection. It is possible to initiate the attack remotely. | ||
| CVE-2017-20064 | Med | 0.41 | 6.3 | 0.01 | Jun 20, 2022 | A vulnerability was found in Elefant CMS 1.3.12-RC. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /designer/add/layout. The manipulation leads to code injection. The attack can be launched remotely. Upgrading to version… | ||
| CVE-2021-23154 | Med | 0.41 | 6.3 | 0.01 | Jan 10, 2022 | In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the user's shell. Arguments can be provided which cause arbitrary shell commands to run on the system. | ||
| CVE-2021-1518 | Med | 0.41 | 6.3 | 0.02 | Jul 22, 2021 | A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system of an affected device. This vulnerability is due to insufficient sanitization of… | ||
| CVE-2020-11056 | Hig | 0.41 | 7.4 | 0.01 | May 7, 2020 | In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lead to the execution of Twig code. This has been fixed in 3.9.0. | ||
| CVE-2017-18468 | Med | 0.41 | 6.3 | 0.01 | Aug 5, 2019 | cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232). | ||
| CVE-2018-20931 | Med | 0.41 | 6.3 | 0.01 | Aug 1, 2019 | cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405). | ||
| CVE-2019-1577 | Med | 0.41 | 6.3 | 0.01 | Jul 1, 2019 | Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScript or HTML. | ||
| CVE-2026-61552 | Hig | 0.40 | 7.2 | 0.01 | Sep 18, 2026 | Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject… | ||
| CVE-2026-78654 | Hig | 0.40 | 7.3 | 0.00 | Aug 25, 2026 | A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the… | ||
| CVE-2026-56703 | Hig | 0.40 | 7.2 | 0.01 | Aug 25, 2026 | Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server. | ||
| CVE-2026-76635 | Hig | 0.40 | 7.2 | 0.00 | Aug 20, 2026 | baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management… |
- risk 0.41cvss 6.3epss 0.02
A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the component Configuration File Handler. The manipulation leads to code injection. The attack can be initiated remotely. The…
- risk 0.41cvss 7.4epss 0.01
Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization.
- risk 0.41cvss 6.3epss 0.01
A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit of the component Template Handler. The manipulation leads to injection. The attack may be initiated remotely. The exploit has been disclosed…
- risk 0.41cvss 7.3epss 0.02
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
- risk 0.41cvss 7.3epss 0.01
Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as `git clone`. These commands are constructed using user input (e.g. the repository URL). When building the commands,…
- risk 0.41cvss 6.3epss 0.01
An improper neutralization of special elements used in a template engine vulnerability [CWE-1336] in FortiSOAR management interface 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.4 may allow a remote and authenticated attacker to execute arbitrary code via a crafted payload.
- risk 0.41cvss 7.2epss 0.11
Code Injection in GitHub repository getgrav/grav prior to 1.7.34.
- risk 0.41cvss 6.3epss 0.01
A vulnerability classified as critical was found in Simple Ads Manager Plugin. This vulnerability affects unknown code. The manipulation leads to code injection. The attack can be initiated remotely.
- risk 0.41cvss 6.3epss 0.01
A vulnerability, which was classified as critical, was found in VaultPress Plugin 1.8.4. This affects an unknown part. The manipulation leads to code injection. It is possible to initiate the attack remotely.
- risk 0.41cvss 6.3epss 0.01
A vulnerability was found in Elefant CMS 1.3.12-RC. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /designer/add/layout. The manipulation leads to code injection. The attack can be launched remotely. Upgrading to version…
- risk 0.41cvss 6.3epss 0.01
In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the user's shell. Arguments can be provided which cause arbitrary shell commands to run on the system.
- risk 0.41cvss 6.3epss 0.02
A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system of an affected device. This vulnerability is due to insufficient sanitization of…
- risk 0.41cvss 7.4epss 0.01
In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lead to the execution of Twig code. This has been fixed in 3.9.0.
- risk 0.41cvss 6.3epss 0.01
cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).
- risk 0.41cvss 6.3epss 0.01
cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405).
- risk 0.41cvss 6.3epss 0.01
Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScript or HTML.
- risk 0.40cvss 7.2epss 0.01
Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject…
- risk 0.40cvss 7.3epss 0.00
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the…
- risk 0.40cvss 7.2epss 0.01
Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.
- risk 0.40cvss 7.2epss 0.00
baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management…