VYPR

CWE-94

Improper Control of Generation of Code ('Code Injection')

BaseDraftLikelihood: Medium

Description

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Hierarchy (View 1000)

Related attack patterns (CAPEC)

CAPEC-242 · CAPEC-35 · CAPEC-77

CVEs mapped to this weakness (7,342)

page 268 of 368
  • CVE-2007-5271Oct 8, 2007
    Trionic
    Cite CMS
    risk 0.05cvss —epss 0.29

    Multiple PHP remote file inclusion vulnerabilities in Trionic Cite CMS 1.2 rev9 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the bField[bf_data] parameter to (1) interface/editors/-custom.php or (2) interface/editors/custom.php.

  • CVE-2007-5056Sep 24, 2007
    Adodb Lite
    Adodb Lite
    risk 0.05cvss —epss 0.28

    Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequences in the last_module…

  • CVE-2007-4954Sep 18, 2007
    Joomla
    com_joom12pic
    risk 0.05cvss —epss 0.29

    PHP remote file inclusion vulnerability in admin.joom12pic.php in the joom12Pic (com_joom12pic) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.

  • CVE-2007-4955Sep 18, 2007
    Joomla
    Flash Fun! (com_joomlaflashfun)
    risk 0.05cvss —epss 0.30

    PHP remote file inclusion vulnerability in admin.joomlaflashfun.php in the Flash Fun! (com_joomlaflashfun) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.

  • CVE-2007-4934Sep 18, 2007
    Phpffl
    Phpffl
    risk 0.05cvss —epss 0.22

    Multiple PHP remote file inclusion vulnerabilities in phpFFL 1.24 allow remote attackers to execute arbitrary PHP code via a URL in the PHPFFL_FILE_ROOT parameter to (1) program_files/livedraft/livedraft.php or (2) program_files/livedraft/admin.php.

  • CVE-2006-4812Oct 10, 2006
    PHP
    PHP
    risk 0.05cvss —epss 0.20

    Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function…

  • CVE-2006-1540Mar 30, 2006
    Microsoft
    Office
    risk 0.05cvss —epss 0.29

    MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of service and execute arbitrary code via multiple attack vectors, as originally demonstrated using a crafted document record with a malformed string, as…

  • CVE-1999-0702Sep 10, 1999
    Microsoft
    Internet Explorer
    risk 0.05cvss —epss 0.24

    Internet Explorer 5.0 and 5.01 allows remote attackers to modify or execute files via the Import/Export Favorites feature, aka the "ImportExportFavorites" vulnerability.

  • CVE-2026-27174CriFeb 18, 2026
    Majordomo
    Majordomo
    risk 0.04cvss 9.8epss 0.05

    MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing…

  • CVE-2015-0935May 25, 2015
    Bomgar
    Remote Support
    risk 0.04cvss —epss 0.12

    Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts.

  • CVE-2014-8877Dec 5, 2014
    WordPress
    Cm Download Manager
    risk 0.04cvss —epss 0.14

    The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP…

  • CVE-2014-8791Dec 2, 2014
    Tuleap
    Tuleap
    risk 0.04cvss —epss 0.15

    project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via the data parameter.

  • CVE-2014-8997Nov 20, 2014
    Digitalvidhya
    Digi Online Examination System
    risk 0.04cvss —epss 0.09

    Unrestricted file upload vulnerability in the Photo functionality in DigitalVidhya Digi Online Examination System 2.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…

  • CVE-2014-8949Nov 16, 2014
    Imember360
    Imember360
    risk 0.04cvss —epss 0.08

    The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the i4w_trace parameter. NOTE: this can be leveraged with CVE-2014-8948 to allow remote attackers to execute code. …

  • CVE-2014-8770Nov 13, 2014
    Magmi Project
    Magmi
    risk 0.04cvss —epss 0.07

    Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then…

  • CVE-2014-7226Oct 10, 2014
    Rejetto
    HTTP File Server
    risk 0.04cvss —epss 0.09

    The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a file with certain invalid UTF-8 byte sequences that are interpreted as executable macro symbols.

  • CVE-2014-6389Oct 6, 2014
    Phpcompta
    Phpcompta\/noalyss
    risk 0.04cvss —epss 0.09

    backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter.

  • CVE-2014-2044Oct 6, 2014
    OwnCloud
    Owncloud
    risk 0.04cvss —epss 0.12

    Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream (ADS)…

  • CVE-2013-1436Oct 6, 2014
    Xmonad Contrib
    xmonad-contrib
    risk 0.04cvss —epss 0.09

    The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.

  • CVE-2014-2223Sep 11, 2014
    Plogger
    Plogger
    risk 0.04cvss —epss 0.10

    Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file and a non-zero length PNG file, then accessing the PHP file via a…