CWE-94
Improper Control of Generation of Code ('Code Injection')
Description
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-242 · CAPEC-35 · CAPEC-77
CVEs mapped to this weakness (7,295)
page 93 of 365| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-73166 | Hig | 0.56 | — | 0.01 | Sep 16, 2026 | Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary code on the… | ||
| CVE-2026-58074 | — | Hig | 0.56 | — | 0.00 | Aug 4, 2026 | A vulnerability allowing a high-privileged user to execute arbitrary code on the server. | |
| CVE-2026-40967 | Hig | 0.56 | 8.6 | 0.00 | Apr 28, 2026 | In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query. Affected… | ||
| CVE-2025-9120 | Hig | 0.56 | — | 0.00 | Feb 24, 2026 | Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Carbonite Safe Server Backup allows Code Injection. The vulnerability could be exploited through an open port, potentially allowing unauthorized access. This issue affects Carbonite Safe… | ||
| CVE-2025-10703 | Hig | 0.56 | — | 0.00 | Nov 19, 2025 | Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the… | ||
| CVE-2025-10702 | Hig | 0.56 | — | 0.00 | Nov 19, 2025 | Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the… | ||
| CVE-2025-28993 | Hig | 0.56 | 8.6 | 0.00 | Jun 27, 2025 | Improper Control of Generation of Code ('Code Injection') vulnerability in Jose Mortellaro Content No Cache content-no-cache allows Code Injection.This issue affects Content No Cache: from n/a through <= 0.1.4. | ||
| CVE-2025-1976 | Med | 0.56 | 6.7 | 0.01 | KEV | Apr 24, 2025 | Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6. | |
| CVE-2024-57609 | Hig | 0.56 | 8.6 | 0.01 | Feb 6, 2025 | An issue in Kanaries Inc Pygwalker before v.0.4.9.9 allows a remote attacker to obtain sensitive information and execute arbitrary code via the redirect_path parameter of the login redirection function. | ||
| CVE-2024-9154 | Hig | 0.56 | — | 0.01 | Dec 19, 2024 | A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device. This issue affects Ewon Flexy 205: through 14.8s0 (#2633). | ||
| CVE-2024-55661 | Hig | 0.56 | 8.8 | 0.30 | Dec 13, 2024 | Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pulse prior to version 1.3.1 that could allow remote code execution through the public `remember()` method in the… | ||
| CVE-2024-23278 | Hig | 0.56 | 8.6 | 0.00 | Mar 8, 2024 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, macOS Ventura 13.6.5, tvOS 17.4, watchOS 10.4. An app may be able to break out of its sandbox. | ||
| CVE-2023-41898 | Hig | 0.56 | 8.6 | 0.00 | Oct 19, 2023 | Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution,… | ||
| CVE-2023-30990 | Hig | 0.56 | 8.6 | 0.01 | Jul 4, 2023 | IBM i 7.2, 7.3, 7.4, and 7.5 could allow a remote attacker to execute CL commands as QUSER, caused by an exploitation of DDM architecture. IBM X-Force ID: 254036. | ||
| CVE-2021-40487 | Hig | 0.56 | 8.1 | 0.48 | Oct 13, 2021 | Microsoft SharePoint Server Remote Code Execution Vulnerability | ||
| CVE-2021-39159 | Cri | 0.56 | 9.6 | 0.02 | Aug 25, 2021 | BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with… | ||
| CVE-2021-39160 | Cri | 0.56 | 9.6 | 0.02 | Aug 25, 2021 | nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are… | ||
| CVE-2020-28450 | Hig | 0.56 | 8.6 | 0.02 | Feb 4, 2021 | This affects all versions of package decal. The vulnerability is in the extend function. | ||
| CVE-2020-15252 | Hig | 0.56 | 8.5 | 0.03 | Oct 16, 2020 | In XWiki before version 12.5 and 11.10.6, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code… | ||
| CVE-2020-7672 | Hig | 0.56 | 8.6 | 0.02 | Jun 10, 2020 | mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in code execution. |
- risk 0.56cvss —epss 0.01
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary code on the…
- risk 0.56cvss —epss 0.00
A vulnerability allowing a high-privileged user to execute arbitrary code on the server.
- risk 0.56cvss 8.6epss 0.00
In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query. Affected…
- risk 0.56cvss —epss 0.00
Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Carbonite Safe Server Backup allows Code Injection. The vulnerability could be exploited through an open port, potentially allowing unauthorized access. This issue affects Carbonite Safe…
- risk 0.56cvss —epss 0.00
Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the…
- risk 0.56cvss —epss 0.00
Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the…
- risk 0.56cvss 8.6epss 0.00
Improper Control of Generation of Code ('Code Injection') vulnerability in Jose Mortellaro Content No Cache content-no-cache allows Code Injection.This issue affects Content No Cache: from n/a through <= 0.1.4.
- risk 0.56cvss 6.7epss 0.01
Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6.
- risk 0.56cvss 8.6epss 0.01
An issue in Kanaries Inc Pygwalker before v.0.4.9.9 allows a remote attacker to obtain sensitive information and execute arbitrary code via the redirect_path parameter of the login redirection function.
- risk 0.56cvss —epss 0.01
A code injection vulnerability in HMS Networks Ewon Flexy 205 allows executing commands on system level on the device. This issue affects Ewon Flexy 205: through 14.8s0 (#2633).
- risk 0.56cvss 8.8epss 0.30
Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pulse prior to version 1.3.1 that could allow remote code execution through the public `remember()` method in the…
- risk 0.56cvss 8.6epss 0.00
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, macOS Ventura 13.6.5, tvOS 17.4, watchOS 10.4. An app may be able to break out of its sandbox.
- risk 0.56cvss 8.6epss 0.00
Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution,…
- risk 0.56cvss 8.6epss 0.01
IBM i 7.2, 7.3, 7.4, and 7.5 could allow a remote attacker to execute CL commands as QUSER, caused by an exploitation of DDM architecture. IBM X-Force ID: 254036.
- risk 0.56cvss 8.1epss 0.48
Microsoft SharePoint Server Remote Code Execution Vulnerability
- risk 0.56cvss 9.6epss 0.02
BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with…
- risk 0.56cvss 9.6epss 0.02
nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are…
- risk 0.56cvss 8.6epss 0.02
This affects all versions of package decal. The vulnerability is in the extend function.
- risk 0.56cvss 8.5epss 0.03
In XWiki before version 12.5 and 11.10.6, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code…
- risk 0.56cvss 8.6epss 0.02
mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in code execution.