cve.bz

CWE-94: Improper Control of Generation of Code (Code Injection), page 54

Filter

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

What the weakness is: CWE-94 at MITRE

Related attack patterns (CAPEC): 3
  • CAPEC-35 Leverage Executable Code in Non-Executable Files Likelihood: High · Severity: Very High
  • CAPEC-77 Manipulating User-Controlled Variables Likelihood: High · Severity: Very High
  • CAPEC-242 Code Injection Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-94, as MITRE names them. Credits.

Ask an AI about CWE-94

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-94: Improper Control of Generation of Code and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/94.html and https://cve.bz/cve/cwe/94?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2025-46059EPSS 0.8%

    langchain-ai v0.3.51 was discovered to contain an indirect prompt injection vulnerability in the GmailToolkit component. This vulnerability allows attackers to execute arbitrary code and compromise the application via a crafted email messa…

  2. 7.5CVE-2025-4056EPSS 0.5%

    A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.

  3. 10.0CVE-2025-5120EPSS 31%

    A sandbox escape vulnerability was identified in huggingface/smolagents version 1.14.0, allowing attackers to bypass the restricted execution environment and achieve remote code execution (RCE). The vulnerability stems from the local_pytho…

  4. 2.0CVE-2025-8222EPSS 0.4%

    A vulnerability, which was classified as problematic, has been found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this issue is some unknown functionality of the file GoodsController.ja…

  5. 2.1CVE-2025-8221EPSS 0.6%

    A vulnerability classified as problematic was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this vulnerability is the function goodsSearch of the file GoodsCustController.java. The…

  6. 2.0CVE-2025-8211EPSS 0.4%

    A vulnerability was found in Roothub up to 2.6. It has been declared as problematic. Affected by this vulnerability is the function Edit of the file src/main/java/cn/roothub/web/admin/SystemConfigAdminController.java. The manipulation lead…

  7. 1.3CVE-2025-8206EPSS 0.6%

    A vulnerability, which was classified as problematic, was found in Comodo Dragon up to 134.0.6998.179. This affects an unknown part of the component IP DNS Leakage Detector. The manipulation leads to cross site scripting. It is possible to…

  8. 2.0CVE-2025-8191ExploitEPSS 1.8%

    A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl lead…

  9. 2.0CVE-2025-8167EPSS 0.4%

    A vulnerability was found in code-projects Church Donation System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/edit_members.php. The manipulation of the argument fn…

  10. 9.8CVE-2025-29631EPSS 2.1%

    Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through vulnerable methods that do not sanitize input before passing content to the oper…

  11. 9.1CVE-2025-29629EPSS 0.5%

    Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gar…

  12. 8.4CVE-2025-34114EPSS 0.2%

    A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple versions and default deployments, due to the absence of critical HTTP response headers including Content-Security-Policy, Refe…

  13. 2.0CVE-2025-8155EPSS 25%

    A vulnerability has been found in D-Link DCS-6010L 1.15.03 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /vb.htm of the component Management Application. The manipulation of the argum…

  14. 2.0CVE-2025-8115EPSS 0.4%

    A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/new-autoortaxi-entry-form.php. The manipulation of t…

  15. 9.3CVE-2016-15044ExploitEPSS 2.4%

    A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user-controlled data within the keditorservices module. An unauthenticated remote attacker can exploit this issue by sendin…

  16. 9.3CVE-2018-25114ExploitEPSS 4.6%

    A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessib…

  17. 9.8CVE-2025-54451EPSS 0.8%

    Improper Control of Generation of Code ('Code Injection') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0.

  18. 5.5CVE-2025-42947EPSS 0.4%

    SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be executed by the application. An attacker could thereby control the behaviour of the application causing high impact on integri…

  19. 8.1CVE-2025-8030EPSS 0.4%

    Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird …

  20. 8.8CVE-2025-51482ExploitEPSS 2.1%

    Remote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows remote attackers to execute arbitrary Python code and system commands via crafted payloads to the /v1/tools/run endpoint, …

  21. 7.2CVE-2025-6213EPSS 0.8%

    The Nginx Cache Purge Preload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.1 via the 'nppp_preload_cache_on_update' function. This is due to insufficient sanitization of the $_SERVER…

  22. 2.0CVE-2025-7951EPSS 0.4%

    A vulnerability classified as problematic has been found in code-projects Public Chat Room 1.0. This affects an unknown part of the file /send_message.php. The manipulation of the argument chat_msg/your_name leads to cross site scripting. …

  23. 2.1CVE-2025-7946EPSS 0.5%

    A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /search-visitor.php of the component HTTP POST Request Handler. The …

  24. 2.1CVE-2025-7944EPSS 0.4%

    A vulnerability was found in PHPGurukul Taxi Stand Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /search.php. The manipulation of the argument searchdata leads to cross site scriptin…

  25. 2.1CVE-2025-7943EPSS 0.4%

    A vulnerability was found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/search-autoortaxi.php. The manipulation of the argument searchd…

  26. 2.0CVE-2025-7942EPSS 0.3%

    A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument …

  27. 2.0CVE-2025-7941EPSS 0.3%

    A vulnerability, which was classified as problematic, was found in PHPGurukul Time Table Generator System 1.0. Affected is an unknown function of the file /admin/profile.php. The manipulation of the argument adminname leads to cross site s…

  28. 2.0CVE-2025-7926EPSS 0.4%

    A vulnerability, which was classified as problematic, was found in PHPGurukul Online Banquet Booking System 1.0. This affects an unknown part of the file /admin/booking-search.php. The manipulation of the argument searchdata leads to cross…

  29. 2.1CVE-2025-7925EPSS 0.6%

    A vulnerability, which was classified as problematic, has been found in PHPGurukul Online Banquet Booking System 1.0. Affected by this issue is some unknown functionality of the file /admin/login.php. The manipulation of the argument user_…

  30. 2.0CVE-2025-7924EPSS 0.4%

    A vulnerability classified as problematic was found in PHPGurukul Online Banquet Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument adminnam…

  31. 6.7CVE-2025-0664EPSS 0.2%

    A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially leading the agent to load an arbitrary local library. This may impair endpoint defenses and allow the attacker to achieve code execution…

  32. 2.0CVE-2025-7902EPSS 0.3%

    A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/controller/system/SysNoticeController.java. The manipulation leads to cross site script…

  33. 5.3CVE-2025-7901EPSS 0.9%

    A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been rated as problematic. This issue affects some unknown processing of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument con…

  34. 2.1CVE-2025-7887EPSS 0.7%

    A vulnerability has been found in Zavy86 WikiDocs up to 1.0.78 and classified as problematic. This vulnerability affects unknown code of the file template.inc.php. The manipulation of the argument path leads to cross site scripting. The at…

  35. 2.1CVE-2025-7885EPSS 0.6%

    A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument hostname/port leads …

  36. 2.0CVE-2025-7872EPSS 0.3%

    A weakness has been identified in Portabilis i-Diario 1.5.0. This affects an unknown function of the file /justificativas-de-falta. Executing a manipulation of the argument Justificativa can lead to cross site scripting. The attack may be …

  37. 2.0CVE-2025-7871EPSS 0.3%

    A security flaw has been discovered in Portabilis i-Diario 1.5.0. The impacted element is an unknown function of the file /conteudos. Performing a manipulation of the argument filter[by_description] results in cross site scripting. The att…

  38. 2.0CVE-2025-7870EPSS 0.3%

    A vulnerability was identified in Portabilis i-Diario 1.5.0. The affected element is an unknown function of the file app/uploaders/doc_uploader.rb of the component justificativas-de-falta Endpoint. Such manipulation of the argument Anexo l…

  39. 2.0CVE-2025-7869EPSS 0.3%

    A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the file intranet/educar_turma_tipo_det.php?cod_turma_tipo=ID of the component Turma…

  40. 2.0CVE-2025-7868EPSS 0.3%

    A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_calendario_dia_motivo_cad.php of the component Calendar Module. The manipulation of the argument Motivo/de…

  41. 2.0CVE-2025-7867EPSS 0.3%

    A vulnerability has been found in Portabilis i-Educar 2.9.0/2.10.0. This vulnerability affects unknown code of the file /intranet/agenda.php of the component Agenda Module. The manipulation of the argument novo_titulo/novo_descricao leads …

  42. 2.0CVE-2025-7866EPSS 0.4%

    A vulnerability was found in Portabilis i-Educar 2.9.0. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/educar_deficiencia_lst.php of the component Disabilities Module. The manipulation of…

  43. 2.0CVE-2025-7865EPSS 0.4%

    A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been declared as problematic. This vulnerability affects the function xssFilter of the file src/main/java/com/jeesite/common/codec/EncodeUtils.java of the component XSS Fil…

  44. 2.0CVE-2025-7858EPSS 0.3%

    A vulnerability classified as problematic has been found in PHPGurukul Apartment Visitors Management System 1.0. This affects an unknown part of the file /admin-profile.php of the component HTTP POST Request Handler. The manipulation of th…

  45. 2.0CVE-2025-7857EPSS 0.3%

    A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file bwdates-passreports-details.php of the component HTTP POST…

  46. 2.0CVE-2025-7856EPSS 0.4%

    A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file pass-details.php of the component HTTP POST Reque…

  47. 2.0CVE-2025-7840EPSS 0.4%

    A vulnerability was found in Campcodes Online Movie Theater Seat Reservation System 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php?page=reserve of the component Reserve Your Seat Page. The m…

  48. 4.8CVE-2025-7819EPSS 0.3%

    A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /create-pass.php of the component HTTP POST Request Handler. The manipulation…

  49. 2.0CVE-2025-7818EPSS 0.4%

    A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /category.php of the component HTTP POST Request Handler. The …

  50. 2.0CVE-2025-7817EPSS 0.4%

    A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /bwdates-reports.php of the component HTTP POST Req…