cve.bz

CWE-94: Improper Control of Generation of Code (Code Injection), page 56

Filter

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

What the weakness is: CWE-94 at MITRE

Related attack patterns (CAPEC): 3
  • CAPEC-35 Leverage Executable Code in Non-Executable Files Likelihood: High · Severity: Very High
  • CAPEC-77 Manipulating User-Controlled Variables Likelihood: High · Severity: Very High
  • CAPEC-242 Code Injection Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-94, as MITRE names them. Credits.

Ask an AI about CWE-94

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-94: Improper Control of Generation of Code and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/94.html and https://cve.bz/cve/cwe/94?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 1.9CVE-2025-7144EPSS 0.4%

    A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /panel/admin-profile.php of the component Admin Profile Page. The manipula…

  2. 1.9CVE-2025-7143EPSS 0.3%

    A vulnerability, which was classified as problematic, was found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/edit-tax.php of the component Update Tax Page. The manipulation of the argu…

  3. 1.9CVE-2025-7142EPSS 0.3%

    A vulnerability, which was classified as problematic, has been found in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown functionality of the file /panel/search-appointment.php. The manipulation leads…

  4. 1.9CVE-2025-7141EPSS 0.3%

    A vulnerability classified as problematic was found in SourceCodester Best Salon Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /panel/edit_plan.php of the component Update Staff Page. The man…

  5. 1.9CVE-2025-7140EPSS 0.3%

    A vulnerability classified as problematic has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/edit-staff.php of the component Update Staff Page. The manipulation of the argu…

  6. 1.9CVE-2025-7139EPSS 0.3%

    A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /panel/edit-customer-detailed.php of the component Update Customer Detai…

  7. 6.7CVE-2025-36014EPSS 0.2%

    IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.5 is vulnerable to code injection by a privileged user with access to the IIB install directory.

  8. 9.8CVE-2025-45479EPSS 0.8%

    Insufficient security mechanisms for created containers in educoder challenges v1.0 allow attackers to execute arbitrary code via injecting crafted content into a container.

  9. 2.0CVE-2025-7113EPSS 0.3%

    A vulnerability was found in Portabilis i-Educar 2.9.0. It has been classified as problematic. Affected is an unknown function of the file /module/ComponenteCurricular/edit?id=ID of the component Curricular Components Module. The manipulat…

  10. 2.0CVE-2025-7112EPSS 0.3%

    A vulnerability was found in Portabilis i-Educar 2.9.0 and classified as problematic. This issue affects some unknown processing of the file /intranet/educar_funcao_det.php?cod_funcao=COD&ref_cod_instituicao=COD of the component Function M…

  11. 2.0CVE-2025-7111EPSS 0.3%

    A vulnerability has been found in Portabilis i-Educar 2.9.0 and classified as problematic. This vulnerability affects unknown code of the file /intranet/educar_curso_det.php?cod_curso=ID of the component Course Module. The manipulation of …

  12. 2.0CVE-2025-7110EPSS 0.3%

    A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9.0. This affects an unknown part of the file /intranet/educar_escola_lst.php of the component School Module. The manipulation of the argument Escola …

  13. 2.0CVE-2025-7109EPSS 0.3%

    A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the file /intranet/educar_aluno_beneficio_lst.php of the component Student Benefits …

  14. 2.1CVE-2025-7101EPSS 0.5%

    A vulnerability was found in BoyunCMS up to 1.4.20. It has been classified as critical. This affects an unknown part of the file /install/install_ok.php of the component Configuration File Handler. The manipulation of the argument db_pass …

  15. 9.5CVE-2025-5333EPSS 0.7%

    Remote attackers can execute arbitrary code in the context of the vulnerable service process.

  16. 7.2CVE-2025-52718EPSS 0.2%

    Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Remote Code Inclusion.This issue affects Alone: from n/a through <= 7.8.2.

  17. 10.0CVE-2025-49302EPSS 0.4%

    Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson Easy Stripe easy-stripe allows Remote Code Inclusion.This issue affects Easy Stripe: from n/a through <= 1.1.

  18. 5.1CVE-2025-7053EPSS 0.4%

    A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site scripting. The …

  19. 9.3CVE-2025-34089ExploitEPSS 2.3%

    An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to and including 2025.7. When the application is configured with authentication disab…

  20. 7.5CVE-2025-34086ExploitEPSS 4.2%

    Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of th…

  21. 9.3CVE-2025-34061ExploitEPSS 1.9%

    A backdoor in PHPStudy versions 2016 through 2018 allows unauthenticated remote attackers to execute arbitrary PHP code on affected installations. The backdoor listens for base64-encoded PHP payloads in the Accept-Charset HTTP header of in…

  22. 7.5CVE-2025-34079ExploitEPSS 1.7%

    An authenticated remote code execution vulnerability exists in NSClient++ version 0.5.2.35 when the web interface and ExternalScripts module are enabled. A remote attacker with the administrator password can authenticate to the web interfa…

  23. 9.4CVE-2025-34074ExploitEPSS 2.2%

    An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job …

  24. 9.8CVE-2025-37099EPSS 0.8%

    A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.

  25. 9.1CVE-2025-49029ExploitEPSS 2.4%

    Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through <…

  26. 8.8CVE-2025-49521EPSS 0.6%

    A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute …

  27. 2.0CVE-2025-6849EPSS 0.3%

    A vulnerability, which was classified as problematic, was found in code-projects Simple Forum 1.0. Affected is an unknown function of the file /forum_edit1.php. The manipulation of the argument text leads to cross site scripting. It is pos…

  28. 1.9CVE-2025-6778EPSS 0.4%

    A vulnerability, which was classified as problematic, was found in code-projects Food Distributor Site 1.0. Affected is an unknown function of the file /admin/save_settings.php. The manipulation of the argument site_phone/site_email/addres…

  29. 8.6CVE-2025-28993EPSS 0.4%

    Improper Control of Generation of Code ('Code Injection') vulnerability in Jose Mortellaro Content No Cache content-no-cache allows Code Injection.This issue affects Content No Cache: from n/a through <= 0.1.4.

  30. 2.1CVE-2025-6700EPSS 0.5%

    A vulnerability classified as problematic was found in Xuxueli xxl-sso 1.1.0. This vulnerability affects unknown code of the file /xxl-sso-server/login. The manipulation of the argument errorMsg leads to cross site scripting. The attack ca…

  31. 2.0CVE-2025-6699EPSS 0.4%

    A vulnerability classified as problematic has been found in LabRedesCefetRJ WeGIA 3.4.0. This affects an unknown part of the file /html/funcionario/cadastro_funcionario.php of the component Cadastro de Funcionário. The manipulation of the …

  32. 2.0CVE-2025-6698EPSS 0.4%

    A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /html/matPat/adicionar_tipoSaida.php of the component Adicionar tipo. The manipula…

  33. 2.0CVE-2025-6697EPSS 0.4%

    A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /html/matPat/adicionar_tipoEntrada.php of the component Adicionar tipo. T…

  34. 2.0CVE-2025-6696EPSS 0.4%

    A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been classified as problematic. Affected is an unknown function of the file /html/atendido/Cadastro_Atendido.php of the component Cadastro de Atendio. The manipulation of the…

  35. 9.8CVE-2025-53002EPSS 1.3%

    LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions up to and including 0.9.3 during the LLaMA-Factory training process. This vulnerability arises beca…

  36. 2.0CVE-2025-6695EPSS 0.4%

    A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic. This issue affects some unknown processing of the file /html/matPat/adicionar_categoria.php of the component Additional Categoria. The manipulation of …

  37. 2.0CVE-2025-6694EPSS 0.4%

    A vulnerability has been found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic. This vulnerability affects unknown code of the file /html/matPat/adicionar_unidade.php of the component Adicionar Unidade. The manipulation of the…

  38. 2.0CVE-2025-6613EPSS 0.3%

    A vulnerability classified as problematic was found in PHPGurukul Hospital Management System 4.0. Affected by this vulnerability is an unknown functionality of the file /doctor/manage-patient.php. The manipulation of the argument Name lead…

  39. 9.8CVE-2024-37743EPSS 0.7%

    An issue in mmzdev KnowledgeGPT V.0.0.5 allows a remote attacker to execute arbitrary code via the Document Display Component.

  40. 7.8CVE-2025-23265EPSS 0.3%

    NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by providing a malicious file. A successful exploit of this vulnerability may lead to Code Execution, Es…

  41. 7.8CVE-2025-23264EPSS 0.3%

    NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by providing a malicious file. A successful exploit of this vulnerability may lead to Code Execution, Es…

  42. 2.1CVE-2025-6569EPSS 0.4%

    A vulnerability classified as problematic was found in code-projects School Fees Payment System 1.0. Affected by this vulnerability is an unknown functionality of the file /student.php. The manipulation of the argument sname/contact/about/…

  43. 2.0CVE-2025-6551EPSS 0.5%

    A vulnerability was found in java-aodeng Hope-Boot 1.0.0 and classified as problematic. This issue affects the function Login of the file /src/main/java/com/hope/controller/WebController.java. The manipulation of the argument errorMsg lead…

  44. 9.8CVE-2023-47030EPSS 0.7%

    An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a GET request to a UserService SOAP API endpoint to validate if a user exists.

  45. 2.0CVE-2025-6509EPSS 0.3%

    A vulnerability was found in seaswalker spring-analysis up to 4379cce848af96997a9d7ef91d594aa129be8d71. It has been declared as problematic. Affected by this vulnerability is the function echo of the file /src/main/java/controller/SimpleCo…

  46. 9.8CVE-2023-47032EPSS 0.8%

    Password Vulnerability in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the UserService SOAP API function.

  47. 9.8CVE-2023-48978EPSS 1.0%

    An issue in NCR ITM Web terminal v.4.4.0 and v.4.4.4 allows a remote attacker to execute arbitrary code via a crafted script to the IP camera URL component.

  48. 10.0CVE-2025-6512EPSS 0.5%

    On a client with a non-admin user, a script can be integrated into a report. The reports could later be executed on the BRAIN2 server with administrator rights.

  49. 1.9CVE-2025-6477EPSS 0.3%

    A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /script/admin/system of the component System Sett…

  50. 1.9CVE-2025-6475EPSS 0.3%

    A vulnerability was found in SourceCodester Student Result Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /script/admin/manage_students of the component Manage Students Module. T…