cve.bz

CWE-94: Improper Control of Generation of Code (Code Injection), page 97

Filter

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

What the weakness is: CWE-94 at MITRE

Related attack patterns (CAPEC): 3
  • CAPEC-35 Leverage Executable Code in Non-Executable Files Likelihood: High · Severity: Very High
  • CAPEC-77 Manipulating User-Controlled Variables Likelihood: High · Severity: Very High
  • CAPEC-242 Code Injection Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-94, as MITRE names them. Credits.

Ask an AI about CWE-94

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-94: Improper Control of Generation of Code and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/94.html and https://cve.bz/cve/cwe/94?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2022-22954KEVExploitEPSS >99.9%

    VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in rem…

  2. 8.8CVE-2021-40219EPSS 3.4%

    Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution.

  3. 8.8CVE-2022-24780EPSS 5.7%

    Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using h…

  4. 7.2CVE-2022-26982ExploitEPSS 9.2%

    SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. NOTE: the vendor's position is that admin…

  5. 8.8CVE-2021-39114EPSS 1.7%

    Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affect…

  6. 9.8CVE-2022-22965KEVExploitEPSS 99.6%

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deplo…

  7. 9.8CVE-2022-22963KEVExploitEPSS >99.9%

    In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution …

  8. 7.2CVE-2022-1159EPSS 3.5%

    Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio 5000 Logix Designer could inject controller code undetectable to a user.

  9. 7.5CVE-2021-39908EPSS 1.3%

    In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode characters can be abused to commit malicious code into proj…

  10. 7.2CVE-2021-43097EPSS 2.4%

    A Server-side Template Injection (SSTI) vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code.

  11. 10.0CVE-2021-26622EPSS 3.0%

    An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all conn…

  12. 6.8CVE-2021-38745EPSS 0.9%

    Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin. This vulnerability is triggered through user interaction with the attacker's pr…

  13. 9.8CVE-2021-39383EPSS 3.1%

    DWSurvey v3.2.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /sysuser/SysPropertyAction.java.

  14. 9.8CVE-2022-25578EPSS 1.8%

    taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file.

  15. 8.8CVE-2020-25197EPSS 3.2%

    A code injection vulnerability exists in one of the webpages in GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06 that could allow an authenticated remote attacker to execute arbitrary code on the syste…

  16. 9.8CVE-2020-15591EPSS 4.1%

    fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).

  17. 9.8CVE-2022-25760EPSS 1.6%

    All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's export…

  18. 8.8CVE-2022-0811EPSS 19%

    A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as ro…

  19. 9.8CVE-2022-25498EPSS 3.1%

    CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the saveConfigData function in /classes/ajax/Functions.php.

  20. 7.2CVE-2022-0944EPSS 8.5%

    Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.

  21. 9.8CVE-2021-25003ExploitEPSS 56%

    The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE

  22. 6.7CVE-2022-0921EPSS 2.2%

    Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.

  23. 9.8CVE-2021-44618EPSS 1.4%

    A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header.

  24. 8.8CVE-2022-24915EPSS 1.0%

    The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section where the information is d…

  25. 8.8CVE-2022-22985EPSS 1.0%

    The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the specific web section where the informa…

  26. 7.2CVE-2022-24734ExploitEPSS 78%

    MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` wit…

  27. 6.3CVE-2022-24512EPSS 1.6%

    .NET and Visual Studio Remote Code Execution Vulnerability

  28. 8.8CVE-2022-0896EPSS 1.4%

    Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.

  29. 7.2CVE-2021-43944EPSS 2.3%

    This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system admin…

  30. 9.8CVE-2022-0845EPSS 1.0%

    Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.

  31. 10.0CVE-2022-22947KEVExploitEPSS 98%

    In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted r…

  32. 8.8CVE-2022-22909ExploitEPSS 45%

    HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module.

  33. 8.8CVE-2022-0819EPSS 43%

    Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.

  34. 7.2CVE-2021-44238EPSS 1.9%

    AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE) via /aya/module/admin/ust_tab_e.inc.php,

  35. 8.8CVE-2022-25018EPSS 2.7%

    Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.

  36. 9.8CVE-2022-24442EPSS 3.8%

    JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

  37. 7.5CVE-2021-22395EPSS 0.7%

    There is a code injection vulnerability in smartphones. Successful exploitation of this vulnerability may affect service confidentiality.

  38. 6.5CVE-2022-23810EPSS 1.1%

    Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions…

  39. 8.8CVE-2022-24295EPSS 17%

    Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL.

  40. 8.8CVE-2022-23642ExploitEPSS 74%

    Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git conf…

  41. 9.1CVE-2021-46063EPSS 2.7%

    MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.

  42. 8.8CVE-2022-24665EPSS 2.6%

    PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts.

  43. 8.8CVE-2022-24664EPSS 1.7%

    PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to edit posts.

  44. 8.8CVE-2022-24663EPSS 2.1%

    PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated user.

  45. 9.8CVE-2021-46362EPSS 4.7%

    A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter.

  46. 3.3CVE-2022-23434EPSS 0.2%

    A vulnerability using PendingIntent in Bixby Vision prior to versions 3.7.60.8 in Android S(12), 3.7.50.6 in Andorid R(11) and below allows attackers to execute privileged action by hijacking and modifying the intent.

  47. 6.0CVE-2022-23426EPSS 0.1%

    A vulnerability using PendingIntent in DeX Home and DeX for PC prior to SMR Feb-2022 Release 1 allows attackers to access files with system privilege.

  48. 9.1CVE-2021-44521ExploitEPSS 59%

    When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitra…

  49. 9.8CVE-2022-23631EPSS 2.7%

    superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or know…

  50. 9.8CVE-2022-23614EPSS 8.2%

    Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was n…