cve.bz

CWE-94: Improper Control of Generation of Code (Code Injection), page 98

Filter

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

What the weakness is: CWE-94 at MITRE

Related attack patterns (CAPEC): 3
  • CAPEC-35 Leverage Executable Code in Non-Executable Files Likelihood: High · Severity: Very High
  • CAPEC-77 Manipulating User-Controlled Variables Likelihood: High · Severity: Very High
  • CAPEC-242 Code Injection Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-94, as MITRE names them. Credits.

Ask an AI about CWE-94

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-94: Improper Control of Generation of Code and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/94.html and https://cve.bz/cve/cwe/94?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2021-44978EPSS 2.2%

    iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution.

  2. 9.8CVE-2022-21686EPSS 1.8%

    PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1…

  3. 8.8CVE-2021-46114EPSS 1.3%

    jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.

  4. 7.2CVE-2021-46118EPSS 2.3%

    jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.

  5. 7.2CVE-2021-46117EPSS 2.8%

    jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.

  6. 5.4CVE-2022-23008EPSS 0.5%

    On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undisclosed API endpoints on NGINX Controller API Management to inject JavaScript code that is executed …

  7. 9.8CVE-2021-45029EPSS 6.0%

    Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

  8. 8.8CVE-2022-0323EPSS 0.7%

    Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.

  9. 7.8CVE-2022-23120EPSS 6.4%

    A code injection vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allow an attacker to escalate privileges and run arbitrary code in the context of root. Please note: a…

  10. 9.8CVE-2021-44734EPSS 6.2%

    Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device.

  11. 8.8CVE-2021-43269EPSS 1.3%

    In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy configuration to use a malicious proxy auto-config (PAC) file, leading to arbitrary code execution. This affects Incydr Basic, Advanced, and Gov F1; C…

  12. 8.8CVE-2021-32650EPSS 2.1%

    October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import fea…

  13. 8.8CVE-2021-32649EPSS 1.3%

    October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with "create, modify and delete website pages" privileges in the backend is able to …

  14. 8.8CVE-2021-34994EPSS 5.8%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be …

  15. 8.8CVE-2021-45806EPSS 1.4%

    jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code.

  16. 7.8CVE-2021-23154EPSS 0.6%

    In Lens prior to 5.3.4, custom helm chart configuration creates helm commands from string concatenation of provided arguments which are then executed in the user's shell. Arguments can be provided which cause arbitrary shell commands to ru…

  17. 7.1CVE-2022-22286EPSS 0.3%

    A vulnerability using PendingIntent in Bixby Routines prior to version 3.1.21.8 in Android R(11.0) and 2.6.30.5 in Android Q(10.0) allows attackers to execute privileged action by hijacking and modifying the intent.

  18. 7.1CVE-2022-22285EPSS 0.3%

    A vulnerability using PendingIntent in Reminder prior to version 12.2.05.0 in Android R(11.0) and 12.3.02.1000 in Android S(12.0) allows attackers to execute privileged action by hijacking and modifying the intent.

  19. 3.3CVE-2022-22270EPSS 0.2%

    An implicit Intent hijacking vulnerability in Dialer prior to SMR Jan-2022 Release 1 allows unprivileged applications to access contact information.

  20. 9.8CVE-2021-39979EPSS 1.1%

    HHEE system has a Code Injection vulnerability.Successful exploitation of this vulnerability may affect HHEE system integrity.

  21. 9.8CVE-2020-20601ExploitEPSS 7.4%

    An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.

  22. 8.8CVE-2021-23814EPSS 1.8%

    This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: 1. Install a pac…

  23. 9.1CVE-2021-43837EPSS 5.2%

    vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. In versions before 3.0.0 vault-cli features the ability for rendering templated values. When a secret starts with the prefix `!t…

  24. 8.8CVE-2021-42309EPSS 2.9%

    Microsoft SharePoint Server Remote Code Execution Vulnerability

  25. 9.8CVE-2021-44231EPSS 1.4%

    Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.

  26. 7.8CVE-2021-43811EPSS 2.5%

    Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to…

  27. 9.8CVE-2021-44529KEVExploitEPSS 99.1%

    A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).

  28. 7.5CVE-2021-37097EPSS 0.7%

    There is a Code Injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to system restart.

  29. 9.1CVE-2021-37079EPSS 0.7%

    There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to delete arbitrary file by system_app permission.

  30. 6.7CVE-2021-38967EPSS 0.3%

    IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local privileged user to inject and execute malicious code. IBM X-Force ID: 212441.

  31. 8.8CVE-2021-3725EPSS 1.1%

    Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a dire…

  32. 4.2CVE-2021-43221EPSS 1.2%

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

  33. 7.6CVE-2021-38448EPSS 0.3%

    The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

  34. 6.0CVE-2021-33493EPSS 0.5%

    The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format.

  35. 8.8CVE-2021-22053ExploitEPSS 13%

    Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hy…

  36. 9.8CVE-2021-41269EPSS 4.3%

    cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java …

  37. 9.8CVE-2021-41653ExploitEPSS 76%

    The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.

  38. 9.8CVE-2021-33816EPSS 3.9%

    The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.

  39. 7.8CVE-2021-43208EPSS 4.3%

    3D Viewer Remote Code Execution Vulnerability

  40. 7.8CVE-2021-42298EPSS 5.8%

    Microsoft Defender Remote Code Execution Vulnerability

  41. 7.8CVE-2021-42296EPSS 1.1%

    Microsoft Word Remote Code Execution Vulnerability

  42. 9.8CVE-2021-43466EPSS 4.0%

    In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.

  43. 6.5CVE-2021-24721EPSS 0.9%

    The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files …

  44. 7.2CVE-2021-24537EPSS 1.6%

    The Similar Posts WordPress plugin through 3.1.5 allow high privilege users to execute arbitrary PHP code in an hardened environment (ie with DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and DISALLOW_UNFILTERED_HTML set to true) via the 'widget_…

  45. 7.8CVE-2021-41228EPSS 0.2%

    TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a code injection as it calls `eval` on user supplied strings. This can be used by attackers to run arbitr…

  46. 7.8CVE-2021-42057EPSS 1.2%

    Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker to craft malicious Markdown files that will execute arbitrary code once opened. NOTE: 0.4.13 provid…

  47. 7.2CVE-2021-43281EPSS 1.3%

    MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add …

  48. 5.0CVE-2021-42754EPSS 0.4%

    An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated attacker to hijack the MacOS camera without the user permission via the malicious …

  49. 7.2CVE-2021-25877EPSS 1.6%

    AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code variables in file save.php.

  50. 8.8CVE-2021-40348EPSS 1.8%

    Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tom…