Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CVEs (7,081)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-3098 - - Jun 17, 2026 Apr 10, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises du...Show more A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.Show less
CVE-2024-2195 1Aimstack 1Aim Jun 17, 2026 Apr 10, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affecting versions >= 3.0.0. The vulnerability resides in the `ru...Show more A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affecting versions >= 3.0.0. The vulnerability resides in the `run_search_api` function of the `aim/web/api/runs/views.py` file, where improper restriction of user access to the `RunView` object allows for the execution of arbitrary code via the `query` parameter. This issue enables attackers to execute arbitrary commands on the server, potentially leading to full system compromise.Show less
CVE-2024-27476 1Leantime 1Leantime Jun 17, 2026 Apr 10, 2024 N/A· v4 4.7 MEDIUM· v3 N/A· v2 Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket.
CVE-2024-31864 1Apache 1Zeppelin Jun 17, 2026 Apr 9, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue af...Show more Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.Show less
CVE-2023-47542 1Fortinet 1Fortimanager Jun 17, 2026 Apr 9, 2024 N/A· v4 6.7 MEDIUM· v3 N/A· v2 A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0.10 and below allows attacker to execute unauthorized code or...Show more A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0.10 and below allows attacker to execute unauthorized code or commands via specially crafted templates.Show less
CVE-2023-45590 1Fortinet 1Forticlient Jun 17, 2026 Apr 9, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows attacker to execute unauthorized code or commands via tricking...Show more An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows attacker to execute unauthorized code or commands via tricking a FortiClientLinux user into visiting a malicious websiteShow less
CVE-2024-31807 1Totolink 1Ex200 Firmware Jun 17, 2026 Apr 8, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the hostTime parameter in the NTPSyncWithHost function.
CVE-2024-31022 1Steve228uk 1Candycms Jun 17, 2026 Apr 8, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue was discovered in CandyCMS version 1.0.0, allows remote attackers to execute arbitrary code via the install.php component.
CVE-2024-25706 1Esri 1Portal For Arcgis Jun 17, 2026 Apr 4, 2024 N/A· v4 6.1 MEDIUM· v3 N/A· v2 There is an HTML injection vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL which, when clicked, could potentially generate a message that may entice...Show more There is an HTML injection vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL which, when clicked, could potentially generate a message that may entice an unsuspecting victim to visit an arbitrary website. This could simplify phishing attacks.Show less
CVE-2023-36645 1Itb Pim 1Tradepro Jun 17, 2026 Apr 4, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function.
CVE-2024-30565 1Seacms 1Seacms Jun 17, 2026 Apr 4, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 An issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php.
CVE-2024-27705 1Leantime 1Leantime Jun 17, 2026 Apr 3, 2024 N/A· v4 7.6 HIGH· v3 N/A· v2 Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the files/browse endpoint.
CVE-2024-30568 1Netgear 1R6850 Firmware Jun 17, 2026 Apr 3, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the c4-IPAddr parameter.
CVE-2024-25096 1Canto 1Canto Jun 17, 2026 Apr 3, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7.
CVE-2024-24707 - - Jun 17, 2026 Apr 3, 2024 N/A· v4 9.9 CRITICAL· v3 N/A· v2 Improper Control of Generation of Code ('Code Injection') vulnerability in Cwicly Builder, SL. Cwicly allows Code Injection.This issue affects Cwicly: from n/a through 1.4.0.2.
CVE-2024-31390 - - Jun 17, 2026 Apr 3, 2024 N/A· v4 9.9 CRITICAL· v3 N/A· v2 : Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Breakdance allows : Code Injection.This issue affects Breakdance: from n/a through 1.7.2.
CVE-2024-31380 - - Jun 17, 2026 Apr 3, 2024 N/A· v4 9.9 CRITICAL· v3 N/A· v2 Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Oxygen Builder allows Code Injection. Vendor is ignoring report, refuses to patch the issue.This issue affects Oxygen Builder: from n/a th...Show more Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Oxygen Builder allows Code Injection. Vendor is ignoring report, refuses to patch the issue.This issue affects Oxygen Builder: from n/a through 4.9.Show less
CVE-2024-29477 1Dolibarr 1Dolibarr Erp/crm Jul 9, 2026 Apr 3, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.
CVE-2024-27972 - - Jun 17, 2026 Apr 3, 2024 N/A· v4 9.9 CRITICAL· v3 N/A· v2 Improper Control of Generation of Code ('Code Injection') vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite.This issue affects WP Fusion Lite: from n/a through <= 3.41.24.
CVE-2024-27191 - - Jun 17, 2026 Apr 3, 2024 N/A· v4 8.5 HIGH· v3 N/A· v2 Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Slivery Extender slivery-extender allows Remote Code Inclusion.This issue affects Slivery Extender: from n/a through <= 1.0.2.

Previous 1...176177178...355 Next