Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CVEs (6,471)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-30580 1Golang 1Go Mar 6, 2026 Aug 10, 2022 N/A· v4 7.8 HIGH· v3 N/A· v2 Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedO...Show more Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.Show less
CVE-2022-35779 1Microsoft 1Azure Real Time Operating System Guix Studio May 29, 2025 Aug 9, 2022 N/A· v4 7.8 HIGH· v3 N/A· v2 Azure RTOS GUIX Studio Remote Code Execution Vulnerability
CVE-2022-35777 1Microsoft 4Visual Studio Visual Studio 2017Visual Studio 2019+1 more May 29, 2025 Aug 9, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Visual Studio Remote Code Execution Vulnerability
CVE-2022-35772 1Microsoft 1Azure Site Recovery Vmware To Azure May 29, 2025 Aug 9, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Azure Site Recovery Remote Code Execution Vulnerability
CVE-2022-35767 1Microsoft 10Windows 10 Windows 11Windows 7+7 more May 29, 2025 Aug 9, 2022 N/A· v4 8.1 HIGH· v3 N/A· v2 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2022-35766 1Microsoft 5Windows 10 Windows 11Windows Server 2016+2 more May 29, 2025 Aug 9, 2022 N/A· v4 8.1 HIGH· v3 N/A· v2 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2022-34715 1Microsoft 1Windows Server 2022 May 29, 2025 Aug 9, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Windows Network File System Remote Code Execution Vulnerability
CVE-2022-34714 1Microsoft 10Windows 10 Windows 11Windows 7+7 more May 29, 2025 Aug 9, 2022 N/A· v4 8.1 HIGH· v3 N/A· v2 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2022-30194 1Microsoft 10Windows 10 Windows 11Windows 7+7 more Jun 24, 2025 Aug 9, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 Windows WebBrowser Control Remote Code Execution Vulnerability
CVE-2022-30175 1Microsoft 1Azure Real Time Operating System Guix Studio Jun 24, 2025 Aug 9, 2022 N/A· v4 7.8 HIGH· v3 N/A· v2 Azure RTOS GUIX Studio Remote Code Execution Vulnerability
CVE-2022-33725 1Google 1Android Nov 21, 2024 Aug 5, 2022 N/A· v4 3.3 LOW· v3 N/A· v2 A vulnerability using PendingIntent in Knox VPN prior to SMR Aug-2022 Release 1 allows attackers to access content providers with system privilege.
CVE-2022-33721 1Google 1Android Nov 21, 2024 Aug 5, 2022 N/A· v4 5.5 MEDIUM· v3 N/A· v2 A vulnerability using PendingIntent in DeX for PC prior to SMR Aug-2022 Release 1 allows attackers to access files with system privilege.
CVE-2022-2636 1Hestiacp 1Control Panel Feb 25, 2026 Aug 5, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.
CVE-2022-37396 1Jetbrains 1Rider Nov 21, 2024 Aug 3, 2022 N/A· v4 7.8 HIGH· v3 N/A· v2 In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution
CVE-2022-34625 1Mealie Project 1Mealie Nov 21, 2024 Aug 2, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to execute arbitrary code via a crafted Jinja2 template.
CVE-2022-36799 1Atlassian 2Jira Data Center Jira Server Nov 21, 2024 Aug 1, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attacker...Show more This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. In this case the security improvement was to protect against using the XStream library to be able to execute arbitrary code in velocity templates. The affected versions are before version 8.13.19, from version 8.14.0 before 8.20.7, and from version 8.21.0 before 8.22.1.Show less
CVE-2022-30083 1Elliegrid 1Elliegrid Nov 21, 2024 Jul 30, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 EllieGrid Android Application version 3.4.1 is vulnerable to Code Injection. The application appears to evaluate user input as code (remote).
CVE-2021-22646 1Ovarro 8Tbox Lt2 530 Firmware Tbox Lt2 532 FirmwareTbox Lt2 540 Firmware+5 more Apr 17, 2025 Jul 28, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution.
CVE-2022-37009 1Jetbrains 1Intellij Idea Nov 21, 2024 Jul 28, 2022 N/A· v4 7.8 HIGH· v3 N/A· v2 In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible
CVE-2022-35649 2Fedoraproject Moodle 2Fedora Moodle Nov 21, 2024 Jul 25, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions o...Show more The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.Show less

Previous 1...180181182...324 Next