CWE-94
6,471 CVEs • Abstraction: Base • Likelihood of Exploit: Medium
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVEs (6,471)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Convert Svg Core Project 1Convert Svg Core Nov 21, 2024 Jul 22, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload. |
Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received f...Show more |
PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the function parserIfLabel at function.php. |
1Siemens 15Simatic Cp 1242 7 V2 Firmware Simatic Cp 1243 1 FirmwareSimatic Cp 1243 7 Lte Eu Firmware+12 moreJan 14, 2025 Jul 12, 2022 8.8 HIGH· v4 9.8 CRITICAL· v3 9.3 HIGH· v2 A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2), SCALANCE M804PB (6GK5804-0AP00-2AA2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00...Show more |
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM...Show more |
1Custom Content Type Manager Project 1Custom Content Type Manager Nov 21, 2024 Jul 6, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution. |
Code Injection in GitHub repository getgrav/grav prior to 1.7.34. |
piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor. |
1Analytics Stats Counter Statistics Project 1Analytics Stats Counter Statistics Nov 21, 2024 Jun 27, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated...Show more |
1Simple Ads Manager Project 1Simple Ads Manager Nov 21, 2024 Jun 24, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A vulnerability classified as critical was found in Simple Ads Manager Plugin. This vulnerability affects unknown code. The manipulation leads to code injection. The attack can be initiated remotely. |
A vulnerability, which was classified as critical, was found in VaultPress Plugin 1.8.4. This affects an unknown part. The manipulation leads to code injection. It is possible to initiate the attack remotely. |
A vulnerability was found in Elefant CMS 1.3.12-RC. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /designer/add/layout. The manipulation leads to code injection....Show more |
flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code. |
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments...Show more |
Code Injection in GitHub repository nuitka/nuitka prior to 0.9. |
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution. |
1Convert Svg Core Project 1Convert Svg Core Nov 21, 2024 Jun 10, 2022 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a...Show more |
Code Injection in GitHub repository jgraph/drawio prior to 19.0.2. |
The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScrip...Show more |
2Debian Rubyonrails2Active Storage Debian LinuxNov 21, 2024 May 26, 2022 N/A· v4 9.8 CRITICAL· v3 6.8 MEDIUM· v2 A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments. |