CWE-94
7,062 CVEs • Abstraction: Base • Likelihood of Exploit: Medium
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVEs (7,062)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Microsoft 1Azure Real Time Operating System Guix Studio Jun 17, 2026 Aug 9, 2022 N/A· v4 7.8 HIGH· v3 N/A· v2 Azure RTOS GUIX Studio Remote Code Execution Vulnerability |
A vulnerability using PendingIntent in Knox VPN prior to SMR Aug-2022 Release 1 allows attackers to access content providers with system privilege. |
A vulnerability using PendingIntent in DeX for PC prior to SMR Aug-2022 Release 1 allows attackers to access files with system privilege. |
Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6. |
In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution |
Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to execute arbitrary code via a crafted Jinja2 template. |
1Atlassian 2Jira Data Center Jira ServerJun 17, 2026 Aug 1, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attacker...Show more |
EllieGrid Android Application version 3.4.1 is vulnerable to Code Injection. The application appears to evaluate user input as code (remote). |
1Ovarro 8Tbox Lt2 530 Firmware Tbox Lt2 532 FirmwareTbox Lt2 540 Firmware+5 moreJun 17, 2026 Jul 28, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution. |
In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible |
2Fedoraproject Moodle2Fedora MoodleJun 17, 2026 Jul 25, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions o...Show more |
1Convert Svg Core Project 1Convert Svg Core Jun 17, 2026 Jul 22, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload. |
Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received f...Show more |
PbootCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the function parserIfLabel at function.php. |
1Siemens 15Simatic Cp 1242 7 V2 Firmware Simatic Cp 1243 1 FirmwareSimatic Cp 1243 7 Lte Eu Firmware+12 moreSep 3, 2026 Jul 12, 2022 8.8 HIGH· v4 9.8 CRITICAL· v3 9.3 HIGH· v2 A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2), SCALANCE M804PB (6GK5804-0AP00-2AA2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00...Show more |
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM...Show more |
1Custom Content Type Manager Project 1Custom Content Type Manager Nov 21, 2024 Jul 6, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution. |
Code Injection in GitHub repository getgrav/grav prior to 1.7.34. |
piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor. |
1Analytics Stats Counter Statistics Project 1Analytics Stats Counter Statistics Nov 21, 2024 Jun 27, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated...Show more |