Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CVEs (7,056)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-8218 2Ivanti Pulsesecure 3Connect Secure Policy SecurePulse Policy Secure Jun 17, 2026 Jul 30, 2020 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
CVE-2020-7694 1Encode 1Uvicorn Jun 17, 2026 Jul 27, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log...Show more This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file).Show less
CVE-2020-12013 2Iconics Mitsubishielectric 11Bizviz Energy AnalytixFacility Analytix+8 more Jun 17, 2026 Jul 16, 2020 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all version...Show more A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.Show less
CVE-2020-11546 1Superwebmailer 1Superwebmailer Jun 17, 2026 Jul 14, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP c...Show more SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.Show less
CVE-2020-8194 1Citrix 4Application Delivery Controller Firmware Gateway FirmwareNetscaler Gateway Firmware+1 more Jun 17, 2026 Jul 10, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows the modif...Show more Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows the modification of a file download.Show less
CVE-2020-8163 2Debian Rubyonrails 2Debian Linux Rails Jun 17, 2026 Jul 2, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
CVE-2020-15348 1Zyxel 1Cloud Cnm Secumanager Jun 17, 2026 Jun 26, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows use of live/CPEManager/AXCampaignManager/delete_cpes_by_ids?cpe_ids= for eval injection of Python code.
CVE-2016-11064 1Mattermost 1Mattermost Desktop Nov 21, 2024 Jun 19, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
CVE-2020-5593 1Zenphoto 1Zenphoto Jun 17, 2026 Jun 11, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Zenphoto versions prior to 1.5.7 allows an attacker to conduct PHP code injection attacks by leading a user to upload a specially crafted .zip file.
CVE-2020-7675 1Cd Messenger Project 1Cd Messenger Jun 17, 2026 Jun 10, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the `color` argument executed by the `eval` function resulting in code execution.
CVE-2020-7674 1Access Policy Project 1Access Policy Jun 17, 2026 Jun 10, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the `template` function is executed by the `eval` function resulting in code execution.
CVE-2020-7673 1Node Extend Project 1Node Extend Jun 17, 2026 Jun 10, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located within `lib/extend.js` is executed by the `eval` function, resul...Show more node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located within `lib/extend.js` is executed by the `eval` function, resulting in code execution.Show less
CVE-2020-7672 1Mosc Project 1Mosc Jun 17, 2026 Jun 10, 2020 N/A· v4 8.6 HIGH· v3 7.5 HIGH· v2 mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in code execution.
CVE-2020-8180 1Nextcloud 1Talk Jun 17, 2026 Jun 8, 2020 N/A· v4 9.9 CRITICAL· v3 6.5 MEDIUM· v2 A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator.
CVE-2020-7013 2Elastic Redhat 2Kibana Openshift Container Platform Jun 17, 2026 Jun 3, 2020 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary co...Show more Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.Show less
CVE-2020-7012 1Elastic 1Kibana Jun 17, 2026 Jun 3, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kib...Show more Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.Show less
CVE-2020-13756 1Sabberworm 1Php Css Parser Jun 17, 2026 Jun 3, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
CVE-2020-11079 1Node Dns Sync Project 1Node Dns Sync Jun 17, 2026 May 28, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This ha...Show more node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.Show less
CVE-2019-5997 1Panasonic 1Video Insight Vms Jun 17, 2026 May 20, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Video Insight VMS versions prior to 7.6.1 allow remote attackers to conduct code injection attacks via unspecified vectors.
CVE-2020-13144 1Edx 1Open Edx Platform Jun 17, 2026 May 18, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new component>Problem button>Advanced tab>Custom Python evaluated code" sc...Show more Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New unit>Add new component>Problem button>Advanced tab>Custom Python evaluated code" screen, edit the problem, and execute Python code. This leads to arbitrary code execution.Show less

Previous 1...226227228...353 Next