Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CVEs (7,056)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-18582 1Dell 2Emc Data Protection Advisor Emc Integrated Data Protection Appliance Firmware Jun 17, 2026 Mar 18, 2020 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server-side template injection vulnerability in the REST API. A remote authenticated...Show more Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server-side template injection vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this vulnerability to inject malicious report generation scripts in the server. This may lead to OS command execution as the regular user runs the DPA service on the affected system.Show less
CVE-2019-19208 1Codiad 1Codiad Jun 17, 2026 Mar 16, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Codiad Web IDE through 2.8.4 allows PHP Code injection.
CVE-2020-8141 1Dot Project 1Dot Jun 17, 2026 Mar 15, 2020 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
CVE-2020-10389 1Chadhaajay 1Phpkb Jun 17, 2026 Mar 12, 2020 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 admin/save-settings.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by injecting PHP code into any POST parameter when saving global settings.
CVE-2020-5203 1Fatfreeframework 1Fat Free Framework Jun 17, 2026 Mar 11, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the framework's Clear method.
CVE-2020-5259 1Linuxfoundation 1Dojox Jun 17, 2026 Mar 10, 2020 N/A· v4 8.6 HIGH· v3 5.0 MEDIUM· v2 In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, s...Show more In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.11.10, 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2Show less
CVE-2020-5258 3Debian LinuxfoundationOracle 10Communications Application Session Controller Communications Policy ManagementCommunications Pricing Design Center+7 more Jun 17, 2026 Mar 10, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes,...Show more In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2Show less
CVE-2020-10257 1Themerex 63Addons Aldo Gutenberg Wordpress Blog ThemeAmuli+60 more Jun 17, 2026 Mar 10, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-...Show more The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.Show less
CVE-2020-9530 1Mi 1Miui Firmware Jun 17, 2026 Mar 6, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. The export component of GetApps(com.xiaomi.mipicks) mishandles the functionality of opening other components. Attackers need to induce users to open speci...Show more An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. The export component of GetApps(com.xiaomi.mipicks) mishandles the functionality of opening other components. Attackers need to induce users to open specific web pages in a specific network environment. By jumping to the WebView component of Messaging(com.android.MMS) and loading malicious web pages, information leakage can occur. This is fixed on version: 2001122; 11.0.1.54.Show less
CVE-2019-3695 1Opensuse 1Pcp Jun 17, 2026 Mar 3, 2020 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise...Show more A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows the user pcp to run code as root by placing it into /var/log/pcp/configs.sh This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1.Show less
CVE-2020-8132 1Pdf Image Project 1Pdf Image Jun 17, 2026 Feb 28, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user input.
CVE-2020-9406 1Iblsoft 1Online Weather Jun 17, 2026 Feb 26, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
CVE-2019-4000 1Druva 1Insync Jun 17, 2026 Feb 25, 2020 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attacker to execute arbitrary Python expressions with root privileges.
CVE-2020-8518 3Debian FedoraprojectHorde 3Debian Linux FedoraGroupware Jun 17, 2026 Feb 17, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.
CVE-2020-8129 1Script Manager Project 1Script Manager Jun 17, 2026 Feb 14, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code.
CVE-2013-4211 1Openx 1Openx Nov 21, 2024 Feb 14, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP code
CVE-2013-4225 1Restful Web Services Project 1Restful Web Services Nov 21, 2024 Feb 11, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users wit...Show more The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.Show less
CVE-2020-5529 4Apache CanonicalDebian+1 more 4Camel Debian LinuxHtmlunit+1 more Jun 17, 2026 Feb 11, 2020 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded...Show more HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.Show less
CVE-2019-17268 1Omniauth Weibo Oauth2 Project 1Omniauth Weibo Oauth2 Jun 17, 2026 Feb 7, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected.
CVE-2020-8644 1Playsms 1Playsms Jun 17, 2026 Feb 5, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.

Previous 1...228229230...353 Next