CWE-94 Improper Control of Generation of Code ('Code Injection')
baseThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (10398)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-0322US | high7.2OT critical | KEV | ||
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbi… | ||||
| CVE-2026-58400US | —OT critical | — | ||
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured… | ||||
| CVE-2026-60004US | —OT critical | KEV | ||
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. | ||||
| CVE-2026-72530US | —OT critical | KEV | ||
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a special… | ||||
| CVE-2026-65660US | high8.8OT critical | KEV | ||
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-9198US | —OT critical | KEV | ||
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (execut… | ||||
| CVE-2026-15410US | —OT critical | KEV | ||
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific… | ||||
| CVE-2026-34197US | —OT critical | KEV | ||
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the… | ||||
| CVE-2026-33017US | critical9.8OT critical | KEV | ||
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building… | ||||
| CVE-2026-3910US | high8.8OT critical | KEV | ||
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium s… | ||||
| CVE-2026-1340US | —OT critical | KEV | ||
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. | ||||
| CVE-2026-1281US | —OT critical | KEV | ||
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. | ||||
| CVE-2026-20045US | critical9.8OT critical | KEV | ||
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications… | ||||
| CVE-2025-37164US | critical9.8OT critical | KEV | ||
A remote code execution issue exists in HPE OneView. | ||||
| CVE-2025-62593US | high8.8OT critical | KEV | ||
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox an… | ||||
| CVE-2025-6204US | —OT critical | KEV | ||
An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary… | ||||
| CVE-2025-54068US | critical9.8OT critical | KEV | ||
Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in s… | ||||
| CVE-2025-49704US | —OT critical | KEV | ||
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2025-4428US | high8.8OT critical | KEV | ||
Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via cr… | ||||
| CVE-2025-3928US | high8.8OT critical | KEV | ||
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised… | ||||
04
attack patterns (3)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan