CWE-94

Medium likelihood

Improper Control of Generation of Code ('Code Injection')

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

6,491 vulnerabilities with CWE-94
CVE-2025-9921 LOW
code-projects POS Pharmacy System 1.0 - Cross-Site Scripting via product_code/gen_name/product_name/supplier Parameters
CVSS 2.4
CVE-2025-58176 HIGH
Dive 0.9.0-0.9.3 - Remote Code Execution via Custom URL Transport Parameter
CVSS 8.8
CVE-2025-9845 LOW
Fruit Shop Management System 1.0 - Cross-Site Scripting via products.php Parameter Manipulation
CVSS 3.5
CVE-2025-9834 LOW
PHPGurukul Small CRM 4.0 - Stored Cross-Site Scripting via Username Parameter in Registration
CVSS 3.5
CVE-2025-9796 LOW
JeeSite < 5.13.0 - Cross-Site Scripting via EncodeUtils.decodeUrl2
CVSS 3.5
CVE-2025-9773 MEDIUM
RemoteClinic < 2.0 - Cross-Site Scripting via Last Name Parameter in Staff Edit Page
CVSS 4.3
CVE-2025-9755 MEDIUM
khanakag-17 library_management_system < 2025-08-23 - Cross-Site Scripting via msg Parameter
CVSS 4.3
CVE-2025-9754 LOW
Campcodes Online Hospital Management System 1.0 - Stored Cross-Site Scripting via Edit Profile Username Field
CVSS 3.5
CVE-2025-9753 LOW
Campcodes Online Hospital Management System 1.0 - Cross-Site Scripting in Patient Search Module
CVSS 2.4
CVE-2025-9746 LOW
Campcodes Hospital Management System 1.0 - Stored Cross-Site Scripting in Edit Doctor Specialization Page
CVSS 2.4
CVE-2025-9738 LOW
Portabilis i-Educar < 2.10.0 - Cross-Site Scripting via nm_tipo Argument in educar_tipo_ensino_cad.php
CVSS 3.5
CVE-2025-9737 LOW
O2OA <10.0-410 - XSS
CVSS 3.5
CVE-2025-9736 LOW
O2OA <10.0-410 - XSS
CVSS 3.5
CVE-2025-9735 LOW
O2OA <10.0-410 - XSS
CVSS 3.5
CVE-2025-9734 LOW
O2OA <10.0-410 - XSS
CVSS 3.5
CVE-2025-9728 MEDIUM
Vvveb 1.0.7.2 - Cross-Site Scripting via Email/Password Argument
CVSS 4.3
CVE-2025-9724 LOW
Portabilis i-educar < 2.10 - Cross-Site Scripting via nm_nivel/descricao Parameter
CVSS 3.5
CVE-2025-9723 LOW
Portabilis i-Educar <= 2.10 - Cross-Site Scripting via nm_tipo Argument
CVSS 3.5
CVE-2025-9722 LOW
Portabilis i-Educar <= 2.10 - Cross-Site Scripting via nm_tipo/descricao Parameter
CVSS 3.5
CVE-2025-9721 LOW
Portabilis i-Educar < 2.10 - Cross-Site Scripting via FormulaMedia Edit Function
CVSS 3.5
CVE-2025-9720 LOW
Portabilis i-educar < 2.10 - Cross-Site Scripting via Nome Parameter in Cadastrar tabela de arredondamento Page
CVSS 3.5
CVE-2025-9719 LOW
O2OA <10.0-410 - XSS
CVSS 3.5
CVE-2025-9718 LOW
O2OA <10.0-410 - XSS
CVSS 3.5
CVE-2025-9717 LOW
O2OA <10.0-410 - XSS
CVSS 3.5
CVE-2025-9716 LOW
O2OA <10.0-410 - XSS
CVSS 3.5
Details
Vulnerabilities 6,491
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits