CWE-94

Medium likelihood

Improper Control of Generation of Code ('Code Injection')

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

6,492 vulnerabilities with CWE-94
CVE-2025-9119 LOW
Netis WF2419 1.2.29433 - Cross-Site Scripting via SSID Parameter in Wireless Settings Page
CVSS 2.4
CVE-2025-9107 MEDIUM
Portabilis i-Diario < 1.5.0 - Cross-Site Scripting via Search Autocomplete Parameter
CVSS 4.3
CVE-2025-9106 LOW
Portabilis i-Diario < 1.5.0 - Stored Cross-Site Scripting via Parecer/Contedos/Objetivos Parameters
CVSS 3.5
CVE-2025-9105 LOW
Portabilis i-Diario < 1.5.0 - Stored Cross-Site Scripting via Parecer/Contedos/Objetivos Parameters
CVSS 3.5
CVE-2025-9104 LOW
Portabilis i-Diario < 1.5.0 - Stored Cross-Site Scripting via Parecer/Objeto de Conhecimento/Habilidades Parameters
CVSS 3.5
CVE-2025-9103 LOW
ZenCart 2.1.0 - Cross-Site Scripting in CKEditor
CVSS 2.4
CVE-2025-9101 LOW
zhenfeng13 My-Blog <= 1.0.0 - Cross-Site Scripting in Tag Handler
CVSS 3.5
CVE-2025-9096 LOW
ExpressGateway express-gateway <= 1.16.10 - Cross-Site Scripting in REST Endpoint
CVSS 3.5
CVE-2025-9095 LOW
ExpressGateway express-gateway <= 1.16.10 - Cross-Site Scripting in REST Endpoint
CVSS 3.5
CVE-2025-8878 MEDIUM
WordPress ProfilePress <= 4.16.4 - Unauthenticated Shortcode Execution
CVSS 6.5
CVE-2025-8105 HIGH
Soledad < 8.6.7 - Unauthenticated Arbitrary Shortcode Execution via do_shortcode
CVSS 7.3
CVE-2025-7961 MEDIUM
Wulkano KAP <3.6.0 - Code Injection
CVE-2025-54466 CRITICAL
Apache OFBiz < 24.09.02 - Unauthenticated Remote Code Execution via Scrum Plugin
CVSS 9.8
CVE-2025-8905 MEDIUM
Inpersttion For Theme <= 1.0 - Authenticated Remote Code Execution via theme_section_shortcode Function
CVSS 6.3
CVE-2025-9017 MEDIUM
PHPGurukul Zoo Management System 2.1 - Cross-Site Scripting via visitorname Parameter
CVSS 4.3
CVE-2025-9003 LOW
Dlink Dir-818lw Firmware - Code Injection
CVSS 3.5
CVE-2025-8976 LOW
Vvveb < 1.0.6 - Cross-Site Scripting via /vadmin123/index.php Endpoint
CVSS 3.5
CVE-2025-8975 LOW
Vvveb < 1.0.6 - Cross-Site Scripting via slug Parameter in admin/template/content/edit.tpl
CVSS 3.5
CVE-2025-55192 HIGH
HomeAssistant-Tapo-Control <2a3b80f - Code Injection
CVE-2025-49887 CRITICAL
WPFactory Product XML Feed Manager <2.9.3 - Code Injection
CVSS 9.9
CVE-2025-39483 MEDIUM
imithemes Eventer <3.9.9.1 - Code Injection
CVSS 6.5
CVE-2025-55346 CRITICAL
flowise - Remote Code Execution via Dynamic Function Constructor
CVSS 9.8
CVE-2025-8934 MEDIUM
1000 Projects Sales Management System 1.0 - Cross-Site Scripting via select2112 Parameter
CVSS 4.3
CVE-2025-8933 MEDIUM
1000 Projects Sales Management System 1.0 - Cross-Site Scripting via ssalescat Parameter
CVSS 4.3
CVE-2025-8920 LOW
Portabilis i-Diario 1.6 - Stored Cross-Site Scripting via Planos de ensino Parameter
CVSS 2.4
Details
Vulnerabilities 6,492
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits