CWE-94

Medium likelihood

Improper Control of Generation of Code ('Code Injection')

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

6,492 vulnerabilities with CWE-94
CVE-2025-54417 HIGH
Craft CMS 4.13.8-4.16.2 and 5.5.8-5.8.3 - Remote Code Execution via /updater/restore-db Endpoint
CVSS 8.8
CVE-2025-8743 LOW
scada-lts < 2.7.8.1 - Stored Cross-Site Scripting in Virtual Data Source Property Handler via Name Parameter
CVSS 3.5
CVE-2025-8740 LOW
zhenfeng13 My-Blog <= 1.0.0 - Cross-Site Scripting via Category Name Parameter
CVSS 2.4
CVE-2025-8356 CRITICAL
Xerox FreeFlow Core 8.0.4 - Path Traversal and Remote Code Execution
CVSS 9.8
CVE-2025-54940 LOW
WordPress Advanced Custom Fields <6.4.3 - XSS
CVSS 3.4
CVE-2025-50692 CRITICAL
FoxCMS < 1.2.6 - Remote Code Execution via Template File Edit
CVSS 9.8
CVE-2025-54594 CRITICAL
react-native-bottom-tabs <0.9.2 - Code Injection
CVSS 9.1
CVE-2025-50707 CRITICAL
ThinkPHP 3.2.5 index.php - Remote Code Execution
CVSS 9.8
CVE-2025-50706 CRITICAL
thinkphp 5.1 - Remote Code Execution via Route Check Function
CVSS 9.8
CVE-2025-8555 LOW
pybbs < 6.0.0 - Cross-Site Scripting via Search Keyword Parameter
CVSS 3.5
CVE-2025-8554 LOW
pybbs < 6.0.0 - Cross-Site Scripting via Username Parameter in Admin User List
CVSS 2.4
CVE-2025-8553 LOW
pybbs < 6.0.0 - Cross-Site Scripting via Sensitive Word List Argument
CVSS 2.4
CVE-2025-8552 LOW
pybbs < 6.0.0 - Cross-Site Scripting via /admin/tag/list Name Parameter
CVSS 2.4
CVE-2025-8551 LOW
pybbs < 6.0.0 - Cross-Site Scripting via Username Parameter in Admin Comment List
CVSS 3.5
CVE-2025-8550 LOW
pybbs < 6.0.0 - Cross-Site Scripting via Username Parameter in Admin Topic List
CVSS 2.4
CVE-2025-8545 LOW
Portabilis i-Educar 2.10 - Cross-Site Scripting via nm_motivo Parameter
CVSS 2.4
CVE-2025-8544 LOW
Portabilis i-Educar 2.10 - Cross-Site Scripting via /module/RegraAvaliacao/edit nome Parameter
CVSS 2.4
CVE-2025-8543 LOW
Portabilis i-Educar 2.10 - Cross-Site Scripting via nm_raca Parameter in educar_raca_cad.php
CVSS 2.4
CVE-2025-8542 LOW
Portabilis i-Educar 2.10 - Cross-Site Scripting via fantasia/razao_social Parameter
CVSS 2.4
CVE-2025-8541 LOW
Portabilis i-Educar 2.10 - Cross-Site Scripting via nome Parameter in public_uf_cad.php
CVSS 2.4
CVE-2025-8540 LOW
Portabilis i-Educar 2.10 - Cross-Site Scripting via nome Parameter in public_municipio_cad.php
CVSS 2.4
CVE-2025-8539 LOW
Portabilis i-Educar 2.10 - Cross-Site Scripting via nome Parameter in /intranet/public_distrito_cad.php
CVSS 2.4
CVE-2025-8538 LOW
Portabilis i-Educar 2.10 - Cross-Site Scripting via User Type Name/Description Parameter
CVSS 2.4
CVE-2025-8535 LOW
NanoVault < 1.2.1 - Cross-Site Scripting via xrb URL Handler
CVSS 3.5
CVE-2025-51387 CRITICAL
GitKraken Desktop 10.8.0-11.1.0 - Code Injection
CVSS 9.8
Details
Vulnerabilities 6,492
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits