CWE-94

Medium likelihood

Improper Control of Generation of Code ('Code Injection')

Parent: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

6,492 vulnerabilities with CWE-94
CVE-2025-6694 LOW
LabRedesCefetRJ WeGIA 3.4.0 - Cross-Site Scripting via Adicionar Unidade Component
CVSS 3.5
CVE-2025-6613 LOW
PHPGurukul Hospital Management System 4.0 - Stored Cross-Site Scripting via Name Parameter in manage-patient.php
CVSS 3.5
CVE-2025-23265 HIGH
NVIDIA Megatron-LM < 0.12.1 - Code Injection via Malicious File
CVSS 7.8
CVE-2025-23264 HIGH
NVIDIA Megatron-LM < 0.12.1 - Code Injection via Malicious File
CVSS 7.8
CVE-2025-6569 MEDIUM
School Fees Payment System 1.0 - XSS
CVSS 4.3
CVE-2025-6551 LOW
java-aodeng Hope-Boot 1.0.0 - Cross-Site Scripting via WebController Login Error Message
CVSS 3.5
CVE-2025-6509 LOW
seaswalker spring-analysis <4379cce848af96997a9d7ef91d594aa129be8d7...
CVSS 3.5
CVE-2025-6512 CRITICAL
Bizerba BRAIN2 < 3.06 - Remote Code Execution via Report Script Injection
CVSS 10.0
CVE-2025-6477 LOW
Student Result Management System 1.0 - Cross-Site Scripting via System Settings Page School Name Parameter
CVSS 2.4
CVE-2025-6475 LOW
Student Result Management System 1.0 - Cross-Site Scripting in Manage Students Module
CVSS 2.4
CVE-2025-6473 MEDIUM
School Fees Payment System 1.0 - Cross-Site Scripting via transcation_remark Parameter
CVSS 4.3
CVE-2025-6452 LOW
CodeAstro Patient Record Management System 1.0 - Cross-Site Scripting via Patient Name Parameter
CVSS 2.4
CVE-2025-6353 LOW
Responsive Blog Site 1.0 - Cross-Site Scripting via Search Keyword Parameter
CVSS 3.5
CVE-2025-49132 CRITICAL
Pterodactyl Panel < 1.11.11 - Unauthenticated Remote Code Execution via Locale Endpoint
CVSS 10.0
CVE-2025-6347 LOW
Responsive Blog Site 1.0/1.12.4/3.3.4 - Cross-Site Scripting in pageViewMembers.php
CVSS 2.4
CVE-2025-6345 LOW
My Food Recipe 1.0 - Cross-Site Scripting via Add Recipe Page Name Parameter
CVSS 3.5
CVE-2025-6340 LOW
School Fees Payment System 1.0 - XSS
CVSS 3.5
CVE-2025-6301 LOW
PHPGurukul Notice Board System 1.0 - XSS
CVSS 2.4
CVE-2025-6288 LOW
PHPGurukul Bus Pass Management System 1.0 - XSS
CVSS 2.4
CVE-2025-6287 LOW
PHPGurukul COVID19 Testing Management System 1.0 - XSS
CVSS 3.5
CVE-2025-6285 MEDIUM
PHPGurukul COVID19 Testing Management System 2021 - XSS
CVSS 4.3
CVE-2025-6268 MEDIUM
Luna Imaging <= 7.5.5.6 - Cross-Site Scripting via Search Query Parameter
CVSS 4.3
CVE-2025-24287 MEDIUM
Veeam Backup for Microsoft Windows 6.2.0.121 - Local Code Execution
CVSS 6.1
CVE-2025-23121 HIGH
Veeam Backup & Replication < 12.3.2.3617 - Authenticated Remote Code Execution
CVSS 8.8
CVE-2025-32798 CRITICAL
conda-build < 25.4.0 - Remote Code Execution via Unsafe Recipe Selector Evaluation
CVSS 9.8
Details
Vulnerabilities 6,492
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits