CWE-94— Improper Control of Generation of Code (Code Injection)

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.— MITRE CWE catalog

6,496 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-94page 111 of 130

CVE-2025-70364HIGHCVSS 8.8EG 8.8
2026-04-09
An issue was discovered in Kiamo before 8.4 allowing authenticated administrative attackers to execute arbitrary PHP code on the server. NOTE: the Supplier's position is that this is "a historical and intended administrative feature of the…
CVE-2025-7053MEDIUMCVSS 6.1EG 3.5
2025-07-04
A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site scripting. The …
CVE-2025-70830CRITICALCVSS 9.9EG 9.9
2026-02-17
A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via injecting crafted Freemarker template syntax into the SQL script fie…
CVE-2025-70844MEDIUMCVSS 6.1EG 6.1
2026-04-07
yaffa v2.0.0 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript into the "Add Account Group" function on the account-group page, allowing execution of arbitrary script in the context of users who view …
CVE-2025-70995HIGHCVSS 8.8EG 8.8
2026-03-05
An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files. An authenticated user can upload a crafted web.config file by sending …
CVE-2025-7101CRITICALCVSS 9.8EG 6.3
2025-07-07
A vulnerability was found in BoyunCMS up to 1.4.20. It has been classified as critical. This affects an unknown part of the file /install/install_ok.php of the component Configuration File Handler. The manipulation of the argument db_pass …
CVE-2025-71058CRITICALCVSS 9.1EG 9.1
2026-04-07
Dual DHCP DNS Server 8.01 improperly accepts and caches UDP DNS responses without validating that the response originates from a legitimate configured upstream DNS server. The implementation matches responses primarily by TXID and inserts …
CVE-2025-7109MEDIUMCVSS 5.4EG 3.5
2025-07-07
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the file /intranet/educar_aluno_beneficio_lst.php of the component Student Benefits …
CVE-2025-7110MEDIUMCVSS 5.4EG 3.5
2025-07-07
A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9.0. This affects an unknown part of the file /intranet/educar_escola_lst.php of the component School Module. The manipulation of the argument Escola …
CVE-2025-7111MEDIUMCVSS 5.4EG 3.5
2025-07-07
A vulnerability has been found in Portabilis i-Educar 2.9.0 and classified as problematic. This vulnerability affects unknown code of the file /intranet/educar_curso_det.php?cod_curso=ID of the component Course Module. The manipulation of …
CVE-2025-7112MEDIUMCVSS 5.4EG 3.5
2025-07-07
A vulnerability was found in Portabilis i-Educar 2.9.0 and classified as problematic. This issue affects some unknown processing of the file /intranet/educar_funcao_det.php?cod_funcao=COD&ref_cod_instituicao=COD of the component Function M…
CVE-2025-7113MEDIUMCVSS 5.4EG 3.5
2025-07-07
A vulnerability was found in Portabilis i-Educar 2.9.0. It has been classified as problematic. Affected is an unknown function of the file /module/ComponenteCurricular/edit?id=ID of the component Curricular Components Module. The manipulat…
CVE-2025-71281HIGHCVSS 8.8EG 8.8
2026-04-01
XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match for methods accessible through callbacks and variable method calls in templates, p…
CVE-2025-7139MEDIUMCVSS 5.4EG 2.4
2025-07-07
A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /panel/edit-customer-detailed.php of the component Update Customer Detai…
CVE-2025-7140MEDIUMCVSS 5.4EG 2.4
2025-07-07
A vulnerability classified as problematic has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/edit-staff.php of the component Update Staff Page. The manipulation of the argu…
CVE-2025-7141MEDIUMCVSS 5.4EG 2.4
2025-07-07
A vulnerability classified as problematic was found in SourceCodester Best Salon Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /panel/edit_plan.php of the component Update Staff Page. The man…
CVE-2025-7142MEDIUMCVSS 5.4EG 2.4
2025-07-07
A vulnerability, which was classified as problematic, has been found in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown functionality of the file /panel/search-appointment.php. The manipulation leads…
CVE-2025-7143MEDIUMCVSS 5.4EG 2.4
2025-07-07
A vulnerability, which was classified as problematic, was found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/edit-tax.php of the component Update Tax Page. The manipulation of the argu…
CVE-2025-7144MEDIUMCVSS 4.8EG 2.4
2025-07-07
A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /panel/admin-profile.php of the component Admin Profile Page. The manipula…
CVE-2025-7148MEDIUMCVSS 5.4EG 3.5
2025-07-07
A vulnerability was found in CodeAstro Simple Hospital Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /patient.html of the component POST Parameter Handler. The manipul…
CVE-2025-7153MEDIUMCVSS 5.4EG 3.5
2025-07-08
A vulnerability classified as problematic was found in CodeAstro Simple Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /doctor.html of the component POST Parameter Handler. The manipu…
CVE-2025-7182MEDIUMCVSS 6.1EG 4.3
2025-07-08
A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/modules/subject/edit.php. The manipulation…
CVE-2025-7361HIGHCVSS 7.8EG 7.8
2025-07-29
A code injection vulnerability due to an improper initialization check exists in NI LabVIEW that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI using a CIN…
CVE-2025-7366HIGHCVSS 7.3EG 7.3
2025-09-06
The The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 19.9.7. This is due to the software allowing users to execu…
CVE-2025-7408MEDIUMCVSS 5.4EG 3.5
2025-07-10
A vulnerability has been found in SourceCodester Zoo Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/templates/animal_form_template.php. The manipulation of the argument msg l…
CVE-2025-7435LOWCVSS 3.5EG 3.5
2025-07-11
A vulnerability was found in LiveHelperChat lhc-php-resque Extension up to ee1270b35625f552425e32a6a3061cd54b5085c4. It has been classified as problematic. This affects an unknown part of the file /site_admin/lhcphpresque/list/ of the comp…
CVE-2025-7554LOWCVSS 2.4EG 2.4
2025-07-14
A vulnerability classified as problematic was found in Sapido RB-1802 1.0.32. This vulnerability affects unknown code of the file urlfilter.asp of the component URL Filtering Page. The manipulation of the argument URL address leads to cros…
CVE-2025-7567MEDIUMCVSS 4.3EG 4.3
2025-07-14
A vulnerability was found in ShopXO up to 6.5.0 and classified as problematic. This issue affects some unknown processing of the file header.html. The manipulation of the argument lang/system_type leads to cross site scripting. The attack …
CVE-2025-7569LOWCVSS 3.5EG 3.5
2025-07-14
A vulnerability was found in Bigotry OneBase up to 1.3.6. It has been declared as problematic. Affected by this vulnerability is the function parse_args of the file /tpl/think_exception.tpl. The manipulation of the argument args leads to c…
CVE-2025-7601MEDIUMCVSS 5.4EG 3.5
2025-07-14
A vulnerability has been found in PHPGurukul Online Library Management System 3.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/student-history.php. The manipulation of the argument stdid leads t…
CVE-2025-7711MEDIUMCVSS 5.4EG 5.4
2025-11-17
The The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.3. This is due to the software allowing users to execut…
CVE-2025-7728MEDIUMCVSS 5.4EG 3.5
2025-07-17
A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. Affected is an unknown function of the file users.shtm. The manipulation of the argument Username leads to cross site scripting. It is possible to launch …
CVE-2025-7729MEDIUMCVSS 5.4EG 3.5
2025-07-17
A vulnerability classified as problematic was found in Scada-LTS up to 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file usersProfiles.shtm. The manipulation of the argument Username leads to cross site script…
CVE-2025-7748LOWCVSS 3.5EG 3.5
2025-07-17
A vulnerability classified as problematic was found in ZCMS 3.6.0. This vulnerability affects unknown code of the component Create Article Page. The manipulation of the argument Title leads to cross site scripting. The attack can be initia…
CVE-2025-7767MEDIUMCVSS 5.4EG 3.5
2025-07-18
A vulnerability, which was classified as problematic, has been found in PHPGurukul Art Gallery Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/edit-art-medium-detail.php. The manipulation of t…
CVE-2025-7786MEDIUMCVSS 5.4EG 3.5
2025-07-18
A vulnerability, which was classified as problematic, has been found in Gnuboard g6 up to 6.0.10. This issue affects some unknown processing of the file /bbs/scrap_popin_update/qa/ of the component Post Reply Handler. The manipulation lead…
CVE-2025-7791MEDIUMCVSS 5.4EG 3.5
2025-07-18
A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/search.php. The manipulation of the argument searchdata leads…
CVE-2025-7800LOWCVSS 3.5EG 3.5
2025-07-18
A vulnerability classified as problematic was found in cgpandey hotelmis up to c572198e6c4780fccc63b1d3e8f3f72f825fc94e. This vulnerability affects unknown code of the file admin.php of the component HTTP GET Request Handler. The manipulat…
CVE-2025-7802MEDIUMCVSS 5.4EG 3.5
2025-07-18
A vulnerability was found in PHPGurukul Complaint Management System 2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/complaint-search.php. The manipulation of the argument Search le…
CVE-2025-7803LOWCVSS 3.5EG 3.5
2025-07-18
A vulnerability was found in descreekert wx-discuz up to 12bd4745c63ec203cb32119bf77ead4a923bf277. It has been classified as problematic. This affects the function validToken of the file /wx.php. The manipulation of the argument echostr le…
CVE-2025-7815MEDIUMCVSS 5.4EG 2.4
2025-07-19
A vulnerability, which was classified as problematic, has been found in PHPGurukul Apartment Visitors Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php of the component HTTP POST Request …
CVE-2025-7816MEDIUMCVSS 5.4EG 3.5
2025-07-19
A vulnerability, which was classified as problematic, was found in PHPGurukul Apartment Visitors Management System 1.0. Affected is an unknown function of the file /visitor-detail.php of the component HTTP POST Request Handler. The manipul…
CVE-2025-7817MEDIUMCVSS 5.4EG 3.5
2025-07-19
A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /bwdates-reports.php of the component HTTP POST Req…
CVE-2025-7818MEDIUMCVSS 5.4EG 3.5
2025-07-19
A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /category.php of the component HTTP POST Request Handler. The …
CVE-2025-7819MEDIUMCVSS 5.4EG 2.4
2025-07-19
A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /create-pass.php of the component HTTP POST Request Handler. The manipulation…
CVE-2025-7840MEDIUMCVSS 6.1EG 3.5
2025-07-19
A vulnerability was found in Campcodes Online Movie Theater Seat Reservation System 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php?page=reserve of the component Reserve Your Seat Page. The m…
CVE-2025-7856MEDIUMCVSS 5.4EG 3.5
2025-07-19
A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file pass-details.php of the component HTTP POST Reque…
CVE-2025-7857MEDIUMCVSS 5.4EG 3.5
2025-07-19
A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file bwdates-passreports-details.php of the component HTTP POST…
CVE-2025-7858MEDIUMCVSS 5.4EG 3.5
2025-07-20
A vulnerability classified as problematic has been found in PHPGurukul Apartment Visitors Management System 1.0. This affects an unknown part of the file /admin-profile.php of the component HTTP POST Request Handler. The manipulation of th…
CVE-2025-7865MEDIUMCVSS 5.4EG 3.5
2025-07-20
A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been declared as problematic. This vulnerability affects the function xssFilter of the file src/main/java/com/jeesite/common/codec/EncodeUtils.java of the component XSS Fil…

Map vulnerabilities like CWE-94 to your infrastructure

EchelonGraph correlates every CVE — across CWE-94 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →