CWE-94— Improper Control of Generation of Code (Code Injection)

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.— MITRE CWE catalog

6,499 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-94page 112 of 130

CVE-2025-7866MEDIUMCVSS 5.4EG 3.5
2025-07-20
A vulnerability was found in Portabilis i-Educar 2.9.0. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/educar_deficiencia_lst.php of the component Disabilities Module. The manipulation of…
CVE-2025-7867MEDIUMCVSS 5.4EG 3.5
2025-07-20
A vulnerability has been found in Portabilis i-Educar 2.9.0/2.10.0. This vulnerability affects unknown code of the file /intranet/agenda.php of the component Agenda Module. The manipulation of the argument novo_titulo/novo_descricao leads …
CVE-2025-7868MEDIUMCVSS 5.4EG 3.5
2025-07-20
A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_calendario_dia_motivo_cad.php of the component Calendar Module. The manipulation of the argument Motivo/de…
CVE-2025-7869MEDIUMCVSS 5.4EG 3.5
2025-07-20
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the file intranet/educar_turma_tipo_det.php?cod_turma_tipo=ID of the component Turma…
CVE-2025-7870MEDIUMCVSS 5.4EG 3.5
2025-07-20
A vulnerability, which was classified as problematic, was found in Portabilis i-Diario 1.5.0. This affects an unknown part of the component justificativas-de-falta Endpoint. The manipulation of the argument Anexo leads to cross site script…
CVE-2025-7871MEDIUMCVSS 5.4EG 3.5
2025-07-20
A vulnerability has been found in Portabilis i-Diario 1.5.0 and classified as problematic. This vulnerability affects unknown code of the file /conteudos. The manipulation of the argument filter[by_description] leads to cross site scriptin…
CVE-2025-7872MEDIUMCVSS 5.4EG 3.5
2025-07-20
A vulnerability was found in Portabilis i-Diario 1.5.0 and classified as problematic. This issue affects some unknown processing of the file /justificativas-de-falta. The manipulation of the argument Justificativa leads to cross site scrip…
CVE-2025-7885MEDIUMCVSS 6.1EG 4.3
2025-07-20
A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument hostname/port leads …
CVE-2025-7887MEDIUMCVSS 6.1EG 4.3
2025-07-20
A vulnerability has been found in Zavy86 WikiDocs up to 1.0.78 and classified as problematic. This vulnerability affects unknown code of the file template.inc.php. The manipulation of the argument path leads to cross site scripting. The at…
CVE-2025-7901MEDIUMCVSS 6.1EG 4.3
2025-07-20
A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been rated as problematic. This issue affects some unknown processing of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument con…
CVE-2025-7902MEDIUMCVSS 5.4EG 3.5
2025-07-20
A vulnerability classified as problematic has been found in yangzongzhuan RuoYi up to 4.8.1. Affected is the function addSave of the file com/ruoyi/web/controller/system/SysNoticeController.java. The manipulation leads to cross site script…
CVE-2025-7924MEDIUMCVSS 5.4EG 3.5
2025-07-21
A vulnerability classified as problematic was found in PHPGurukul Online Banquet Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument adminnam…
CVE-2025-7925MEDIUMCVSS 6.1EG 4.3
2025-07-21
A vulnerability, which was classified as problematic, has been found in PHPGurukul Online Banquet Booking System 1.0. Affected by this issue is some unknown functionality of the file /admin/login.php. The manipulation of the argument user_…
CVE-2025-7926MEDIUMCVSS 5.4EG 3.5
2025-07-21
A vulnerability, which was classified as problematic, was found in PHPGurukul Online Banquet Booking System 1.0. This affects an unknown part of the file /admin/booking-search.php. The manipulation of the argument searchdata leads to cross…
CVE-2025-7941MEDIUMCVSS 5.4EG 3.5
2025-07-21
A vulnerability, which was classified as problematic, was found in PHPGurukul Time Table Generator System 1.0. Affected is an unknown function of the file /admin/profile.php. The manipulation of the argument adminname leads to cross site s…
CVE-2025-7942MEDIUMCVSS 5.4EG 3.5
2025-07-21
A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument …
CVE-2025-7943MEDIUMCVSS 6.1EG 4.3
2025-07-21
A vulnerability was found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/search-autoortaxi.php. The manipulation of the argument searchd…
CVE-2025-7944MEDIUMCVSS 6.1EG 4.3
2025-07-21
A vulnerability was found in PHPGurukul Taxi Stand Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /search.php. The manipulation of the argument searchdata leads to cross site scriptin…
CVE-2025-7946MEDIUMCVSS 6.1EG 4.3
2025-07-22
A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /search-visitor.php of the component HTTP POST Request Handler. The …
CVE-2025-7951MEDIUMCVSS 5.4EG 3.5
2025-07-22
A vulnerability classified as problematic has been found in code-projects Public Chat Room 1.0. This affects an unknown part of the file /send_message.php. The manipulation of the argument chat_msg/your_name leads to cross site scripting. …
CVE-2025-7958HIGHCVSS 7.1EG 7.1
2026-06-26
A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web interface and Alert artifact details.
CVE-2025-7961MEDIUMCVSS 6.9EG 6.9
2025-08-15
Improper Control of Generation of Code ('Code Injection') vulnerability in Wulkano KAP on MacOS allows TCC Bypass.This issue affects KAP: 3.6.0.
CVE-2025-8030HIGHCVSS 8.1EG 8.1
2025-07-22
Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderb…
CVE-2025-8105HIGHCVSS 7.3EG 7.3
2025-08-16
The The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.6.7. This is due to the software allowing users to execute an action that does not properly validate a value before …
CVE-2025-8115MEDIUMCVSS 5.4EG 3.5
2025-07-24
A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/new-autoortaxi-entry-form.php. The manipulation of t…
CVE-2025-8155MEDIUMCVSS 5.4EG 3.5
2025-07-25
A vulnerability has been found in D-Link DCS-6010L 1.15.03 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /vb.htm of the component Management Application. The manipulation of the argum…
CVE-2025-8167MEDIUMCVSS 5.4EG 3.5
2025-07-25
A vulnerability was found in code-projects Church Donation System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/edit_members.php. The manipulation of the argument fn…
CVE-2025-8191MEDIUMCVSS 5.4EG 3.5
2025-07-26
A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl lead…
CVE-2025-8206MEDIUMCVSS 4.7EG 3.1
2025-07-26
A vulnerability, which was classified as problematic, was found in Comodo Dragon up to 134.0.6998.179. This affects an unknown part of the component IP DNS Leakage Detector. The manipulation leads to cross site scripting. It is possible to…
CVE-2025-8211MEDIUMCVSS 6.1EG 3.5
2025-07-26
A vulnerability was found in Roothub up to 2.6. It has been declared as problematic. Affected by this vulnerability is the function Edit of the file src/main/java/cn/roothub/web/admin/SystemConfigAdminController.java. The manipulation lead…
CVE-2025-8221MEDIUMCVSS 6.1EG 4.3
2025-07-27
A vulnerability classified as problematic was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this vulnerability is the function goodsSearch of the file GoodsCustController…
CVE-2025-8222MEDIUMCVSS 5.4EG 3.5
2025-07-27
A vulnerability, which was classified as problematic, has been found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this issue is some unknown functionality of the file GoodsCon…
CVE-2025-8337MEDIUMCVSS 5.4EG 2.4
2025-07-30
A vulnerability, which was classified as problematic, has been found in code-projects Simple Car Rental System 1.0. This issue affects some unknown processing of the file /admin/add_vehicles.php. The manipulation of the argument car_name l…
CVE-2025-8340MEDIUMCVSS 6.1EG 4.3
2025-07-31
A vulnerability was found in code-projects Intern Membership Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file fill_details.php of the component Error Message Handler. The manip…
CVE-2025-8346MEDIUMCVSS 6.1EG 4.3
2025-07-31
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the file /educar_aluno_lst.php. The manipulation of the argument ref_cod_matricula wi…
CVE-2025-8356CRITICALCVSS 9.8EG 9.8
2025-08-08
In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the s…
CVE-2025-8365MEDIUMCVSS 6.1EG 3.5
2025-07-31
A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file atendidos_cad.php. The manipulation of the argument nome/nome_social/email l…
CVE-2025-8366MEDIUMCVSS 6.1EG 4.3
2025-07-31
A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educar_servidor_lst.php. The manipulation of the argument nome/matricula_ser…
CVE-2025-8367MEDIUMCVSS 6.1EG 4.3
2025-07-31
A vulnerability classified as problematic has been found in Portabilis i-Educar 2.9. This affects an unknown part of the file /intranet/funcionario_vinculo_lst.php. The manipulation of the argument nome leads to cross site scripting. It is…
CVE-2025-8368MEDIUMCVSS 6.1EG 4.3
2025-07-31
A vulnerability classified as problematic was found in Portabilis i-Educar 2.9. This vulnerability affects unknown code of the file /intranet/pesquisa_pessoa_lst.php. The manipulation of the argument campo_busca/cpf leads to cross site scr…
CVE-2025-8369MEDIUMCVSS 6.1EG 4.3
2025-07-31
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9. This issue affects some unknown processing of the file /intranet/educar_avaliacao_desempenho_lst.php. The manipulation of the argument titulo_…
CVE-2025-8370MEDIUMCVSS 6.1EG 4.3
2025-07-31
A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9. Affected is an unknown function of the file /intranet/educar_escolaridade_lst.php. The manipulation of the argument descricao leads to cross site s…
CVE-2025-8380MEDIUMCVSS 5.4EG 3.5
2025-07-31
A vulnerability classified as problematic was found in Campcodes Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /admin/add_query_account.php. The manipulation of the argument Name leads to cross si…
CVE-2025-8417HIGHCVSS 8.1EG 8.1
2025-09-11
The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token (e.g. ?key= 900001705) without proper authen…
CVE-2025-8483MEDIUMCVSS 6.3EG 6.3
2025-10-25
The The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.5.5. This is due to the software allowing users to execute an action that does …
CVE-2025-8501MEDIUMCVSS 5.4EG 3.5
2025-08-03
A vulnerability classified as problematic has been found in code-projects Human Resource Integrated System 1.0. Affected is an unknown function of the file /insert-and-view/action.php. The manipulation of the argument content leads to cros…
CVE-2025-8506LOWCVSS 3.5EG 3.5
2025-08-03
A vulnerability was found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic. This issue affects some unknown processing of the file /user/editUI. The manipulation leads to cross site scriptin…
CVE-2025-8507MEDIUMCVSS 5.4EG 3.5
2025-08-03
A vulnerability was found in Portabilis i-Educar 2.9. It has been classified as problematic. Affected is an unknown function of the file /intranet/educar_funcao_lst.php. The manipulation of the argument nm_funcao/abreviatura leads to cross…
CVE-2025-8508MEDIUMCVSS 5.4EG 3.5
2025-08-03
A vulnerability was found in Portabilis i-Educar 2.9. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_avaliacao_desempenho_cad.php. The manipulation of the argume…
CVE-2025-8509MEDIUMCVSS 5.4EG 3.5
2025-08-03
A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educar_servidor_cad.php. The manipulation of the argument matricula leads to…

Map vulnerabilities like CWE-94 to your infrastructure

EchelonGraph correlates every CVE — across CWE-94 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →