CWE-94— Improper Control of Generation of Code (Code Injection)

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.— MITRE CWE catalog

6,502 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-94page 113 of 131

CVE-2025-8510MEDIUMCVSS 5.4EG 3.5
2025-08-03
A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matricula_lst.php. The manipulation of the argument ref_cod_aluno leads to cross site…
CVE-2025-8511MEDIUMCVSS 5.4EG 3.5
2025-08-03
A vulnerability classified as problematic was found in Portabilis i-Diario 1.5.0. This vulnerability affects unknown code of the file /diario-de-observacoes/ of the component Observações. The manipulation of the argument Descrição lead…
CVE-2025-8518HIGHCVSS 7.2EG 4.7
2025-08-04
A vulnerability was found in givanz Vvveb 1.0.5. It has been rated as critical. Affected by this issue is the function Save of the file admin/controller/editor/code.php of the component Code Editor. The manipulation leads to code injection…
CVE-2025-8521MEDIUMCVSS 5.4EG 2.4
2025-08-04
A vulnerability, which was classified as problematic, has been found in givanz Vvveb up to 1.0.5. This issue affects some unknown processing of the file /vadmin123/index.php?module=settings/post-types of the component Add Type Handler. The…
CVE-2025-8535CRITICALCVSS 9.0EG 3.5
2025-08-05
A vulnerability, which was classified as problematic, has been found in cronoh NanoVault up to 1.2.1. This issue affects the function executeJavaScript of the file /main.js of the component xrb URL Handler. The manipulation leads to cross …
CVE-2025-8538MEDIUMCVSS 4.8EG 2.4
2025-08-05
A vulnerability has been found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /usuarios/tipos/novo. The manipulation of the argument name/description leads …
CVE-2025-8539MEDIUMCVSS 4.8EG 2.4
2025-08-05
A vulnerability was found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this issue is some unknown functionality of the file /intranet/public_distrito_cad.php. The manipulation of the argument nome leads to cross s…
CVE-2025-8540MEDIUMCVSS 4.8EG 2.4
2025-08-05
A vulnerability was found in Portabilis i-Educar 2.10. It has been classified as problematic. This affects an unknown part of the file /intranet/public_municipio_cad.php. The manipulation of the argument nome leads to cross site scripting.…
CVE-2025-8541MEDIUMCVSS 4.8EG 2.4
2025-08-05
A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /intranet/public_uf_cad.php. The manipulation of the argument nome leads to cross site scriptin…
CVE-2025-8542MEDIUMCVSS 4.8EG 2.4
2025-08-05
A vulnerability was found in Portabilis i-Educar 2.10. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/empresas_cad.php. The manipulation of the argument fantasia/razao_social leads to cro…
CVE-2025-8543MEDIUMCVSS 4.8EG 2.4
2025-08-05
A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. Affected is an unknown function of the file /intranet/educar_raca_cad.php. The manipulation of the argument nm_raca leads to cross site scripting. It is …
CVE-2025-8544MEDIUMCVSS 4.8EG 2.4
2025-08-05
A vulnerability classified as problematic was found in Portabilis i-Educar 2.10. Affected by this vulnerability is an unknown functionality of the file /module/RegraAvaliacao/edit. The manipulation of the argument nome leads to cross site …
CVE-2025-8545MEDIUMCVSS 4.8EG 2.4
2025-08-05
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the file /intranet/educar_motivo_afastamento_cad.php. The manipulation of the argumen…
CVE-2025-8550MEDIUMCVSS 5.4EG 2.4
2025-08-05
A vulnerability was found in atjiu pybbs up to 6.0.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/topic/list. The manipulation of the argument Username leads to cross s…
CVE-2025-8551MEDIUMCVSS 5.4EG 3.5
2025-08-05
A vulnerability was found in atjiu pybbs up to 6.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/comment/list. The manipulation of the argument Username leads to cross site scr…
CVE-2025-8552MEDIUMCVSS 5.4EG 2.4
2025-08-05
A vulnerability classified as problematic has been found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /admin/tag/list. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate …
CVE-2025-8553MEDIUMCVSS 5.4EG 2.4
2025-08-05
A vulnerability classified as problematic was found in atjiu pybbs up to 6.0.0. This vulnerability affects unknown code of the file /admin/sensitive_word/list. The manipulation of the argument word leads to cross site scripting. The attack…
CVE-2025-8554MEDIUMCVSS 5.4EG 2.4
2025-08-05
A vulnerability, which was classified as problematic, has been found in atjiu pybbs up to 6.0.0. This issue affects some unknown processing of the file /admin/user/list. The manipulation of the argument Username leads to cross site scripti…
CVE-2025-8555MEDIUMCVSS 5.4EG 3.5
2025-08-05
A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. Affected is an unknown function of the file /search. The manipulation of the argument keyword leads to cross site scripting. It is possible to laun…
CVE-2025-8723CRITICALCVSS 9.8EG 9.8
2025-08-19
The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispatch() method in all versions up to, and including, 1.5.6. T…
CVE-2025-8740MEDIUMCVSS 5.4EG 2.4
2025-08-08
A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0. It has been classified as problematic. Affected is an unknown function of the file /admin/categories/save of the component Category Handler. The manipulation of the argument cate…
CVE-2025-8743MEDIUMCVSS 5.4EG 3.5
2025-08-08
A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. This affects an unknown part of the file /data_source_edit.shtm of the component Virtual Data Source Property Handler. The manipulation of the argument Na…
CVE-2025-8750MEDIUMCVSS 5.4EG 2.4
2025-08-09
A vulnerability has been found in macrozheng mall up to 1.0.3 and classified as problematic. Affected by this vulnerability is the function Upload of the file /minio/upload of the component Add Product Page. The manipulation of the argumen…
CVE-2025-8751MEDIUMCVSS 6.1EG 3.1
2025-08-09
A vulnerability was found in Protected Total WebShield Extension up to 3.2.0 on Chrome. It has been classified as problematic. This affects an unknown part of the component Block Page. The manipulation of the argument Category leads to cro…
CVE-2025-8765LOWCVSS 3.5EG 3.5
2025-08-09
A vulnerability classified as problematic was found in Datacom DM955 5GT 1200 825.8010.00. Affected by this vulnerability is an unknown functionality of the component Wireless Basic Settings. The manipulation of the argument SSID leads to …
CVE-2025-8784MEDIUMCVSS 5.4EG 3.5
2025-08-09
A vulnerability classified as problematic was found in Portabilis i-Educar up to 2.9. This vulnerability affects unknown code of the file /intranet/funcionario_vinculo_cad.php of the component Cadastrar Vínculo Page. The manipulation of t…
CVE-2025-8785MEDIUMCVSS 5.4EG 3.5
2025-08-10
A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9. This issue affects some unknown processing of the file /intranet/educar_usuario_lst.php. The manipulation of the argument nm_pessoa/matr…
CVE-2025-8786MEDIUMCVSS 5.4EG 3.5
2025-08-10
A vulnerability, which was classified as problematic, was found in Portabilis i-Diario up to 1.5.0. Affected is an unknown function of the file /registros-de-conteudos-por-areas-de-conhecimento/ of the component Registro das atividades. Th…
CVE-2025-8787MEDIUMCVSS 5.4EG 3.5
2025-08-10
A vulnerability has been found in Portabilis i-Diario up to 1.5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /registros-de-conteudos-por-disciplina/ of the component Registro das a…
CVE-2025-8788MEDIUMCVSS 5.4EG 3.5
2025-08-10
A vulnerability was found in Portabilis i-Diario up to 1.5.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /planos-de-aula-por-areas-de-conhecimento/ of the component Informações adiciona…
CVE-2025-8812MEDIUMCVSS 5.4EG 2.4
2025-08-10
A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /api/settings of the component Admin Panel. The manipulation leads to cross site scripting. It is possible…
CVE-2025-8834LOWCVSS 2.4EG 2.4
2025-08-11
A vulnerability has been found in JCG Link-net LW-N915R 17s.20.001.908. Affected is an unknown function of the file /wireless/basic.asp of the component Wireless Basic Settings Page. The manipulation of the argument Network Name leads to c…
CVE-2025-8847MEDIUMCVSS 5.4EG 3.5
2025-08-11
A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is the function Edit of the file /system/notice/edit. The manipulation of the argument noticeTitle/noticeContent leads to cross site scripting. Th…
CVE-2025-8848MEDIUMCVSS 5.4EG 4.8
2025-10-22
A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the…
CVE-2025-8878MEDIUMCVSS 6.5EG 6.5
2025-08-16
The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.…
CVE-2025-8905MEDIUMCVSS 6.3EG 6.3
2025-08-15
The Inpersttion For Theme plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the theme_section_shortcode() function. This is due to the plugin not restricting what functions can be cal…
CVE-2025-8918MEDIUMCVSS 4.8EG 2.4
2025-08-13
A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_instituicao_cad.php of the component Editar Page. The manipulation of the argument neighborhood name leads…
CVE-2025-8919MEDIUMCVSS 4.8EG 2.4
2025-08-13
A vulnerability was determined in Portabilis i-Diario up to 1.6. Affected is an unknown function of the file /objetivos-de-aprendizagem-e-habilidades of the component History Page. The manipulation of the argument código/objetivo habilida…
CVE-2025-8920MEDIUMCVSS 5.4EG 2.4
2025-08-13
A vulnerability was identified in Portabilis i-Diario 1.6. Affected by this vulnerability is an unknown functionality of the file /dicionario-de-termos-bncc of the component Dicionário de Termos BNCC Page. The manipulation of the argument…
CVE-2025-8933MEDIUMCVSS 6.1EG 4.3
2025-08-14
A vulnerability was identified in 1000 Projects Sales Management System 1.0. This issue affects some unknown processing of the file /superstore/admin/sales.php. The manipulation of the argument ssalescat leads to cross site scripting. The …
CVE-2025-8934MEDIUMCVSS 6.1EG 4.3
2025-08-14
A vulnerability has been found in 1000 Projects Sales Management System 1.0. Affected is an unknown function of the file /sales.php. The manipulation of the argument select2112 leads to cross site scripting. It is possible to launch the at…
CVE-2025-8975MEDIUMCVSS 5.4EG 3.5
2025-08-14
A vulnerability was identified in givanz Vvveb up to 1.0.5. This affects an unknown part of the file admin/template/content/edit.tpl. The manipulation of the argument slug leads to cross site scripting. It is possible to initiate the attac…
CVE-2025-8976MEDIUMCVSS 5.4EG 3.5
2025-08-14
A vulnerability has been found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/index.php?module=content/post&type=post of the component Endpoint. The manipulation leads to cross site scripting. T…
CVE-2025-9003MEDIUMCVSS 5.4EG 3.5
2025-08-15
A vulnerability has been found in D-Link DIR-818LW 1.04. This vulnerability affects unknown code of the file /bsc_lan.php of the component DHCP Reserved Address Handler. The manipulation of the argument Name leads to cross site scripting. …
CVE-2025-9017MEDIUMCVSS 6.1EG 4.3
2025-08-15
A vulnerability has been found in PHPGurukul Zoo Management System 2.1. This vulnerability affects unknown code of the file /admin/add-foreigner-ticket.php. The manipulation of the argument visitorname leads to cross site scripting. The at…
CVE-2025-9095LOWCVSS 3.5EG 3.5
2025-08-17
A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of the component REST Endpoint. The manipulation leads to cross site scripting. The a…
CVE-2025-9096LOWCVSS 3.5EG 3.5
2025-08-18
A vulnerability has been found in ExpressGateway express-gateway up to 1.16.10. Affected is an unknown function in the library lib/rest/routes/apps.js of the component REST Endpoint. The manipulation leads to cross site scripting. It is po…
CVE-2025-9101MEDIUMCVSS 5.4EG 3.5
2025-08-18
A weakness has been identified in zhenfeng13 My-Blog up to 1.0.0. This issue affects some unknown processing of the file /admin/tags/save of the component Tag Handler. The manipulation leads to cross site scripting. The attack may be initi…
CVE-2025-9103LOWCVSS 2.4EG 2.4
2025-08-18
A vulnerability was detected in ZenCart 2.1.0. Affected by this vulnerability is an unknown functionality of the component CKEditor. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been …
CVE-2025-9104MEDIUMCVSS 5.4EG 3.5
2025-08-18
A flaw has been found in Portabilis i-Diario up to 1.5.0. The affected element is an unknown function of the file /planos-de-aulas-por-disciplina/ of the component Informações Adicionais Page. This manipulation of the argument Parecer/Ob…

Map vulnerabilities like CWE-94 to your infrastructure

EchelonGraph correlates every CVE — across CWE-94 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →