CWE-94— Improper Control of Generation of Code (Code Injection)

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.— MITRE CWE catalog

7,126 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-94page 75 of 143

CVE-2024-10952HIGHCVSS 7.3EG 7.3
2024-12-04
The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution via update_authors_list_ajax AJAX action in all versions up to, and including, 2.0.4. This is due to the software allowing users to execute an action …
CVE-2024-10954HIGHCVSS 8.8EG 8.8
2025-03-20
In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The root cause is the execution of untrusted code generated by the LLM without a prope…
CVE-2024-10958HIGHCVSS 7.3EG 7.3
2024-11-10
The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, 8.8.08.007 . This is due to the software allowing users to…
CVE-2024-10959HIGHCVSS 7.3EG 7.3
2024-12-10
The The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to arbitrary shortcode execution via woot_get_smth AJAX action in all versions up to, and including, 1.0.6.5. This is due t…
CVE-2024-10970MEDIUMCVSS 5.4EG 5.4
2025-01-16
The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.43. This is due to the software allowing users to execute an action that doe…
CVE-2024-11002MEDIUMCVSS 6.3EG 6.3
2024-11-26
The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_shortcode_template AJAX action in all versions up to, and including, 2.1.4.2. This is due to the software allowing users …
CVE-2024-11012MEDIUMCVSS 6.3EG 6.3
2024-12-13
The The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via njt_nofi_text AJAX action in all versions up to, and including, 2.1.4. This is due to the software allowing users to…
CVE-2024-11034HIGHCVSS 7.3EG 7.3
2024-11-23
The The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation plugin for WordPress is vulnerable to arbitrary shortcode execution via fire_contact_form AJAX action in all …
CVE-2024-11036HIGHCVSS 7.3EG 7.3
2024-11-19
The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_get_user_earnings AJAX action in all versions up…
CVE-2024-11038HIGHCVSS 7.3EG 7.3
2024-11-19
The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to arbitrary shortcode execution via wpb_pcf_fire_contact_form AJAX action in all versions up to, an…
CVE-2024-11050LOWCVSS 3.5EG 3.5
2024-11-10
A vulnerability was found in AMTT Hotel Broadband Operation System up to 3.0.3.151204 and classified as problematic. This issue affects some unknown processing of the file /language.php. The manipulation of the argument LangID/LangName/Lan…
CVE-2024-11070LOWCVSS 3.5EG 3.5
2024-11-11
A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /admin/cmsTagType/save of the component Tag Type Handler. The manipulation of the …
CVE-2024-11078LOWCVSS 3.5EG 3.5
2024-11-11
A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /register.php. The manipulation of the argument e/role leads to cross…
CVE-2024-11102LOWCVSS 3.5EG 3.5
2024-11-12
A vulnerability was found in SourceCodester Hospital Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /vm/doctor/edit-doc.php. The manipulation of the argument name l…
CVE-2024-11130LOWCVSS 2.4EG 2.4
2024-11-12
A vulnerability was found in ZZCMS up to 2023. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/msg.php. The manipulation of the argument keyword leads to cross site scripting. The a…
CVE-2024-1117HIGHCVSS 7.3EG 7.3
2024-01-31
A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of the file /application/index/controller/Screen.php. The manipulation of the argument fileurl leads to…
CVE-2024-11175LOWCVSS 3.5EG 3.5
2024-11-13
A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of the component Voting Management. The manipulation leads to cross site scripting…
CVE-2024-11240LOWCVSS 3.5EG 3.5
2024-11-15
A vulnerability was found in IBPhoenix ibWebAdmin up to 1.0.2 and classified as problematic. This issue affects some unknown processing of the file /database.php of the component Banco de Dados Tab. The manipulation of the argument db_logi…
CVE-2024-11243MEDIUMCVSS 4.3EG 4.3
2024-11-15
A vulnerability classified as problematic has been found in code-projects Online Shop Store 1.0. This affects an unknown part of the file /signup.php. The manipulation of the argument m2 with the input <svg%20onload=alert(document.cookie)>…
CVE-2024-11246LOWCVSS 3.5EG 3.5
2024-11-15
A vulnerability, which was classified as problematic, was found in code-projects Farmacia 1.0. Affected is an unknown function of the file /adicionar-cliente.php. The manipulation of the argument nome/cpf/dataNascimento leads to cross site…
CVE-2024-11247LOWCVSS 3.5EG 3.5
2024-11-15
A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=save_product of the component Invento…
CVE-2024-11259LOWCVSS 3.5EG 3.5
2024-11-15
A vulnerability, which was classified as problematic, has been found in code-projects Farmacia 1.0. This issue affects some unknown processing of the file /fornecedores.php. The manipulation leads to cross site scripting. The attack may be…
CVE-2024-11488LOWCVSS 3.5EG 3.5
2024-11-20
A vulnerability was found in 115cms up to 20240807 and classified as problematic. This issue affects some unknown processing of the file /app/admin/view/web_user.html. The manipulation of the argument ks leads to cross site scripting. The …
CVE-2024-11489LOWCVSS 3.5EG 3.5
2024-11-20
A vulnerability was found in 115cms up to 20240807. It has been classified as problematic. Affected is an unknown function of the file /index.php/admin/web/file.html. The manipulation of the argument ks leads to cross site scripting. It is…
CVE-2024-11490LOWCVSS 3.5EG 3.5
2024-11-20
A vulnerability was found in 115cms up to 20240807. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php/admin/web/set.html. The manipulation of the argument type leads to c…
CVE-2024-11491LOWCVSS 3.5EG 3.5
2024-11-20
A vulnerability was found in 115cms up to 20240807. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php/admin/web/useradmin.html. The manipulation of the argument ks leads to cross …
CVE-2024-11492LOWCVSS 3.5EG 3.5
2024-11-20
A vulnerability classified as problematic has been found in 115cms up to 20240807. This affects an unknown part of the file /index.php/admin/web/appurladd.html. The manipulation of the argument tid leads to cross site scripting. It is poss…
CVE-2024-11493LOWCVSS 3.5EG 3.5
2024-11-20
A vulnerability classified as problematic was found in 115cms up to 20240807. This vulnerability affects unknown code of the file /index.php/setpage/admin/pageAE.html. The manipulation of the argument tid leads to cross site scripting. The…
CVE-2024-11587MEDIUMCVSS 3.5EG 6.1
2024-11-21
A vulnerability was found in idcCMS 1.60. It has been classified as problematic. This affects the function GetCityOptionJs of the file /inc/classProvCity.php. The manipulation of the argument idName leads to cross site scripting. It is pos…
CVE-2024-11600HIGHCVSS 7.2EG 7.2
2025-01-30
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.6.0 via the 'write_config' function. This is due to a…
CVE-2024-11613CRITICALCVSS 9.8EG 9.8
2025-01-08
The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfu_file_downloader.php' file. This is due to la…
CVE-2024-11620HIGHCVSS 7.2EG 7.2
2024-11-28
Improper Control of Generation of Code ('Code Injection') vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Code Injection.This issue affects Rank Math SEO: from n/a through <= 1.0.231.
CVE-2024-11635CRITICALCVSS 9.8EG 9.8
2025-01-08
The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfu_ABSPATH' cookie parameter. This makes it possible for unauthenticated attackers to execute cod…
CVE-2024-11660LOWCVSS 3.5EG 3.5
2024-11-25
A vulnerability was found in code-projects Farmacia 1.0. It has been classified as problematic. This affects an unknown part of the file usuario.php. The manipulation of the argument name leads to cross site scripting. It is possible to in…
CVE-2024-11675LOWCVSS 3.5EG 3.5
2024-11-26
A vulnerability has been found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /backend/admin/his_admin_register_patient.php of the component…
CVE-2024-11676LOWCVSS 3.5EG 3.5
2024-11-26
A vulnerability was found in CodeAstro Hospital Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /backend/admin/his_admin_add_lab_equipment.php of the component Add Labor…
CVE-2024-11677LOWCVSS 3.5EG 3.5
2024-11-26
A vulnerability was found in CodeAstro Hospital Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /backend/admin/his_admin_add_vendor.php of the component Add Vendor Details Page. The ma…
CVE-2024-11678LOWCVSS 3.5EG 3.5
2024-11-26
A vulnerability was found in CodeAstro Hospital Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /backend/doc/his_doc_register_patient.php. The manipulation of the argument pat…
CVE-2024-11697HIGHCVSS 8.8EG 8.8
2024-11-26
When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have led to malicious code execution. This vulnerability affects Firefox < 133, Firefo…
CVE-2024-11699HIGHCVSS 8.8EG 8.8
2024-11-26
Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…
CVE-2024-11733HIGHCVSS 7.3EG 7.3
2025-01-03
The The WordPress Popular Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.1.0. This is due to the software allowing users to execute an action that does not properly validat…
CVE-2024-11740HIGHCVSS 7.3EG 7.3
2024-12-19
The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a va…
CVE-2024-11742LOWCVSS 3.5EG 3.5
2024-11-26
A vulnerability, which was classified as problematic, has been found in SourceCodester Best House Rental Management System 1.0. This issue affects some unknown processing of the file /rental/ajax.php?action=save_tenant. The manipulation of…
CVE-2024-11820LOWCVSS 3.5EG 3.5
2024-11-27
A vulnerability, which was classified as problematic, has been found in code-projects Crud Operation System 1.0. This issue affects some unknown processing of the file /add.php. The manipulation of the argument saddress leads to cross site…
CVE-2024-11971LOWCVSS 3.5EG 3.5
2024-11-28
A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of the file /commons/attachment/upload of the component Avatar Handler. The manipulat…
CVE-2024-11976HIGHCVSS 7.3EG 7.3
2026-01-23
The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is due to the software allowing users to execute an action that does not properly validate a value be…
CVE-2024-11977HIGHCVSS 7.3EG 7.3
2024-12-21
The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10. This is due to the software allowing users to execute an actio…
CVE-2024-11995LOWCVSS 3.5EG 3.5
2024-11-29
A vulnerability has been found in code-projects Farmacia 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /pagamento.php. The manipulation of the argument total leads to cross site s…
CVE-2024-11996LOWCVSS 3.5EG 3.5
2024-11-30
A vulnerability was found in code-projects Farmacia 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /editar-fornecedor.php. The manipulation of the argument cidade leads to cross site scr…
CVE-2024-11997LOWCVSS 3.5EG 3.5
2024-11-30
A vulnerability was found in code-projects Farmacia 1.0. It has been classified as problematic. This affects an unknown part of the file /vendas.php. The manipulation of the argument notaFiscal leads to cross site scripting. It is possible…

Map vulnerabilities like CWE-94 to your infrastructure

EchelonGraph correlates every CVE — across CWE-94 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →