CWE-94

Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injectio

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticke

md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5,

A remote code execution issue exists in HPE OneView.

ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code executio

Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to exe

Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid paramete

WeGIA is a web manager for charitable institutions. Prior to 3.2.8, a critical vulnerability was identified in the /WeGI

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulne

Improper Control of Generation of Code ('Code Injection') vulnerability in wpspin Post/Page Copying Tool postpage-import

ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to exec

Improper Control of Generation of Code ('Code Injection') vulnerability in Govind Visual Text Editor visual-text-editor

Improper Control of Generation of Code ('Code Injection') vulnerability in Rometheme RTMKit rometheme-for-elementor allo

Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability

SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. T

SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function mo

In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before being used

Improper Control of Generation of Code ('Code Injection') vulnerability in termel PDF 2 Post pdf2post allows Remote Code

Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the t

WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across th

Improper Control of Generation of Code ('Code Injection') vulnerability in metalpriceapi MetalpriceAPI metalpriceapi all

SAP S/4HANA and SAP SCM Characteristic Propagation has remote code execution vulnerability. This allows an attacker with

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) int

SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function mo

SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. T

Improper Control of Generation of Code ('Code Injection') vulnerability in WPFactory Product XML Feed Manager for WooCom

Improper Control of Generation of Code ('Code Injection') vulnerability in Jordy Meow Code Engine code-engine allows Rem

WeGIA is a Web manager for charitable institutions. Prior to version 3.4.11, a remote code execution vulnerability was i

WeGIA is a Web manager for charitable institutions. The fix for CVE-2025-22133 was not enough to remediate the arbitrary

SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available servic

Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection m

Grafana Image Renderer is vulnerable to remote code execution due to an arbitrary file write vulnerability. This is due

Improper Control of Generation of Code ('Code Injection') vulnerability in Widgetlogic.org Widget Logic widget-logic all

Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when cal

Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when cal

An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows att

Improper Control of Generation of Code ('Code Injection') vulnerability in Mohammad I. Okfie IF AS Shortcode if-as-short

Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zb_users\theme\shell\template.

The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remo

Server-Side Template Injection (SSTI) was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code vi

File Upload Bypass was found in AdPortal 3.0.39 allows a remote attacker to execute arbitrary code via the file upload f

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrar

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includi

PHPYun before 7.0.2 is vulnerable to code execution through backdoor-restricted arbitrary file writing and file inclusio

An issue was discovered in Opsview Monitor Agent 6.8. An unauthenticated remote attacker can call check_nrpe against aff

An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account witho

RE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter at /goform/mp.

RE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName parameter at /goform/setWAN

The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Ex

A type confusion in the nas_message_decode function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa