Sign in Sign up
JA · EN · FR
SecPulse

Cwe 94

🧬 CWE Related 1,871
slug: cwe-94

Explanation

CWE-94は「攻撃者が送ったデータが、プログラムコードとして解釈・実行されてしまう」欠陥です。 Pythonの `eval()`・PHPの `eval()`/`include()` にユーザー入力を渡すような実装が典型例です。 リモートコード実行 (RCE) の直接的な原因となるため、最も重大なクラスの脆弱性です。
📌 Example
Log4Shell (CVE-2021-44228) はLog4jのJNDI Lookupを悪用したコードインジェクションで、世界中のJavaサーバーが数日でハッキングされた。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 1,877

Image ID Title
CVE-2026-47852 Vulnerability in Vmware Onnx (CVE-2026-47852)
CVE-2026-75411 Code Injection in JeecgBoot (CVE-2026-75411)
CVE-2026-75414 In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering...
CVE-2026-52103 Code Injection in SimpleX Chat (CVE-2026-52103)
CVE-2026-58474 Code Injection in whichllm (CVE-2026-58474)
CVE-2026-74851 Code Injection in Pods (WordPress plugin) (CVE-2026-74851)
CVE-2026-80201 Code Injection in Kimai (CVE-2026-80201)
CVE-2026-76148 Code Injection in CorvusSKK (CVE-2026-76148)
CVE-2026-57170 Code Injection in compliance-trestle (CVE-2026-57170)
CVE-2026-54757 Code Injection in compliance-trestle (CVE-2026-54757)
CVE-2026-79793 Cross-Site Scripting (XSS) in code-projects Online Shopping System (CVE-2026-79793)
CVE-2026-79249 Code Injection in Google Chrome (CVE-2026-79249)
CVE-2026-65082 Code Injection in NVIDIA NemoClaw for Linux (CVE-2026-65082)
CVE-2026-55585 Code Injection in qwed (CVE-2026-55585)
CVE-2026-55546 Code Injection in qwed-mcp (CVE-2026-55546)
CVE-2026-57909 Code Injection in WatchGuard Agent (CVE-2026-57909)
CVE-2026-49845 Code Injection in Apache (CVE-2026-49845)
CVE-2026-78654 Code Injection in cleverbrush framework and deep (CVE-2026-78654)
CVE-2026-56703 Code Injection in Adminer (CVE-2026-56703)
CVE-2026-60004 KEV [KEV] Code Injection in gitea.dev (CVE-2026-60004)
CVE-2026-52490 An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute...
CVE-2026-53710 Code Injection in mcp-contextforge-gateway (CVE-2026-53710)
CVE-2026-39975 Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the…
CVE-2026-40877 Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to PHP object injection in…
CVE-2025-26238 Code Injection in D-Link DI-8100G (CVE-2025-26238)
CVE-2026-76836 Code Injection in AzuraCast (CVE-2026-76836)
CVE-2026-78367 Code Injection in rpmbuild (CVE-2026-78367)
CVE-2026-76841 Xinference loads models with Hugging Face remote code execution unconditionally enabled, and...
CVE-2026-78187 Cross-Site Scripting (XSS) in Piwigo (CVE-2026-78187)
CVE-2026-78180 Code Injection in alibaba-fusion next (CVE-2026-78180)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details