Sign in Sign up
JA · EN · FR
SecPulse

Cwe 94

🧬 CWE Related 1,871
slug: cwe-94

Explanation

CWE-94は「攻撃者が送ったデータが、プログラムコードとして解釈・実行されてしまう」欠陥です。 Pythonの `eval()`・PHPの `eval()`/`include()` にユーザー入力を渡すような実装が典型例です。 リモートコード実行 (RCE) の直接的な原因となるため、最も重大なクラスの脆弱性です。
📌 Example
Log4Shell (CVE-2021-44228) はLog4jのJNDI Lookupを悪用したコードインジェクションで、世界中のJavaサーバーが数日でハッキングされた。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 1,872

Image ID Title
CVE-2025-66438 Code Injection in Frappe ERPNext (CVE-2025-66438)
CVE-2025-66434 Code Injection in Frappe ERPNext (CVE-2025-66434)
CVE-2025-66435 Code Injection in Frappe ERPNext (CVE-2025-66435)
CVE-2025-14691 Cross-Site Scripting (XSS) in mayan-edms (CVE-2025-14691)
CVE-2025-14662 Cross-Site Scripting (XSS) in code-projects Student File Management System (CVE-2025-14662)
CVE-2025-14663 Cross-Site Scripting (XSS) in code-projects Student File Management System (CVE-2025-14663)
CVE-2025-14539 Code Injection in Shortcode Ajax (WordPress plugin) (CVE-2025-14539)
CVE-2025-67750 Lightning Flow Scanner provides a A CLI plugin, VS Code Extension and GitHub Action for analysis and optimization of…
CVE-2025-14580 Cross-Site Scripting (XSS) in Qualitor (CVE-2025-14580)
CVE-2025-65854 Code Injection in Mineadmin (CVE-2025-65854)
CVE-2025-12843 Code Injection in Apple macOS (CVE-2025-12843)
CVE-2025-67727 Code Injection in Parseplatform (CVE-2025-67727)
CVE-2025-14166 Code Injection in WPMasterToolKit (WordPress plugin) (CVE-2025-14166)
CVE-2025-13780 Code Injection in pgadmin4 (CVE-2025-13780)
CVE-2025-14538 Cross-Site Scripting (XSS) in yangshare warehouseManager 仓库管理系统 (CVE-2025-14538)
CVE-2025-55313 Code Injection in Microsoft Windows (CVE-2025-55313)
CVE-2025-14519 Cross-Site Scripting (XSS) in baowzh hfly (CVE-2025-14519)
CVE-2025-67509 Code Injection in Neuron (CVE-2025-67509)
CVE-2025-66474 Vulnerability in XWiki Rendering (CVE-2025-66474)
CVE-2025-65294 Code Injection in Aqara Hub devices including Camera Hub G3 (CVE-2025-65294)
CVE-2024-58284 Code Injection in PopojiCMS (CVE-2024-58284)
CVE-2025-67489 @vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to…
CVE-2025-66457 Code Injection in Elysia (CVE-2025-66457)
CVE-2025-66533 Code Injection in GiveWP (CVE-2025-66533)
CVE-2025-42880 Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when…
CVE-2025-14324 Code Injection in Mozilla Firefox (CVE-2025-14324)
CVE-2025-13642 Code Injection in WordPress (CVE-2025-13642)
CVE-2025-66481 Cross-Site Scripting (XSS) in DeepChat (CVE-2025-66481)
CVE-2025-14244 Cross-Site Scripting (XSS) in GreenCMS (CVE-2025-14244)
CVE-2025-14228 Cross-Site Scripting (XSS) in Yealink SIP-T21P E2 (CVE-2025-14228)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details