Sign in Sign up
JA · EN · FR
SecPulse

Cwe 94

🧬 CWE Related 84
slug: cwe-94

Explanation

CWE-94は「攻撃者が送ったデータが、プログラムコードとして解釈・実行されてしまう」欠陥です。 Pythonの `eval()`・PHPの `eval()`/`include()` にユーザー入力を渡すような実装が典型例です。 リモートコード実行 (RCE) の直接的な原因となるため、最も重大なクラスの脆弱性です。
📌 Example
Log4Shell (CVE-2021-44228) はLog4jのJNDI Lookupを悪用したコードインジェクションで、世界中のJavaサーバーが数日でハッキングされた。
🔗 Related links

🔖 Related tags

Cwe 20125 Cwe 78120 Cwe 787105 Cwe 41699 Cwe 2296 Cwe 11990 Cwe 50270 Cwe 7966 Cwe 8954 Cwe 91844 Cwe 28443 Cwe 28741 Cwe 7740 Cwe 30638 Cwe 84337

🛡 Vulnerabilities tagged with this 660

ID Title
CVE-2026-25755 Code Injection in parall (CVE-2026-25755)
CVE-2025-14009 Code Injection in nltk (CVE-2025-14009)
CVE-2025-33239 Code Injection in nvidia (CVE-2025-33239)
CVE-2025-33240 Code Injection in nvidia (CVE-2025-33240)
CVE-2025-69872 Code Injection in CVE-2025-69872 (CVE-2025-69872)
CVE-2026-1615 Code Injection in CVE-2026-1615 (CVE-2026-1615)
CVE-2025-61732 Code Injection in toolchain (CVE-2025-61732)
CVE-2026-25153 Code Injection in linuxfoundation (CVE-2026-25153)
CVE-2025-24293 Command Injection in CVE-2025-24293 (CVE-2025-24293)
CVE-2026-1281 KEV [KEV] Code Injection in Ivanti endpoint-manager-mobile-epmm (CVE-2026-1281)
CVE-2025-57283 Code Injection in browserstack (CVE-2025-57283)
CVE-2026-24747 Code Injection in linuxfoundation (CVE-2026-24747)
CVE-2026-22807 Code Injection in vllm (CVE-2026-22807)
CVE-2026-20045 KEV [KEV] Code Injection in Cisco unified-communications-manager (CVE-2026-20045)
CVE-2026-22771 Code Injection in envoyproxy (CVE-2026-22771)
CVE-2025-69262 pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings....
CVE-2009-0556 KEV [KEV] Code Injection in Microsoft office (CVE-2009-0556)
CVE-2025-37164 KEV [KEV] Code Injection in Hewlett packard enterprise (hpe) hewlett-packard-enterprise-hpe (CVE-2025-37164)
CVE-2025-66848 Code Injection in jdcloud (CVE-2025-66848)
CVE-2023-53888 Code Injection in zomp (CVE-2023-53888)
CVE-2025-65854 Code Injection in mineadmin (CVE-2025-65854)
CVE-2025-56399 Code Injection in laravel (CVE-2025-56399)
CVE-2025-6204 KEV [KEV] Code Injection in Dassault systèmes dassault-systemes (CVE-2025-6204)
CVE-2025-57567 Code Injection in CVE-2025-57567 (CVE-2025-57567)
CVE-2025-56588 Code Injection in dolibarr (CVE-2025-56588)
CVE-2025-50567 SQL Injection in CVE-2025-50567 (CVE-2025-50567)
CVE-2012-10032 Cross-Site Scripting (XSS) in CVE-2012-10032 (CVE-2012-10032)
CVE-2025-4056 Code Injection in dos (CVE-2025-4056)
CVE-2025-49704 KEV [KEV] Code Injection in Microsoft sharepoint (CVE-2025-49704)
CVE-2025-53867 Island Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL.

🍪 About cookies

We use cookies to keep you logged in, remember your language, and improve the service.

Details →