CWE-94 · Command and Code Injection
Code Injection
5,818CVEs
71exploited
115with a public check
712likely (EPSS 10%+)
SortMost likely exploited
5,818 CVEs with CWE-94 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2017-9841In CISA KEVExploitedPHPUnit - Remote Code ExecutionPHPUnit · PHPUnit · CVSS 9.8 · 2017-06-27 | 9.8 | 100% | 2017-06-27 |
| CVE-2015-1635In CISA KEVExploitedMicrosoft Windows 'HTTP.sys' - Remote Code ExecutionMicrosoft · HTTP.sys · CVSS 9.8 · 2015-04-14 | 9.8 | 100% | 2015-04-14 |
| CVE-2022-22954In CISA KEVExploitedVMware Workspace ONE Access - Server-Side Template InjectionVMware · VMware Workspace ONE Access and Identity Manager · CVSS 9.8 · 2022-04-11 | 9.8 | 100% | 2022-04-11 |
| CVE-2025-49704In CISA KEVExploitedMicrosoft SharePoint Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 8.8 · 2025-07-08 | 8.8 | 100% | 2025-07-08 |
| CVE-2021-22204In CISA KEVExploitedImproper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious imageExifTool · ExifTool · CVSS 6.8 · 2021-04-23 | 6.8 | 100% | 2021-04-23 |
| CVE-2012-0158In CISA KEVExploitedThe (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 G…Microsoft · MSCOMCTL.OCX · CVSS 8.8 · 2012-04-10 | 8.8 | 100% | 2012-04-10 |
| CVE-2022-22963In CISA KEVExploitedSpring Cloud - Remote Code ExecutionVMware Tanzu · Spring Cloud Function · CVSS 9.8 · 2022-04-01 | 9.8 | 100% | 2022-04-01 |
| CVE-2022-24816In CISA KEVExploitedGeoServer <1.2.2 - Remote Code Executiongeosolutions-it · jai-ext · CVSS 10 · 2022-04-13 | 10.0 | 100% | 2022-04-13 |
| CVE-2025-32432In CISA KEVExploitedCraftCMS - Remote Code Executioncraftcms · cms · CVSS 10 · 2025-04-25 | 10.0 | 100% | 2025-04-25 |
| CVE-2023-3519In CISA KEVExploitedCitrix NetScaler ADC and NetScaler Gateway - Remote Code ExecutionCitrix · NetScaler ADC · CVSS 9.8 · 2023-07-19 | 9.8 | 100% | 2023-07-19 |
| CVE-2021-22205In CISA KEVExploitedGitLab CE/EE - Remote Code ExecutionGitLab · GitLab · CVSS 10 · 2021-04-23 | 10.0 | 100% | 2021-04-23 |
| CVE-2019-16759In CISA KEVExploitedvBulletin 5.0.0-5.5.4 - Remote Command ExecutionvBulletin · vBulletin · CVSS 9.8 · 2019-09-24 | 9.8 | 100% | 2019-09-24 |
| CVE-2022-22965In CISA KEVExploitedSpring - Remote Code ExecutionVMware · Spring Framework · CVSS 9.8 · 2022-04-01 | 9.8 | 100% | 2022-04-01 |
| CVE-2017-7494In CISA KEVExploitedSamba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a wri…Samba · samba · CVSS 9.8 · 2017-05-30 | 9.8 | 99% | 2017-05-30 |
| CVE-2014-6287In CISA KEVExploitedHTTP File Server <2.3c - Remote Command ExecutionRejetto · HTTP File Server (HFS) · CVSS 9.8 · 2014-10-07 | 9.8 | 99% | 2014-10-07 |
| CVE-2018-7602In CISA KEVExploitedDrupal - Remote Code ExecutionDrupal · core · CVSS 8.1 · 2018-07-19 | 8.1 | 99% | 2018-07-19 |
| CVE-2021-44529In CISA KEVExploitedIvanti EPM Cloud Services Appliance Code InjectionIvanti · Ivanti EPM · CVSS 9.8 · 2021-12-08 | 9.8 | 99% | 2021-12-08 |
| CVE-2022-3236In CISA KEVExploitedSophos Firewall <= 19.0 MR1 - Remote Code ExecutionSophos · Sophos Firewall · CVSS 9.8 · 2022-09-23 | 9.8 | 99% | 2022-09-23 |
| CVE-2026-1281In CISA KEVExploitedIvanti EPMM <=12.7.0.0 - Unauthenticated Code InjectionIvanti · Endpoint Manager Mobile · CVSS 9.8 · 2026-01-29 | 9.8 | 99% | 2026-01-29 |
| CVE-2026-1340In CISA KEVExploitedIvanti EPMM < 12.8.0.0 - Remote Code ExecutionIvanti · Endpoint Manager Mobile · CVSS 9.8 · 2026-01-29 | 9.8 | 99% | 2026-01-29 |
| CVE-2026-34197In CISA KEVExploitedApache ActiveMQ - Remote Code ExecutionApache Software Foundation · Apache ActiveMQ Broker · CVSS 8.8 · 2026-04-07 | 8.8 | 98% | 2026-04-07 |
| CVE-2022-22947In CISA KEVExploitedSpring Cloud Gateway Code InjectionVMware · Spring Cloud Gateway · CVSS 10 · 2022-03-03 | 10.0 | 98% | 2022-03-03 |
| CVE-2021-39144In CISA KEVExploitedXStream 1.4.18 - Remote Code Executionx-stream · xstream · CVSS 8.5 · 2021-08-23 | 8.5 | 98% | 2021-08-23 |
| CVE-2023-25717In CISA KEVExploitedRuckus Wireless Admin - Remote Code ExecutionRuckus Wireless · Multiple Products · CVSS 9.8 · 2023-02-13 | 9.8 | 98% | 2023-02-13 |
| CVE-2024-56145In CISA KEVExploitedCraft CMS - Remote Code Execution via Template Path Manipulationcraftcms · cms · CVSS 9.3 · 2024-12-18 | 9.3 | 97% | 2024-12-18 |
| CVE-2018-1273In CISA KEVExploitedSpring Data Commons - Remote Code ExecutionSpring by Pivotal · Spring Framework · CVSS 9.8 · 2018-04-11 | 9.8 | 97% | 2018-04-11 |
| CVE-2023-33246In CISA KEVExploitedRocketMQ <= 5.1.0 - Remote Code ExecutionApache Software Foundation · Apache RocketMQ · CVSS 9.8 · 2023-05-24 | 9.8 | 97% | 2023-05-24 |
| CVE-2009-1151In CISA KEVExploitedPhpMyAdmin Scripts - Remote Code ExecutionphpMyAdmin · phpMyAdmin · CVSS 9.8 · 2009-03-26 | 9.8 | 97% | 2009-03-26 |
| CVE-2025-54068In CISA KEVExploitedLaravel Livewire v3 - Remote Command Executionlivewire · livewire · CVSS 9.2 · 2025-07-17 | 9.2 | 96% | 2025-07-17 |
| CVE-2019-7609In CISA KEVExploitedKibana Timelion - Arbitrary Code ExecutionElastic · Kibana · CVSS 9.8 · 2019-03-25 | 9.8 | 95% | 2019-03-25 |
| CVE-2017-9822In CISA KEVExploitedDotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code ExecutionDotNetNuke · DotNetNuke CMS Fixed in 9.1.1 · CVSS 8.8 · 2017-07-20 | 8.8 | 95% | 2017-07-20 |
| CVE-2020-8243In CISA KEVExploitedA vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.Ivanti · Pulse Connect Secre · CVSS 7.2 · 2020-09-29 | 7.2 | 91% | 2020-09-29 |
| CVE-2025-37164In CISA KEVExploitedHPE OneView - Remote Code ExecutionHewlett Packard Enterprise (HPE) · HPE OneView · CVSS 10 · 2025-12-16 | 10.0 | 90% | 2025-12-16 |
| CVE-2017-8759In CISA KEVExploitedMicrosoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework…Microsoft Corporation · Microsoft .NET Framework · CVSS 7.8 · 2017-09-13 | 7.8 | 89% | 2017-09-13 |
| CVE-2025-4428In CISA KEVExploitedRemote Code ExecutionIvanti · Endpoint Manager Mobile · CVSS 7.2 · 2025-05-13 | 7.2 | 88% | 2025-05-13 |
| CVE-2019-4716In CISA KEVExploitedIBM Planning Analytics - Authentication Bypass & Remote Code Execution Version DetectionIBM · Planning Analytics · CVSS 10 · 2019-12-18 | 10.0 | 86% | 2019-12-18 |
| CVE-2020-8644In CISA KEVExploitedplaySMS <1.4.3 - Remote Code ExecutionPlaySMS · PlaySMS · CVSS 9.8 · 2020-02-05 | 9.8 | 86% | 2020-02-05 |
| CVE-2023-24955In CISA KEVExploitedMicrosoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 7.2 · 2023-05-09 | 7.2 | 85% | 2023-05-09 |
| CVE-2013-3906In CISA KEVExploitedGDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Ba…Microsoft · Graphics Component · CVSS 7.8 · 2013-11-06 | 7.8 | 85% | 2013-11-06 |
| CVE-2019-10758In CISA KEVExploitedmongo-express Remote Code ExecutionMongoDB · mongo-express · CVSS 9.9 · 2019-12-24 | 9.9 | 85% | 2019-12-24 |
| CVE-2019-0193In CISA KEVExploitedApache Solr DataImportHandler <8.2.0 - Remote Code ExecutionApache · Apache Solr · CVSS 7.2 · 2019-08-01 | 7.2 | 84% | 2019-08-01 |
| CVE-2023-22952In CISA KEVExploitedSugarCRM Unauthenticated - Remote Code ExecutionSugarCRM · Multiple Products · CVSS 8.8 · 2023-01-11 | 8.8 | 80% | 2023-01-11 |
| CVE-2013-4810In CISA KEVExploitedHP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code…Hewlett Packard (HP) · ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Li… · CVSS 9.8 · 2013-09-13 | 9.8 | 79% | 2013-09-13 |
| CVE-2025-6204In CISA KEVExploitedDELMIA Apriso - Command InjectionDassault Systèmes · DELMIA Apriso · CVSS 8 · 2025-08-04 | 8.0 | 77% | 2025-08-04 |
| CVE-2012-0391In CISA KEVExploitedThe ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of pro…Apache · Struts 2 · CVSS 9.8 · 2012-01-08 | 9.8 | 76% | 2012-01-08 |
| CVE-2018-14667In CISA KEVExploitedThe RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this…Red Hat · RichFaces · CVSS 9.8 · 2018-11-06 | 9.8 | 71% | 2018-11-06 |
| CVE-2012-1535In CISA KEVExploitedUnspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or c…Adobe · Flash Player · CVSS 7.8 · 2012-08-15 | 7.8 | 70% | 2012-08-15 |
| CVE-2009-0556In CISA KEVExploitedMicrosoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint f…Microsoft · Office · CVSS 8.8 · 2009-04-03 | 8.8 | 67% | 2009-04-03 |
| CVE-2025-62593In CISA KEVExploitedRay < 2.52.0 - Remote Code Executionray-project · ray · CVSS 9.4 · 2025-11-26 | 9.4 | 60% | 2025-11-26 |
| CVE-2014-4148In CISA KEVExploitedwin32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows S…Microsoft · Windows · CVSS 8.8 · 2014-10-15 | 8.8 | 60% | 2014-10-15 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.