Code injection vulnerabilities
Input is evaluated as code by the application itself, through templates, expression languages or eval-style functions.
Code injection in numbers
sbomify tracks 12,068 code injection vulnerabilities. Most are found in web application (40%), server software (16%) and library (15%).
How to fix code injection vulnerabilities
Upgrade, and never evaluate templates, expressions or code built from user input.
Most exploited code injection vulnerabilities
- CVE-2026-75650 Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine
- CVE-2026-86218 N-able N-central Static Code Injection
- CVE-2025-68613 n8n Improper Control of Dynamically-Managed Code Resources
- CVE-2025-37164 Hewlett Packard Enterprise (HPE) OneView Code Injection
- CVE-2025-20337 Cisco Identity Services Engine Injection
- CVE-2025-47812 Wing FTP Server Improper Neutralization of Null Byte or NUL Character
- CVE-2025-20281 Cisco Identity Services Engine Injection
- CVE-2025-32432 Craft CMS Code Injection
- CVE-2023-22527 Atlassian Confluence Data Center and Server Template Injection
- CVE-2022-24816 OSGeo GeoServer JAI-EXT Code Injection
- CVE-2022-22947 VMware Spring Cloud Gateway Code Injection
- CVE-2022-0543 Debian-specific Redis Server Lua Sandbox Escape
Recently published
- CVE-2024-4412 Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
- CVE-2026-109432 Camunda Expression Injection via orQueries RCE
- CVE-2026-110887 WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability
- CVE-2026-111058 Mercury: Unauthenticated Remote Code Execution via /api/kernels
- CVE-2026-111440 JDBC LogFactory 任意类加载/构造导致潜在 RCE
- CVE-2026-111828 WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability
Other types of vulnerability
- Cross-site scripting54,178
- Memory corruption53,628
- Denial of service36,532
- 35,428
- Missing authorization28,513
- SQL injection23,565
- Path traversal19,236
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.