Security Degradation in Iterative AI Code Generation -- a Systematic Analysis of the Paradox

The rapid adoption of Large Language ModelsLLMs for code generation has transformed software development, yet little attention has been given to how security vulnerabilities evolve through iterative LLM feedback. This paper analyzes security degradation in AI-generated code through a controlled...

WordPress plugin MapSVG Lite 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

The vulnerability of the IBM Verify Identity Access system (formerly IBM Security Verify Access) relates to improper code generation, allowing a perpetrator to execute arbitrary code.

The vulnerability of the IBM Verify Identity Access system formerly IBM Security Verify Access is related to improper code generation. Exploiting this vulnerability could allow a perpetrator to execute arbitrary code...

WordPress plugin Ultimate Member 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability exists in...

PT-2025-24453

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The vulnerability resides within the System component of the Android operating system, stemming from improper code generation management. Remote attackers can potentially execute arbitrary...

CVE-2025-2421

Improper Control of Generation of Code 'Code Injection' vulnerability in Profelis Informatics SambaBox allows Code Injection. This issue affects SambaBox: before 5.1...

CVE-2025-2421

Improper Control of Generation of Code 'Code Injection' vulnerability in Profelis Informatics SambaBox allows Code Injection.This issue affects SambaBox: before 5.1...

The vulnerability of the corporate version of the GitHub Enterprise Server, related to improper code generation management, allows a perpetrator to execute arbitrary code.

The vulnerability of the corporate version of the GitHub Enterprise Server is related to improper code generation management. Exploitation of this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the EQUELLA repository in the virtual learning environment Moodle, which allows a perpetrator to execute arbitrary code.

The vulnerability of the EQUELLA repository in the virtual learning environment Moodle is related to incorrect code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of Dropbox’s repository in the virtual learning environment Moodle allows a perpetrator to execute arbitrary code.

The vulnerability of Dropbox’s virtual learning environment Moodle is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the WebKit component in the Safari browser, available on iOS operating systems, macOS Sonoma, iPadOS, and tvOS, allows a hacker to execute arbitrary code.

The vulnerability of the WebKit component in the Safari browser, as well as in the iOS and macOS Sonoma operating systems, iPadOS, and tvOS, is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

SecRepoBench: Benchmarking LLMs for Secure Code Generation in Real-World Repositories

This paper introduces SecRepoBench, a benchmark to evaluate LLMs on secure code generation in real-world repositories. SecRepoBench has 318 code generation tasks in 27 C/C++ repositories, covering 15 CWEs. We evaluate 19 state-of-the-art LLMs using our benchmark and find that the models struggle...

The Hidden Risks of LLM-Generated Web Application Code: a Security-Centric Evaluation of Code Generation Capabilities in Large Language Models

The rapid advancement of Large Language Models LLMs has enhanced software development processes, minimizing the time and effort required for coding and enhancing developer productivity. However, despite their potential benefits, code generated by LLMs has been shown to generate insecure code in...

The vulnerability of the eval() function in Cloud Deployment modules and the Query Tool, a database management tool for pgAdmin 4, allows a hacker to execute arbitrary code.

The vulnerability of the eval function in the Cloud Deployment and Query Tool modules of the pgAdmin 4 database management tool is related to improper code generation during processing of endpoints like /sqleditor/querytool/download and /cloud/deploy, when the querycommited and highavailability...

The vulnerability of SAP ERP BW Business Content software-related software for managing business processes arises from improper code generation, allowing attackers to execute arbitrary code.

The vulnerability of SAP ERP BW Business Content software-related business process management software is related to incorrect code generation. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2025-23251

NVIDIA NeMo Framework contains a vulnerability where a user could cause an improper control of generation of code by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering...

CVE-2025-23251

CVE-2025-23251 (NVIDIA NeMo Framework) involves a code-generation control weakness that could allow remote code execution, with potential data tampering. Multiple sources (NVD, NVIDIA security bulletin, Red Hat, PT Security) confirm the flaw and its impact, describing an attacker who could execut...

GraphAttack: Exploiting Representational Blindspots in LLM Safety Mechanisms

Large Language Models LLMs have been equipped with safety mechanisms to prevent harmful outputs, but these guardrails can often be bypassed through "jailbreak" prompts. This paper introduces a novel graph-based approach to systematically generate jailbreak prompts through semantic transformations...

CVE-2025-29705

code-gen =2.0.6 is vulnerable to Incorrect Access Control. The project does not have permission control allowing anyone to access such projects...

CVE-2025-29705

The CVE-2025-29705 entry concerns code-gen versions 2.0.6 and earlier, with an underlying flaw of Incorrect Access Control due to missing permission controls. This allows anyone to access such projects (impact described as unauthenticated access to projects). Public references corroborate the vul...