# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Portabilis i-Educar Cadastrar Vínculo funcionario_vinculo_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8784.md) `CVE-2025-8784` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 9 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Datacom DM955 5GT 1200 Wireless Basic Settings cross site scripting](https://agentprime.io/advisories/CVE-2025-8765.md) `CVE-2025-8765` · CVE record: Datacom DM955 5GT 1200 · CVSS 5.1 Medium · Not analysed yet · Published 9 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Protected Total WebShield Extension Block Page cross site scripting](https://agentprime.io/advisories/CVE-2025-8751.md) `CVE-2025-8751` · CVE record: Protected Total WebShield Extension · CVSS 2.3 Low · Not analysed yet · Published 9 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [macrozheng mall Add Product Page upload cross site scripting](https://agentprime.io/advisories/CVE-2025-8750.md) `CVE-2025-8750` · CVE record: macrozheng mall · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Scada-LTS Virtual Data Source Property data_source_edit.shtm cross site scripting](https://agentprime.io/advisories/CVE-2025-8743.md) `CVE-2025-8743` · CVE record: Scada-LTS · CVSS 5.1 Medium · Not analysed yet · Published 8 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [zhenfeng13 My-Blog Category save cross site scripting](https://agentprime.io/advisories/CVE-2025-8740.md) `CVE-2025-8740` · CVE record: zhenfeng13 My-Blog · CVSS 4.8 Medium · Not analysed yet · Published 8 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Craft CMS has a theoretical bypass for CVE-2025-23209](https://agentprime.io/advisories/GHSA-2vcf-qxv3-2mgw.md) `GHSA-2vcf-qxv3-2mgw`, `CVE-2025-54417`, `PKSA-xnt5-5jkh-xr5x` · Packagist `craftcms/cms`: affected `>=4.13.8, <4.16.3 || >=5.5.8, <5.8.4`, fixed in `4.16.3`, `5.8.4` · CVSS 5.2 Medium · Not analysed yet · Published 8 Aug 2025 · Tags: Code injection - [Path Traversal leading to RCE](https://agentprime.io/advisories/CVE-2025-8356.md) `CVE-2025-8356` · CVE record: Xerox FreeFlow Core · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.23 · Not analysed yet · Published 8 Aug 2025 · Tags: Path traversal, Code injection - [Privileged OpenBao Operator May Execute Code on the Underlying Host](https://agentprime.io/advisories/GHSA-xp75-r577-cvhp.md) `GHSA-xp75-r577-cvhp`, `BIT-openbao-2025-54997`, `CVE-2025-54997`, `GO-2025-3858` · Go `github.com/openbao/openbao`: affected `<0.0.0-20250806194004-a14053c9679d || >=0.1.0, <2.3.2`, fixed in `0.0.0-20250806194004-a14053c9679d`, `2.3.2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Aug 2025 · Tags: Code injection - [Code injection in WPEngine, Inc. Advanced Custom Fields](https://agentprime.io/advisories/CVE-2025-54940.md) `CVE-2025-54940` · CVE record: WPEngine, Inc. Advanced Custom Fields · CVSS 4.6 Medium · Not analysed yet · Published 8 Aug 2025 · Tags: Code injection - [FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html.](https://agentprime.io/advisories/CVE-2025-50692.md) `CVE-2025-50692` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2025 · Tags: Code injection - [Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution](https://agentprime.io/advisories/CVE-2025-8420.md) `CVE-2025-8420` · CVE record: emarket-design Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress and 4 more · CVSS 8.1 High · Not analysed yet · Published 6 Aug 2025 · Tags: Code injection - [react-native-bottom-tabs: Arbitrary code execution in GitHub Actions canary workflow leads to secret exfiltration](https://agentprime.io/advisories/CVE-2025-54594.md) `CVE-2025-54594` · CVE record: callstackincubator react-native-bottom-tabs · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2025 · Tags: Code injection, Privilege escalation - [PHP-Charts v1.0 PHP Code Execution](https://agentprime.io/advisories/CVE-2013-10070.md) `CVE-2013-10070` · CVE record: PHP-Charts PHP-Charts · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2025 · Tags: Code injection - [Maxthon3 about:history XCS Trusted Zone Code Execution](https://agentprime.io/advisories/CVE-2012-10032.md) `CVE-2012-10032` · CVE record: Maxthon International Ltd. Maxthon3 Browser · CVSS 8.7 High · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [ThinkPHP Path Traversal Vulnerability](https://agentprime.io/advisories/GHSA-mrwc-mvr8-9xq5.md) `GHSA-mrwc-mvr8-9xq5`, `CVE-2025-50706`, `PKSA-1h4d-g3yk-64z8` · Packagist `topthink/framework`: affected `<=5.1.41`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2025 · Tags: Path traversal, Code injection - [atjiu pybbs search cross site scripting](https://agentprime.io/advisories/CVE-2025-8555.md) `CVE-2025-8555` · CVE record: atjiu pybbs · CVSS 5.1 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [atjiu pybbs list cross site scripting](https://agentprime.io/advisories/CVE-2025-8554.md) `CVE-2025-8554` · CVE record: atjiu pybbs · CVSS 4.8 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [atjiu pybbs list cross site scripting](https://agentprime.io/advisories/CVE-2025-8553.md) `CVE-2025-8553` · CVE record: atjiu pybbs · CVSS 4.8 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [atjiu pybbs list cross site scripting](https://agentprime.io/advisories/CVE-2025-8552.md) `CVE-2025-8552` · CVE record: atjiu pybbs · CVSS 4.8 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [atjiu pybbs list cross site scripting](https://agentprime.io/advisories/CVE-2025-8551.md) `CVE-2025-8551` · CVE record: atjiu pybbs · CVSS 5.1 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [atjiu pybbs list cross site scripting](https://agentprime.io/advisories/CVE-2025-8550.md) `CVE-2025-8550` · CVE record: atjiu pybbs · CVSS 4.8 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_motivo_afastamento_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8545.md) `CVE-2025-8545` · CVE record: Portabilis i-Educar · CVSS 4.8 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar edit cross site scripting](https://agentprime.io/advisories/CVE-2025-8544.md) `CVE-2025-8544` · CVE record: Portabilis i-Educar · CVSS 4.8 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_raca_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8543.md) `CVE-2025-8543` · CVE record: Portabilis i-Educar · CVSS 4.8 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar empresas_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8542.md) `CVE-2025-8542` · CVE record: Portabilis i-Educar · CVSS 4.8 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar public_uf_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8541.md) `CVE-2025-8541` · CVE record: Portabilis i-Educar · CVSS 4.8 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar public_municipio_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8540.md) `CVE-2025-8540` · CVE record: Portabilis i-Educar · CVSS 4.8 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar public_distrito_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8539.md) `CVE-2025-8539` · CVE record: Portabilis i-Educar · CVSS 4.8 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar novo cross site scripting](https://agentprime.io/advisories/CVE-2025-8538.md) `CVE-2025-8538` · CVE record: Portabilis i-Educar · CVSS 4.8 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [cronoh NanoVault xrb URL main.js executeJavaScript cross site scripting](https://agentprime.io/advisories/CVE-2025-8535.md) `CVE-2025-8535` · CVE record: cronoh NanoVault · CVSS 5.1 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component](https://agentprime.io/advisories/CVE-2025-50707.md) `CVE-2025-50707` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2025 · Tags: Code injection - [givanz Vvveb Add Type post-types cross site scripting](https://agentprime.io/advisories/CVE-2025-8521.md) `CVE-2025-8521` · CVE record: givanz Vvveb · CVSS 4.8 Medium · Not analysed yet · Published 4 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [givanz Vvveb Code Editor code.php save code injection](https://agentprime.io/advisories/CVE-2025-8518.md) `CVE-2025-8518` · CVE record: givanz Vvveb · CVSS 5.1 Medium · Not analysed yet · Published 4 Aug 2025 · Tags: Other injection, Code injection - [Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025](https://agentprime.io/advisories/CVE-2025-6204.md) `CVE-2025-6204` · CVE record: Dassault Systèmes DELMIA Apriso · CVSS 8.0 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.77 · Not analysed yet · Published 4 Aug 2025 · Tags: Code injection - [The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses.](https://agentprime.io/advisories/CVE-2025-51387.md) `CVE-2025-51387` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Aug 2025 · Tags: Code injection - [Portabilis i-Diario Observações diario-de-observacoes cross site scripting](https://agentprime.io/advisories/CVE-2025-8511.md) `CVE-2025-8511` · CVE record: Portabilis i-Diario · CVSS 5.1 Medium · Not analysed yet · Published 3 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_matricula_lst.php Gerar cross site scripting](https://agentprime.io/advisories/CVE-2025-8510.md) `CVE-2025-8510` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 3 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_servidor_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8509.md) `CVE-2025-8509` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 3 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_avaliacao_desempenho_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8508.md) `CVE-2025-8508` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 3 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_funcao_lst.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8507.md) `CVE-2025-8507` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 3 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [495300897 wx-shop editUI cross site scripting](https://agentprime.io/advisories/CVE-2025-8506.md) `CVE-2025-8506` · CVE record: 495300897 wx-shop · CVSS 5.1 Medium · Not analysed yet · Published 3 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Human Resource Integrated System action.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8501.md) `CVE-2025-8501` · CVE record: code-projects Human Resource Integrated System · CVSS 5.1 Medium · Not analysed yet · Published 3 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Synactis PDF In-The-Box ConnectToSynactic Stack-Based Buffer Overflow](https://agentprime.io/advisories/CVE-2013-10057.md) `CVE-2013-10057` · CVE record: Synactis PDF In-The-Box · CVSS 7.5 High · Not analysed yet · Published 1 Aug 2025 · Tags: Code injection, Memory corruption - [InstantCMS <= 1.6 Remote PHP Code Execution](https://agentprime.io/advisories/CVE-2013-10051.md) `CVE-2013-10051` · CVE record: InstantCMS InstantCMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Aug 2025 · Tags: Code injection - [Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration](https://agentprime.io/advisories/GHSA-mr4h-qf9j-f665.md) `GHSA-mr4h-qf9j-f665`, `BIT-vault-2025-6000`, `CVE-2025-6000`, `GO-2025-3838` · Go `github.com/hashicorp/vault`: affected `>=0.8.0, <1.20.1`, fixed in `1.20.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Aug 2025 · Tags: Code injection - [FreshRSS is vulnerable to RCE attacks by authenticated admin](https://agentprime.io/advisories/CVE-2025-54593.md) `CVE-2025-54593` · CVE record: FreshRSS FreshRSS · CVSS 7.2 High · Not analysed yet · Published 1 Aug 2025 · Tags: Code injection - [ProcessMaker Open Source < 2.5.2 neoclassic Skin PHP Code Execution](https://agentprime.io/advisories/CVE-2013-10035.md) `CVE-2013-10035` · CVE record: ProcessMaker, Inc. ProcessMaker Open Source · CVSS 8.7 High · Not analysed yet · Published 31 Jul 2025 · Tags: Code injection - [Campcodes Online Hotel Reservation System add_query_account.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8380.md) `CVE-2025-8380` · CVE record: Campcodes Online Hotel Reservation System · CVSS 5.1 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_escolaridade_lst.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8370.md) `CVE-2025-8370` · CVE record: Portabilis i-Educar · CVSS 5.3 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_avaliacao_desempenho_lst.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8369.md) `CVE-2025-8369` · CVE record: Portabilis i-Educar · CVSS 5.3 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar pesquisa_pessoa_lst.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8368.md) `CVE-2025-8368` · CVE record: Portabilis i-Educar · CVSS 5.3 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar funcionario_vinculo_lst.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8367.md) `CVE-2025-8367` · CVE record: Portabilis i-Educar · CVSS 5.3 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_servidor_lst.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8366.md) `CVE-2025-8366` · CVE record: Portabilis i-Educar · CVSS 5.3 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar atendidos_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8365.md) `CVE-2025-8365` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_aluno_lst.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8346.md) `CVE-2025-8346` · CVE record: Portabilis i-Educar · CVSS 5.3 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Intern Membership Management System Error Message fill_details.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8340.md) `CVE-2025-8340` · CVE record: code-projects Intern Membership Management System · CVSS 5.3 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Simple Car Rental System add_vehicles.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8337.md) `CVE-2025-8337` · CVE record: code-projects Simple Car Rental System · CVSS 4.8 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: Cross-site scripting (XSS), Code injection - [Pyload log Injection via API /json/add_package in add_name parameter](https://agentprime.io/advisories/GHSA-3wwm-hjv7-23r3.md) `GHSA-3wwm-hjv7-23r3` · PyPI `pyload-ng`: affected `<=0.5.0b3.dev89`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: Code injection - [Code Injection Vulnerability in NI LabVIEW when using CIN nodes](https://agentprime.io/advisories/CVE-2025-7361.md) `CVE-2025-7361` · CVE record: NI LabVIEW · CVSS 8.5 High · Not analysed yet · Published 29 Jul 2025 · Tags: Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .