# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [DeepChat One-click Remote Code Execution through Custom URL Handling](https://agentprime.io/advisories/CVE-2025-55733.md) `CVE-2025-55733` · CVE record: ThinkInAIXYZ deepchat · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2025 · Tags: Code injection - [jasonclark getsemantic index.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9147.md) `CVE-2025-9147` · CVE record: jasonclark getsemantic · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Scada-LTS SVG File view_edit.shtm cross site scripting](https://agentprime.io/advisories/CVE-2025-9145.md) `CVE-2025-9145` · CVE record: Scada-LTS · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Scada-LTS publisher_edit.shtm cross site scripting](https://agentprime.io/advisories/CVE-2025-9144.md) `CVE-2025-9144` · CVE record: Scada-LTS · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Scada-LTS mailing_lists.shtm cross site scripting](https://agentprime.io/advisories/CVE-2025-9143.md) `CVE-2025-9143` · CVE record: Scada-LTS · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Scada-LTS new cross site scripting](https://agentprime.io/advisories/CVE-2025-9138.md) `CVE-2025-9138` · CVE record: Scada-LTS · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Scada-LTS scheduled_events.shtm cross site scripting](https://agentprime.io/advisories/CVE-2025-9137.md) `CVE-2025-9137` · CVE record: Scada-LTS · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Cloudflare Image Resizing <= 1.5.6 - Missing Authentication to Unauthenticated Remote Code Execution via rest_pre_dispatch Hook](https://agentprime.io/advisories/CVE-2025-8723.md) `CVE-2025-8723` · CVE record: mecanik Cloudflare Image Resizing – Optimize & Accelerate Your Images · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.19 · Not analysed yet · Published 19 Aug 2025 · Tags: Code injection - [Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare() function, which uses preg_replace() with the deprecated /e (eval) modifier to interpolate SQL query parameters.](https://agentprime.io/advisories/CVE-2025-50567.md) `CVE-2025-50567` · CVE record · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2025 · Tags: SQL injection, Code injection - [Netis WF2419 Wireless Settings index.htm cross site scripting](https://agentprime.io/advisories/CVE-2025-9119.md) `CVE-2025-9119` · CVE record: Netis WF2419 · CVSS 4.8 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Diario search_autocomplete cross site scripting](https://agentprime.io/advisories/CVE-2025-9107.md) `CVE-2025-9107` · CVE record: Portabilis i-Diario · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Diario Informações Adicionais /planos-de-ensino-por-disciplina cross site scripting](https://agentprime.io/advisories/CVE-2025-9106.md) `CVE-2025-9106` · CVE record: Portabilis i-Diario · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Diario Informações Adicionais /planos-de-ensino-por-areas-de-conhecimento cross site scripting](https://agentprime.io/advisories/CVE-2025-9105.md) `CVE-2025-9105` · CVE record: Portabilis i-Diario · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Diario Informações Adicionais /planos-de-aulas-por-disciplina cross site scripting](https://agentprime.io/advisories/CVE-2025-9104.md) `CVE-2025-9104` · CVE record: Portabilis i-Diario · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [ZenCart CKEditor cross site scripting](https://agentprime.io/advisories/CVE-2025-9103.md) `CVE-2025-9103` · CVE record: ZenCart · CVSS 4.8 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [zhenfeng13 My-Blog Tag save cross site scripting](https://agentprime.io/advisories/CVE-2025-9101.md) `CVE-2025-9101` · CVE record: zhenfeng13 My-Blog · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/apps.js](https://agentprime.io/advisories/GHSA-xfp8-x3j6-h67v.md) `GHSA-xfp8-x3j6-h67v`, `CVE-2025-9096` · npm `express-gateway`: affected `<=1.16.10`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/users.js](https://agentprime.io/advisories/GHSA-q4rg-7cjj-5r86.md) `GHSA-q4rg-7cjj-5r86`, `CVE-2025-9095` · npm `express-gateway`: affected `<=1.16.10`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an eval injection vulnerability via the eval() function.](https://agentprime.io/advisories/CVE-2025-55585.md) `CVE-2025-55585` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 18 Aug 2025 · Tags: Code injection - [ThingsBoard Add Gateway special elements used in a template engine](https://agentprime.io/advisories/CVE-2025-9094.md) `CVE-2025-9094` · CVE record: ThingsBoard · CVSS 5.3 Medium · Not analysed yet · Published 17 Aug 2025 · Tags: Code injection, CWE-791 - [Soledad <= 8.6.7 - Unauthenticated Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2025-8105.md) `CVE-2025-8105` · CVE record: pencidesign Soledad · CVSS 7.3 High · Not analysed yet · Published 16 Aug 2025 · Tags: Code injection - [Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2025-8878.md) `CVE-2025-8878` · CVE record: properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress · CVSS 6.5 Medium · Not analysed yet · Published 16 Aug 2025 · Tags: Code injection - [KAP 3.6.0 - TCC Bypass](https://agentprime.io/advisories/CVE-2025-7961.md) `CVE-2025-7961` · CVE record: Wulkano KAP · CVSS 6.9 Medium · Not analysed yet · Published 15 Aug 2025 · Tags: Code injection - [Apache OFBiz: RCE Vulnerability in scrum plugin](https://agentprime.io/advisories/CVE-2025-54466.md) `CVE-2025-54466` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 6.3 Medium · EPSS 0.29 · Not analysed yet · Published 15 Aug 2025 · Tags: Code injection - [Inpersttion For Theme <= 1.0 - Authenticated (Contributor+) Arbitrary Function Call](https://agentprime.io/advisories/CVE-2025-8905.md) `CVE-2025-8905` · CVE record: inpersttion Inpersttion For Theme · CVSS 6.3 Medium · Not analysed yet · Published 15 Aug 2025 · Tags: Code injection - [PHPGurukul Zoo Management System add-foreigner-ticket.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9017.md) `CVE-2025-9017` · CVE record: PHPGurukul Zoo Management System · CVSS 5.3 Medium · Not analysed yet · Published 15 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [D-Link DIR-818LW DHCP Reserved Address bsc_lan.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9003.md) `CVE-2025-9003` · CVE record: D-Link DIR-818LW · CVSS 5.1 Medium · Not analysed yet · Published 15 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [givanz Vvveb Endpoint post cross site scripting](https://agentprime.io/advisories/CVE-2025-8976.md) `CVE-2025-8976` · CVE record: givanz Vvveb · CVSS 5.1 Medium · Not analysed yet · Published 14 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [givanz Vvveb edit.tpl cross site scripting](https://agentprime.io/advisories/CVE-2025-8975.md) `CVE-2025-8975` · CVE record: givanz Vvveb · CVSS 5.1 Medium · Not analysed yet · Published 14 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [HomeAssistant-Tapo-Control Code Injection Vulnerability in issues.yml Workflow](https://agentprime.io/advisories/CVE-2025-55192.md) `CVE-2025-55192` · CVE record: JurajNyiri HomeAssistant-Tapo-Control · CVSS 8.6 High · Not analysed yet · Published 14 Aug 2025 · Tags: Code injection - [Duplicate Advisory: Flowise vulnerable to RCE via Dynamic function constructor injection](https://agentprime.io/advisories/GHSA-q4xx-mc3q-23x8.md) `GHSA-q4xx-mc3q-23x8` · npm `flowise`: affected `<=3.0.5`, no fixed version yet · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 14 Aug 2025 · Tags: Code injection - [WordPress Eventer plugin < 3.9.9.1 - Content Injection vulnerability](https://agentprime.io/advisories/CVE-2025-39483.md) `CVE-2025-39483` · CVE record: imithemes Eventer · CVSS 6.5 Medium · Not analysed yet · Published 14 Aug 2025 · Tags: Code injection - [WordPress Product XML Feed Manager for WooCommerce Plugin <= 2.9.3 - Remote Code Execution (RCE) Vulnerability](https://agentprime.io/advisories/CVE-2025-49887.md) `CVE-2025-49887` · CVE record: WPFactory Product XML Feed Manager for WooCommerce · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2025 · Tags: Code injection - [1000 Projects Sales Management System sales.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8934.md) `CVE-2025-8934` · CVE record: 1000 Projects Sales Management System · CVSS 5.3 Medium · Not analysed yet · Published 14 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [1000 Projects Sales Management System sales.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8933.md) `CVE-2025-8933` · CVE record: 1000 Projects Sales Management System · CVSS 5.3 Medium · Not analysed yet · Published 14 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Active Storage allowed transformation methods that were potentially unsafe](https://agentprime.io/advisories/GHSA-r4mg-4433-c7g3.md) `GHSA-r4mg-4433-c7g3`, `CVE-2025-24293` · RubyGems `activestorage`: affected `>=5.2.0, <7.1.5.2 || >=7.2, <7.2.2.2 || >=8.0, <8.0.2.1`, fixed in `7.1.5.2`, `7.2.2.2`, `8.0.2.1` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2025 · Tags: Command injection, Code injection - [Spree has Remote Command Execution vulnerability in search functionality](https://agentprime.io/advisories/GHSA-97vm-c39p-jr86.md) `GHSA-97vm-c39p-jr86`, `CVE-2011-10019` · RubyGems `spree`: affected `<0.60.2`, fixed in `0.60.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2025 · Tags: Code injection, Prototype pollution - [WeBid 1.0.2 converter.php Remote PHP Code Injection](https://agentprime.io/advisories/CVE-2011-10011.md) `CVE-2011-10011` · CVE record: WeBid WeBid · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2025 · Tags: Code injection - [Traq 2.0–2.3 admincp/common.php RCE](https://agentprime.io/advisories/CVE-2011-10013.md) `CVE-2011-10013` · CVE record: Traq Project Issue Tracking System · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2025 · Tags: Code injection, Authentication bypass - [myBB 1.6.4 Backdoor Arbitrary Command Execution](https://agentprime.io/advisories/CVE-2011-10018.md) `CVE-2011-10018` · CVE record: myBB Group Forum Software · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2025 · Tags: Code injection, CWE-912 - [Portabilis i-Diario Dicionário de Termos BNCC dicionario-de-termos-bncc cross site scripting](https://agentprime.io/advisories/CVE-2025-8920.md) `CVE-2025-8920` · CVE record: Portabilis i-Diario · CVSS 4.8 Medium · Not analysed yet · Published 13 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Code injection in NVIDIA Megatron-LM](https://agentprime.io/advisories/CVE-2025-23306.md) `CVE-2025-23306` · CVE record: NVIDIA Megatron-LM · CVSS 7.8 High · Not analysed yet · Published 13 Aug 2025 · Tags: Code injection - [Code injection in NVIDIA Megatron-LM](https://agentprime.io/advisories/CVE-2025-23305.md) `CVE-2025-23305` · CVE record: NVIDIA Megatron-LM · CVSS 7.8 High · Not analysed yet · Published 13 Aug 2025 · Tags: Code injection - [Portabilis i-Diario History objetivos-de-aprendizagem-e-habilidades cross site scripting](https://agentprime.io/advisories/CVE-2025-8919.md) `CVE-2025-8919` · CVE record: Portabilis i-Diario · CVSS 4.8 Medium · Not analysed yet · Published 13 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Code injection in NVIDIA Merlin Transformers4Rec](https://agentprime.io/advisories/CVE-2025-23298.md) `CVE-2025-23298` · CVE record: NVIDIA NVIDIA Merlin Transformers4Rec · CVSS 7.8 High · Not analysed yet · Published 13 Aug 2025 · Tags: Code injection - [Code injection in NVIDIA Isaac-GR00T N1](https://agentprime.io/advisories/CVE-2025-23296.md) `CVE-2025-23296` · CVE record: NVIDIA NVIDIA Isaac-GR00T N1 · CVSS 7.8 High · Not analysed yet · Published 13 Aug 2025 · Tags: Code injection - [Code injection in NVIDIA Apex](https://agentprime.io/advisories/CVE-2025-23295.md) `CVE-2025-23295` · CVE record: NVIDIA NVIDIA Apex · CVSS 7.8 High · Not analysed yet · Published 13 Aug 2025 · Tags: Code injection - [Portabilis i-Educar Editar educar_instituicao_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8918.md) `CVE-2025-8918` · CVE record: Portabilis i-Educar · CVSS 4.8 Medium · Not analysed yet · Published 13 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the child_process module](https://agentprime.io/advisories/CVE-2025-52385.md) `CVE-2025-52385` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2025 · Tags: Code injection - [Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)](https://agentprime.io/advisories/CVE-2025-42957.md) `CVE-2025-42957` · CVE record: SAP_SE SAP S/4HANA (Private Cloud or On-Premise) · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2025 · Tags: Code injection - [Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)](https://agentprime.io/advisories/CVE-2025-42950.md) `CVE-2025-42950` · CVE record: SAP_SE SAP Landscape Transformation (Analysis Platform) · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2025 · Tags: Code injection - [HTML Injection vulnerability in SAP NetWeaver Application Server ABAP](https://agentprime.io/advisories/CVE-2025-42945.md) `CVE-2025-42945` · CVE record: SAP_SE SAP NetWeaver Application Server ABAP · CVSS 6.1 Medium · Not analysed yet · Published 12 Aug 2025 · Tags: Code injection - [Cherry Studio One-click Remote Code Execution Vulnerability through Custom URL Handling](https://agentprime.io/advisories/CVE-2025-54063.md) `CVE-2025-54063` · CVE record: CherryHQ cherry-studio · CVSS 8.0 High · Not analysed yet · Published 11 Aug 2025 · Tags: Code injection - [yangzongzhuan RuoYi edit cross site scripting](https://agentprime.io/advisories/CVE-2025-8847.md) `CVE-2025-8847` · CVE record: yangzongzhuan RuoYi · CVSS 5.1 Medium · Not analysed yet · Published 11 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [JCG Link-net LW-N915R Wireless Basic Settings basic.asp cross site scripting](https://agentprime.io/advisories/CVE-2025-8834.md) `CVE-2025-8834` · CVE record: JCG Link-net LW-N915R · CVSS 4.8 Medium · Not analysed yet · Published 11 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [atjiu pybbs Admin Panel settings cross site scripting](https://agentprime.io/advisories/CVE-2025-8812.md) `CVE-2025-8812` · CVE record: atjiu pybbs · CVSS 4.8 Medium · Not analysed yet · Published 10 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Diario Informações adicionais planos-de-aula-por-areas-de-conhecimento cross site scripting](https://agentprime.io/advisories/CVE-2025-8788.md) `CVE-2025-8788` · CVE record: Portabilis i-Diario · CVSS 5.1 Medium · Not analysed yet · Published 10 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Diario Registro das atividades registros-de-conteudos-por-disciplina cross site scripting](https://agentprime.io/advisories/CVE-2025-8787.md) `CVE-2025-8787` · CVE record: Portabilis i-Diario · CVSS 5.1 Medium · Not analysed yet · Published 10 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Diario Registro das atividades registros-de-conteudos-por-areas-de-conhecimento cross site scripting](https://agentprime.io/advisories/CVE-2025-8786.md) `CVE-2025-8786` · CVE record: Portabilis i-Diario · CVSS 5.1 Medium · Not analysed yet · Published 10 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_usuario_lst.php cross site scripting](https://agentprime.io/advisories/CVE-2025-8785.md) `CVE-2025-8785` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 9 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .