# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [O2OA calendarConfig cross site scripting](https://agentprime.io/advisories/CVE-2025-9646.md) `CVE-2025-9646` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Student Information Management System login.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9595.md) `CVE-2025-9595` · CVE record: code-projects Student Information Management System · CVSS 5.3 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [ZrLog Theme Configuration Form config cross site scripting](https://agentprime.io/advisories/CVE-2025-9591.md) `CVE-2025-9591` · CVE record: ZrLog · CVSS 4.8 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Weaver E-Mobile Mobile Management Platform cross site scripting](https://agentprime.io/advisories/CVE-2025-9590.md) `CVE-2025-9590` · CVE record: Weaver E-Mobile Mobile Management Platform · CVSS 5.1 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [lychee-action vulnerable to arbitrary code injection in composite action](https://agentprime.io/advisories/CVE-2024-48908.md) `CVE-2024-48908` · CVE record: lycheeverse lychee-action · CVSS 6.9 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Code injection - [WordPress YouTube Showcase Plugin <= 3.5.1 - PHP Object Injection Vulnerability](https://agentprime.io/advisories/CVE-2025-54731.md) `CVE-2025-54731` · CVE record: emarket-design YouTube Showcase · CVSS 8.1 High · Not analysed yet · Published 28 Aug 2025 · Tags: Code injection - [WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2025-48100.md) `CVE-2025-48100` · CVE record: extremeidea bidorbuy Store Integrator · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2025 · Tags: Code injection - [Improper Control of Generation of Code ('Code Injection') in GitLab](https://agentprime.io/advisories/CVE-2025-5101.md) `CVE-2025-5101` · CVE record: GitLab GitLab · CVSS 5.0 Medium · Not analysed yet · Published 27 Aug 2025 · Tags: Code injection - [Coolify Docker Compose Directive Injection in Application Deployment Workflow](https://agentprime.io/advisories/CVE-2025-34159.md) `CVE-2025-34159` · CVE record: coolLabs Technologies Coolify · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2025 · Tags: Code injection, CWE-20 - [The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability](https://agentprime.io/advisories/GHSA-9hp3-f5g8-rccg.md) `GHSA-9hp3-f5g8-rccg`, `CVE-2025-52122`, `PKSA-tpdv-c7w9-v16r` · Packagist `solspace/craft-freeform`: affected `>=5.0.0, <5.10.16`, fixed in `5.10.16` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2025 · Tags: Code injection - [Authenticated RCE with uhcapache privileges in ConvertToPDF](https://agentprime.io/advisories/CVE-2025-30057.md) `CVE-2025-30057` · CVE record: CGM CGM CLININET · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2025 · Tags: Code injection - [Calling system commands via RunCommand](https://agentprime.io/advisories/CVE-2025-30056.md) `CVE-2025-30056` · CVE record: CGM CGM CLININET · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2025 · Tags: Code injection - [Conditional RCE via the "system" function](https://agentprime.io/advisories/CVE-2025-30055.md) `CVE-2025-30055` · CVE record: CGM CGM CLININET · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2025 · Tags: Code injection - [RCE via Print.pl in uhcPrintServerPrint](https://agentprime.io/advisories/CVE-2025-2313.md) `CVE-2025-2313` · CVE record: CGM CGM CLININET · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2025 · Tags: Code injection - [O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function.](https://agentprime.io/advisories/CVE-2024-37777.md) `CVE-2024-37777` · CVE record · CVSS 8.8 High · Not analysed yet · Published 27 Aug 2025 · Tags: Code injection, CWE-20 - [Agiloft improper neutralization in EUI template engine](https://agentprime.io/advisories/CVE-2025-35113.md) `CVE-2025-35113` · CVE record: Agiloft Agiloft · CVSS 4.8 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: Code injection - [Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip](https://agentprime.io/advisories/GHSA-8r4j-24qv-fmq9.md) `GHSA-8r4j-24qv-fmq9`, `CVE-2025-71361`, `PYSEC-2026-1786` · PyPI `picklescan`: affected `<0.0.29`, fixed in `0.0.29` · CVSS 7.6 High · Not analysed yet · Published 26 Aug 2025 · Tags: Code injection - [Code injection in NVIDIA NeMo Framework](https://agentprime.io/advisories/CVE-2025-23315.md) `CVE-2025-23315` · CVE record: NVIDIA NeMo Framework · CVSS 7.8 High · Not analysed yet · Published 26 Aug 2025 · Tags: Code injection - [Code injection in NVIDIA NeMo Framework](https://agentprime.io/advisories/CVE-2025-23314.md) `CVE-2025-23314` · CVE record: NVIDIA NeMo Framework · CVSS 7.8 High · Not analysed yet · Published 26 Aug 2025 · Tags: Code injection - [Code injection in NVIDIA NeMo Framework](https://agentprime.io/advisories/CVE-2025-23313.md) `CVE-2025-23313` · CVE record: NVIDIA NeMo Framework · CVSS 7.8 High · Not analysed yet · Published 26 Aug 2025 · Tags: Code injection - [Code injection in NVIDIA NeMo Framework](https://agentprime.io/advisories/CVE-2025-23312.md) `CVE-2025-23312` · CVE record: NVIDIA NeMo Framework · CVSS 7.8 High · Not analysed yet · Published 26 Aug 2025 · Tags: Code injection - [Code injection in NVIDIA NeMo Curator](https://agentprime.io/advisories/CVE-2025-23307.md) `CVE-2025-23307` · CVE record: NVIDIA NVIDIA NeMo Curator · CVSS 7.8 High · Not analysed yet · Published 26 Aug 2025 · Tags: Code injection - [COMMGR Code Injection Vulnerability](https://agentprime.io/advisories/CVE-2025-53419.md) `CVE-2025-53419` · CVE record: Delta Electronics COMMGR · CVSS 7.8 High · Not analysed yet · Published 26 Aug 2025 · Tags: Code injection - [1000projects Online Project Report Submission and Evaluation System add_title.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9440.md) `CVE-2025-9440` · CVE record: 1000projects Online Project Report Submission and Evaluation System · CVSS 5.3 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [1000projects Online Project Report Submission and Evaluation System edit_faculty.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9439.md) `CVE-2025-9439` · CVE record: 1000projects Online Project Report Submission and Evaluation System · CVSS 5.3 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [1000projects Online Project Report Submission and Evaluation System add_student.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9438.md) `CVE-2025-9438` · CVE record: 1000projects Online Project Report Submission and Evaluation System · CVSS 5.3 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [1000projects Online Project Report Submission and Evaluation System edit_title.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9434.md) `CVE-2025-9434` · CVE record: 1000projects Online Project Report Submission and Evaluation System · CVSS 5.3 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [mtons mblog Admin Panel list cross site scripting](https://agentprime.io/advisories/CVE-2025-9433.md) `CVE-2025-9433` · CVE record: mtons mblog · CVSS 5.3 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [mtons mblog Admin Panel list cross site scripting](https://agentprime.io/advisories/CVE-2025-9432.md) `CVE-2025-9432` · CVE record: mtons mblog · CVSS 5.3 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [mtons mblog search cross site scripting](https://agentprime.io/advisories/CVE-2025-9431.md) `CVE-2025-9431` · CVE record: mtons mblog · CVSS 5.3 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [mtons mblog update cross site scripting](https://agentprime.io/advisories/CVE-2025-9430.md) `CVE-2025-9430` · CVE record: mtons mblog · CVSS 4.8 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [SelectZero Data Observability Platform before 2025.5.2 is vulnerable to Content Spoofing / Text Injection.](https://agentprime.io/advisories/CVE-2025-52218.md) `CVE-2025-52218` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2025 · Tags: Code injection - [mtons mblog Post submit cross site scripting](https://agentprime.io/advisories/CVE-2025-9429.md) `CVE-2025-9429` · CVE record: mtons mblog · CVSS 5.1 Medium · Not analysed yet · Published 25 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [oitcode samarium Team Image team cross site scripting](https://agentprime.io/advisories/CVE-2025-9422.md) `CVE-2025-9422` · CVE record: oitcode samarium · CVSS 4.8 Medium · Not analysed yet · Published 25 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Craft CMS Potential Remote Code Execution via Twig SSTI](https://agentprime.io/advisories/GHSA-crcq-738g-pqvc.md) `GHSA-crcq-738g-pqvc`, `CVE-2025-57811`, `PKSA-cbq7-fhfn-fyt5` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1, <4.16.6 || >=5.0.0-RC1, <5.8.7`, fixed in `4.16.6`, `5.8.7` · CVSS 6.1 Medium · Not analysed yet · Published 25 Aug 2025 · Tags: Path traversal, Code injection - [oitcode samarium Pages Image webpage cross site scripting](https://agentprime.io/advisories/CVE-2025-9416.md) `CVE-2025-9416` · CVE record: oitcode samarium · CVSS 4.8 Medium · Not analysed yet · Published 25 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Dataease H2 JDBC RCE Bypass](https://agentprime.io/advisories/CVE-2025-57772.md) `CVE-2025-57772` · CVE record: dataease dataease · CVSS 8.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 25 Aug 2025 · Tags: Code injection - [Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability](https://agentprime.io/advisories/CVE-2025-57773.md) `CVE-2025-57773` · CVE record: dataease dataease · CVSS 8.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.10 · Not analysed yet · Published 25 Aug 2025 · Tags: Code injection, Insecure deserialization - [mtons mblog profile cross site scripting](https://agentprime.io/advisories/CVE-2025-9407.md) `CVE-2025-9407` · CVE record: mtons mblog · CVSS 5.1 Medium · Not analysed yet · Published 25 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Scada-LTS Folder pointHierarchySLTS cross site scripting](https://agentprime.io/advisories/CVE-2025-9404.md) `CVE-2025-9404` · CVE record: Scada-LTS · CVSS 4.8 Medium · Not analysed yet · Published 25 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Scada-LTS watch_list.shtm cross site scripting](https://agentprime.io/advisories/CVE-2025-9388.md) `CVE-2025-9388` · CVE record: Scada-LTS · CVSS 5.1 Medium · Not analysed yet · Published 24 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL.](https://agentprime.io/advisories/CVE-2024-52786.md) `CVE-2024-52786` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2025 · Tags: Code injection, Authentication bypass - [Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to run arbitrary code via an unspecified web interfa…](https://agentprime.io/advisories/CVE-2022-31491.md) `CVE-2022-31491` · CVE record · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2025 · Tags: Code injection, CWE-749 - [Maple <= v13 Maplet File Creation and Command Execution](https://agentprime.io/advisories/CVE-2010-20120.md) `CVE-2010-20120` · CVE record: Maplesoft Maple · CVSS 8.4 High · Not analysed yet · Published 21 Aug 2025 · Tags: Code injection - [SourceCodester Advanced School Management System addNotice cross site scripting](https://agentprime.io/advisories/CVE-2025-9306.md) `CVE-2025-9306` · CVE record: SourceCodester Advanced School Management System · CVSS 5.1 Medium · Not analysed yet · Published 21 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Spree Commerce is vulnerable to RCE through Search API](https://agentprime.io/advisories/GHSA-x485-rhg3-cqr4.md) `GHSA-x485-rhg3-cqr4`, `CVE-2011-10026` · RubyGems `rd_searchlogic` and 1 more: affected `<=3.0.1`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2025 · Tags: Command injection, Code injection - [CodeAstro Ecommerce Website Edit Your Account my_account.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9237.md) `CVE-2025-9237` · CVE record: CodeAstro Ecommerce Website · CVSS 5.1 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Scada-LTS compound_events.shtm cross site scripting](https://agentprime.io/advisories/CVE-2025-9235.md) `CVE-2025-9235` · CVE record: Scada-LTS · CVSS 5.1 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Scada-LTS maintenance_events.shtm cross site scripting](https://agentprime.io/advisories/CVE-2025-9234.md) `CVE-2025-9234` · CVE record: Scada-LTS · CVSS 5.1 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Scada-LTS view_edit.shtm cross site scripting](https://agentprime.io/advisories/CVE-2025-9233.md) `CVE-2025-9233` · CVE record: Scada-LTS · CVSS 5.1 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [WordPress Add Custom Codes <= 4.80 - Arbitrary Code Execution vulnerability](https://agentprime.io/advisories/CVE-2025-30975.md) `CVE-2025-30975` · CVE record: SaifuMak Add Custom Codes · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2025 · Tags: Code injection - [WordPress Code Engine Plugin <= 0.3.3 - Remote Code Execution (RCE) Vulnerability](https://agentprime.io/advisories/CVE-2025-48169.md) `CVE-2025-48169` · CVE record: Jordy Meow Code Engine · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2025 · Tags: Code injection - [WordPress Global DNS Plugin <= 3.1.0 - Remote Code Execution (RCE) Vulnerability](https://agentprime.io/advisories/CVE-2025-53577.md) `CVE-2025-53577` · CVE record: thehp Global DNS · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2025 · Tags: Code injection - [WordPress Alone < 7.8.5 - Arbitrary Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-54019.md) `CVE-2025-54019` · CVE record: Beplusthemes Alone · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: Code injection - [XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentatio…](https://agentprime.io/advisories/CVE-2025-51991.md) `CVE-2025-51991` · CVE record · CVSS 8.8 High · Not analysed yet · Published 20 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [SolidInvoice Clients clients cross site scripting](https://agentprime.io/advisories/CVE-2025-9171.md) `CVE-2025-9171` · CVE record: SolidInvoice · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [SolidInvoice Tax Rates rates cross site scripting](https://agentprime.io/advisories/CVE-2025-9170.md) `CVE-2025-9170` · CVE record: SolidInvoice · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [SolidInvoice Quote quotes cross site scripting](https://agentprime.io/advisories/CVE-2025-9169.md) `CVE-2025-9169` · CVE record: SolidInvoice · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [SolidInvoice Invoice Creation invoice cross site scripting](https://agentprime.io/advisories/CVE-2025-9168.md) `CVE-2025-9168` · CVE record: SolidInvoice · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [SolidInvoice Recurring Invoice recurring cross site scripting](https://agentprime.io/advisories/CVE-2025-9167.md) `CVE-2025-9167` · CVE record: SolidInvoice · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .