# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [itsourcecode POS Point of Sale System deferred_table.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10063.md) `CVE-2025-10063` · CVE record: itsourcecode POS Point of Sale System · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Campcodes Grocery Sales and Inventory System index.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10032.md) `CVE-2025-10032` · CVE record: Campcodes Grocery Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 6 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [itsourcecode POS Point of Sale System complex_header_2.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10029.md) `CVE-2025-10029` · CVE record: itsourcecode POS Point of Sale System · CVSS 5.1 Medium · Not analysed yet · Published 6 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [itsourcecode POS Point of Sale System 6776.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10028.md) `CVE-2025-10028` · CVE record: itsourcecode POS Point of Sale System · CVSS 5.1 Medium · Not analysed yet · Published 6 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Rehub <= 19.9.7 - Unauthenticated Arbitrary Shortcode Execution via re_filterpost](https://agentprime.io/advisories/CVE-2025-7366.md) `CVE-2025-7366` · CVE record: sizam REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme · CVSS 7.3 High · Not analysed yet · Published 6 Sept 2025 · Tags: Code injection - [Roo Code: Potential Remote Code Execution via .code-workspace](https://agentprime.io/advisories/CVE-2025-58372.md) `CVE-2025-58372` · CVE record: RooCodeInc Roo-Code · CVSS 8.1 High · Not analysed yet · Published 5 Sept 2025 · Tags: Code injection, Broken access control - [itsourcecode POS Point of Sale System 2512.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10027.md) `CVE-2025-10027` · CVE record: itsourcecode POS Point of Sale System · CVSS 5.1 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [itsourcecode POS Point of Sale System -complex_header.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10026.md) `CVE-2025-10026` · CVE record: itsourcecode POS Point of Sale System · CVSS 5.1 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [WordPress Job Board Manager Plugin <= 2.1.61 - Content Injection Vulnerability](https://agentprime.io/advisories/CVE-2025-58827.md) `CVE-2025-58827` · CVE record: PickPlugins Job Board Manager · CVSS 3.8 Low · Not analysed yet · Published 5 Sept 2025 · Tags: Code injection - [Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode](https://agentprime.io/advisories/CVE-2025-9519.md) `CVE-2025-9519` · CVE record: kleor Easy Timer · CVSS 7.2 High · Not analysed yet · Published 4 Sept 2025 · Tags: Code injection - [atec Debug <= 1.2.22 - Authenticated (Administrator+) Remote Code Execution](https://agentprime.io/advisories/CVE-2025-9517.md) `CVE-2025-9517` · CVE record: docjojo atec Debug · CVSS 7.2 High · Not analysed yet · Published 4 Sept 2025 · Tags: Code injection - [CodeAstro Real Estate Management System feature.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9940.md) `CVE-2025-9940` · CVE record: CodeAstro Real Estate Management System · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [CodeAstro Real Estate Management System propertyview.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9939.md) `CVE-2025-9939` · CVE record: CodeAstro Real Estate Management System · CVSS 5.1 Medium · Not analysed yet · Published 4 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Jinher OA POST Request login!changePassWord.action cross site scripting](https://agentprime.io/advisories/CVE-2025-9931.md) `CVE-2025-9931` · CVE record: Jinher OA · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Responsive Blog Site blogs_view.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9929.md) `CVE-2025-9929` · CVE record: code-projects Responsive Blog Site · CVSS 4.8 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Electron has ASAR Integrity Bypass via resource modification](https://agentprime.io/advisories/GHSA-vmqv-hx8q-j7mg.md) `GHSA-vmqv-hx8q-j7mg`, `CVE-2025-55305` · npm `electron`: affected `<35.7.5 || >=36.0.0-alpha.1, <36.8.1 || >=37.0.0-alpha.1, <37.3.1 || >=38.0.0-alpha.1, <38.0.0-beta.6`, fixed in `35.7.5`, `36.8.1`, `37.3.1`, `38.0.0-beta.6` · CVSS 6.1 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Code injection, CWE-829 - [Campcodes Sales and Inventory System index.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9923.md) `CVE-2025-9923` · CVE record: Campcodes Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning](https://agentprime.io/advisories/GHSA-ph6w-f82w-28w6.md) `GHSA-ph6w-f82w-28w6` · npm `@anthropic-ai/claude-code`: affected `<1.0.87`, fixed in `1.0.87` · CVSS 4.0, no score published · Not analysed yet · Published 3 Sept 2025 · Tags: Code injection - [Campcodes Sales and Inventory System index.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9922.md) `CVE-2025-9922` · CVE record: Campcodes Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [code-projects POS Pharmacy System products.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9921.md) `CVE-2025-9921` · CVE record: code-projects POS Pharmacy System · CVSS 4.8 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Sandbox escape in smolagents Local Python execution environment via dunder attributes](https://agentprime.io/advisories/CVE-2025-9959.md) `CVE-2025-9959` · CVE record · CVSS 7.6 High · Not analysed yet · Published 3 Sept 2025 · Tags: Code injection - [HTML Cache Poisoning through Unsafe Reflections](https://agentprime.io/advisories/CVE-2025-53693.md) `CVE-2025-53693` · CVE record: Sitecore Sitecore Experience Manager (XM) and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.20 · Not analysed yet · Published 3 Sept 2025 · Tags: Code injection - [Dive's improper processing of custom urls can lead to Remote Code Execution](https://agentprime.io/advisories/CVE-2025-58176.md) `CVE-2025-58176` · CVE record: OpenAgentPlatform Dive · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.10 · Not analysed yet · Published 3 Sept 2025 · Tags: Code injection - [code-projects Fruit Shop Management System products.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9845.md) `CVE-2025-9845` · CVE record: code-projects Fruit Shop Management System · CVSS 5.1 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [PHPGurukul Small CRM registration.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9834.md) `CVE-2025-9834` · CVE record: PHPGurukul Small CRM · CVSS 5.1 Medium · Not analysed yet · Published 2 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [thinkgem JeeSite EncodeUtils.java decodeUrl2 cross site scripting](https://agentprime.io/advisories/CVE-2025-9796.md) `CVE-2025-9796` · CVE record: thinkgem JeeSite · CVSS 5.1 Medium · Not analysed yet · Published 1 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [RemoteClinic edit.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9773.md) `CVE-2025-9773` · CVE record: RemoteClinic · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Khanakag-17 Library Management System index.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9755.md) `CVE-2025-9755` · CVE record: Khanakag-17 Library Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Campcodes Online Hospital Management System Edit Profile edit-profile.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9754.md) `CVE-2025-9754` · CVE record: Campcodes Online Hospital Management System · CVSS 5.1 Medium · Not analysed yet · Published 1 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Campcodes Online Hospital Management System Patient Search patient-search.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9753.md) `CVE-2025-9753` · CVE record: Campcodes Online Hospital Management System · CVSS 4.8 Medium · Not analysed yet · Published 1 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Campcodes Hospital Management System Edit Doctor Specialization edit-doctor-specialization.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9746.md) `CVE-2025-9746` · CVE record: Campcodes Hospital Management System · CVSS 4.8 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_tipo_ensino_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9738.md) `CVE-2025-9738` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile importmodel cross site scripting](https://agentprime.io/advisories/CVE-2025-9737.md) `CVE-2025-9737` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile statement cross site scripting](https://agentprime.io/advisories/CVE-2025-9736.md) `CVE-2025-9736` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile table cross site scripting](https://agentprime.io/advisories/CVE-2025-9735.md) `CVE-2025-9735` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile stat cross site scripting](https://agentprime.io/advisories/CVE-2025-9734.md) `CVE-2025-9734` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [givanz Vvveb login.tpl cross site scripting](https://agentprime.io/advisories/CVE-2025-9728.md) `CVE-2025-9728` · CVE record: givanz Vvveb · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_nivel_ensino_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9724.md) `CVE-2025-9724` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_tipo_regime_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9723.md) `CVE-2025-9723` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_tipo_ocorrencia_disciplinar_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9722.md) `CVE-2025-9722` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar edit cross site scripting](https://agentprime.io/advisories/CVE-2025-9721.md) `CVE-2025-9721` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar Cadastrar tabela de arredondamento edit cross site scripting](https://agentprime.io/advisories/CVE-2025-9720.md) `CVE-2025-9720` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile script cross site scripting](https://agentprime.io/advisories/CVE-2025-9719.md) `CVE-2025-9719` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile process cross site scripting](https://agentprime.io/advisories/CVE-2025-9718.md) `CVE-2025-9718` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile unit cross site scripting](https://agentprime.io/advisories/CVE-2025-9717.md) `CVE-2025-9717` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile form cross site scripting](https://agentprime.io/advisories/CVE-2025-9716.md) `CVE-2025-9716` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile script cross site scripting](https://agentprime.io/advisories/CVE-2025-9715.md) `CVE-2025-9715` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile form cross site scripting](https://agentprime.io/advisories/CVE-2025-9683.md) `CVE-2025-9683` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 30 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile appdict cross site scripting](https://agentprime.io/advisories/CVE-2025-9682.md) `CVE-2025-9682` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 30 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile agent cross site scripting](https://agentprime.io/advisories/CVE-2025-9681.md) `CVE-2025-9681` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 30 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile page cross site scripting](https://agentprime.io/advisories/CVE-2025-9680.md) `CVE-2025-9680` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 30 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [WeGIA Authenticated Arbitrary File Upload Leading To Remote Code Execution (RCE)](https://agentprime.io/advisories/CVE-2025-58159.md) `CVE-2025-58159` · CVE record: LabRedesCefetRJ WeGIA · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Aug 2025 · Tags: Code injection, Unrestricted file upload - [O2OA Personal Profile widget cross site scripting](https://agentprime.io/advisories/CVE-2025-9659.md) `CVE-2025-9659` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile dict cross site scripting](https://agentprime.io/advisories/CVE-2025-9658.md) `CVE-2025-9658` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile script cross site scripting](https://agentprime.io/advisories/CVE-2025-9657.md) `CVE-2025-9657` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [PHPGurukul Directory Management System add-directory.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9656.md) `CVE-2025-9656` · CVE record: PHPGurukul Directory Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [O2OA Personal Profile person cross site scripting](https://agentprime.io/advisories/CVE-2025-9655.md) `CVE-2025-9655` · CVE record: O2OA · CVSS 5.1 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar Cadastrar projeto educar_projeto_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9653.md) `CVE-2025-9653` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar Cadastrar tipo de transferência educar_transferencia_tipo_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-9652.md) `CVE-2025-9652` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [mtons mblog list cross site scripting](https://agentprime.io/advisories/CVE-2025-9647.md) `CVE-2025-9647` · CVE record: mtons mblog · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .