# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Portabilis i-Educar agenda_preferencias.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10605.md) `CVE-2025-10605` · CVE record: Portabilis i-Educar · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar Editar Função educar_funcao_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10591.md) `CVE-2025-10591` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_usuario_det.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10590.md) `CVE-2025-10590` · CVE record: Portabilis i-Educar · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection](https://agentprime.io/advisories/CVE-2025-10057.md) `CVE-2025-10057` · CVE record: smackcoders WP Import – Ultimate CSV XML Importer for WordPress · CVSS 8.8 High · Not analysed yet · Published 17 Sept 2025 · Tags: Code injection - [Portabilis i-Educar educar_calendario_anotacao_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10584.md) `CVE-2025-10584` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Campcodes Grocery Sales and Inventory System index.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10566.md) `CVE-2025-10566` · CVE record: Campcodes Grocery Sales and Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Spring Expression language property modification using Spring Cloud Gateway Server WebFlux](https://agentprime.io/advisories/GHSA-q2cj-h8fw-q4cc.md) `GHSA-q2cj-h8fw-q4cc`, `CVE-2025-41243` · Maven `org.springframework.cloud:spring-cloud-gateway-server-webflux`: affected `>=3.1.0, <=3.1.10 || >=4.0.0, <=4.1.10 || >=4.2.0, <4.2.5 || >=4.3.0, <4.3.1`, fixed in `4.2.5`, `4.3.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2025 · Tags: Code injection - [pojoin h3blog HTTP Header login ppt_log cross site scripting](https://agentprime.io/advisories/CVE-2025-10485.md) `CVE-2025-10485` · CVE record: pojoin h3blog · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Flowise has Remote Code Execution vulnerability](https://agentprime.io/advisories/GHSA-3gcm-f6qx-ff7p.md) `GHSA-3gcm-f6qx-ff7p`, `CVE-2025-59528` · npm `flowise`: affected `>=3.0.5, <3.0.6`, fixed in `3.0.6` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.92 · Not analysed yet · Published 15 Sept 2025 · Tags: Code injection - [FlowiseAI Pre-Auth Arbitrary Code Execution](https://agentprime.io/advisories/GHSA-7944-7c6r-55vv.md) `GHSA-7944-7c6r-55vv`, `CVE-2025-57164` · npm `flowise`: affected `>=3.0.5, <3.0.6`, fixed in `3.0.6` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2025 · Tags: Command injection, Code injection - [IbuyuCMS Add Article article.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10434.md) `CVE-2025-10434` · CVE record: IbuyuCMS · CVSS 4.8 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [itsourcecode E-Logbook with Health Monitoring System for COVID-19 POST Request check_profile.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10411.md) `CVE-2025-10411` · CVE record: itsourcecode E-Logbook with Health Monitoring System for COVID-19 · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [fcba_zzm ics-park Smart Park Management System Scheduled Task JobController.java code injection](https://agentprime.io/advisories/CVE-2025-10394.md) `CVE-2025-10394` · CVE record: fcba_zzm ics-park Smart Park Management System · CVSS 5.1 Medium · Not analysed yet · Published 14 Sept 2025 · Tags: Other injection, Code injection - [Selleo Mentingo Create New Course Basic Settings enroll-course cross site scripting](https://agentprime.io/advisories/CVE-2025-10388.md) `CVE-2025-10388` · CVE record: Selleo Mentingo · CVSS 5.1 Medium · Not analysed yet · Published 14 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Yida ECMS Consulting Enterprise Management System POST Request login.do cross site scripting](https://agentprime.io/advisories/CVE-2025-10386.md) `CVE-2025-10386` · CVE record: Yida ECMS Consulting Enterprise Management System · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_turma_tipo_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10373.md) `CVE-2025-10373` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar educar_modulo_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10372.md) `CVE-2025-10372` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [MiczFlor RPi-Jukebox-RFID userScripts.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10370.md) `CVE-2025-10370` · CVE record: MiczFlor RPi-Jukebox-RFID · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [MiczFlor RPi-Jukebox-RFID cardRegisterNew.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10369.md) `CVE-2025-10369` · CVE record: MiczFlor RPi-Jukebox-RFID · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [MiczFlor RPi-Jukebox-RFID manageFilesFolders.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10368.md) `CVE-2025-10368` · CVE record: MiczFlor RPi-Jukebox-RFID · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [MiczFlor RPi-Jukebox-RFID cardEdit.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10367.md) `CVE-2025-10367` · CVE record: MiczFlor RPi-Jukebox-RFID · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [MiczFlor RPi-Jukebox-RFID inc.setWlanIpMail.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10366.md) `CVE-2025-10366` · CVE record: MiczFlor RPi-Jukebox-RFID · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [WhatCD Gazelle Commit Message change_log.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10340.md) `CVE-2025-10340` · CVE record: WhatCD Gazelle · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [cdevroe unmark info.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10332.md) `CVE-2025-10332` · CVE record: cdevroe unmark · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [cdevroe unmark Marks.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10331.md) `CVE-2025-10331` · CVE record: cdevroe unmark · CVSS 5.1 Medium · Not analysed yet · Published 13 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [cdevroe unmark searchform.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10330.md) `CVE-2025-10330` · CVE record: cdevroe unmark · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [erjinzhi 10OA item cross site scripting](https://agentprime.io/advisories/CVE-2025-10274.md) `CVE-2025-10274` · CVE record: erjinzhi 10OA · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [erjinzhi 10OA catalogue cross site scripting](https://agentprime.io/advisories/CVE-2025-10272.md) `CVE-2025-10272` · CVE record: erjinzhi 10OA · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [erjinzhi 10OA finder cross site scripting](https://agentprime.io/advisories/CVE-2025-10271.md) `CVE-2025-10271` · CVE record: erjinzhi 10OA · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [AIRI's character card/chat UI is vulnerable to XSS and can lead to RCE](https://agentprime.io/advisories/CVE-2025-59053.md) `CVE-2025-59053` · CVE record: moeru-ai airi · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2025 · Tags: Code injection - [Ascensio System SIA OnlyOffice Comment Messages.aspx cross site scripting](https://agentprime.io/advisories/CVE-2025-10255.md) `CVE-2025-10255` · CVE record: Ascensio System SIA OnlyOffice · CVSS 5.1 Medium · Not analysed yet · Published 11 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Ascensio System SIA OnlyOffice SVG Image Messages.aspx cross site scripting](https://agentprime.io/advisories/CVE-2025-10254.md) `CVE-2025-10254` · CVE record: Ascensio System SIA OnlyOffice · CVSS 5.1 Medium · Not analysed yet · Published 11 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [openDCIM SVG File uploadifive.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10253.md) `CVE-2025-10253` · CVE record: openDCIM · CVSS 5.1 Medium · Not analysed yet · Published 11 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Catalog Importer, Scraper & Crawler <= 5.1.4 - Unauthenticated PHP Code Injection](https://agentprime.io/advisories/CVE-2025-8417.md) `CVE-2025-8417` · CVE record: idiatech Catalog Importer, Scraper & Crawler · CVSS 8.1 High · Not analysed yet · Published 11 Sept 2025 · Tags: Code injection - [lokibhardwaj PHP-Code-For-Unlimited-File-Upload f.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10246.md) `CVE-2025-10246` · CVE record: lokibhardwaj PHP-Code-For-Unlimited-File-Upload · CVSS 5.1 Medium · Not analysed yet · Published 11 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Scada-LTS Reports reports.shtm cross site scripting](https://agentprime.io/advisories/CVE-2025-10235.md) `CVE-2025-10235` · CVE record: Scada-LTS · CVSS 4.8 Medium · Not analysed yet · Published 11 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Scada-LTS Data Point Edit data_point_edit.shtm cross site scripting](https://agentprime.io/advisories/CVE-2025-10234.md) `CVE-2025-10234` · CVE record: Scada-LTS · CVSS 4.8 Medium · Not analysed yet · Published 10 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [PyInstaller has local privilege escalation vulnerability](https://agentprime.io/advisories/GHSA-p2xp-xx3r-mffc.md) `GHSA-p2xp-xx3r-mffc`, `CVE-2025-59042`, `PYSEC-2026-1813` · PyPI `pyinstaller`: affected `<6.0.0`, fixed in `6.0.0` · CVSS 7.0 High · Not analysed yet · Published 10 Sept 2025 · Tags: Code injection - [Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email](https://agentprime.io/advisories/GHSA-j4h9-wv2m-wrf7.md) `GHSA-j4h9-wv2m-wrf7`, `CVE-2025-59041` · npm `@anthropic-ai/claude-code`: affected `<1.0.105`, fixed in `1.0.105` · CVSS 8.7 High · Not analysed yet · Published 10 Sept 2025 · Tags: Command injection, Code injection - [Claude Code rg vulnerability does not protect against approval prompt bypass](https://agentprime.io/advisories/GHSA-qxfv-fcpc-w36x.md) `GHSA-qxfv-fcpc-w36x`, `CVE-2025-58764` · npm `@anthropic-ai/claude-code`: affected `<1.0.105`, fixed in `1.0.105` · CVSS 8.7 High · Not analysed yet · Published 10 Sept 2025 · Tags: Code injection - [DeepChat's Mermaid rendering has XSS leading to RCE](https://agentprime.io/advisories/CVE-2025-58768.md) `CVE-2025-58768` · CVE record: ThinkInAIXYZ deepchat · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2025 · Tags: Code injection - [XWiki Remote Macros vulnerable to remote code execution using the panel macro](https://agentprime.io/advisories/CVE-2025-55728.md) `CVE-2025-55728` · CVE record: xwikisas xwiki-pro-macros · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2025 · Tags: Code injection - [XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macro](https://agentprime.io/advisories/CVE-2025-55727.md) `CVE-2025-55727` · CVE record: xwikisas xwiki-pro-macros · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2025 · Tags: Code injection - [AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automatio…](https://agentprime.io/advisories/CVE-2025-9539.md) `CVE-2025-9539` · CVE record: rubengc AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress · CVSS 8.0 High · Not analysed yet · Published 9 Sept 2025 · Tags: Code injection - [WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names](https://agentprime.io/advisories/CVE-2025-9489.md) `CVE-2025-9489` · CVE record: cbutlerjr WP-Members Membership Plugin · CVSS 5.0 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: Code injection - [Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)](https://agentprime.io/advisories/CVE-2025-42922.md) `CVE-2025-42922` · CVE record: SAP_SE SAP NetWeaver AS Java (Deploy Web Service) · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2025 · Tags: Code injection - [SourceCodester Simple To-Do List System Add New Task fetch_tasks.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10117.md) `CVE-2025-10117` · CVE record: SourceCodester Simple To-Do List System · CVSS 5.1 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [WeGIA has a bypass for the fix for CVE-2025-22133 - Arbitrary File Upload leads to Remote Code Execution (RCE)](https://agentprime.io/advisories/CVE-2025-58745.md) `CVE-2025-58745` · CVE record: LabRedesCefetRJ WeGIA · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2025 · Tags: Code injection, Unrestricted file upload - [MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server](https://agentprime.io/advisories/GHSA-g9hg-qhmf-q45m.md) `GHSA-g9hg-qhmf-q45m`, `CVE-2025-58444` · npm `@modelcontextprotocol/inspector`: affected `<0.16.6`, fixed in `0.16.6` · CVSS 8.6 High · Not analysed yet · Published 8 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection, CWE-84 - [XWiki Blog Application: Privilege Escalation (PR) from account through blog content](https://agentprime.io/advisories/GHSA-gwj6-xpfg-pxwr.md) `GHSA-gwj6-xpfg-pxwr`, `CVE-2025-58365` · Maven `org.xwiki.contrib.blog:application-blog-ui`: affected `<9.14`, fixed in `9.14` · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2025 · Tags: Code injection, Privilege escalation - [SimStudioAI: A function in route.ts is vulnerable to Code Injection](https://agentprime.io/advisories/GHSA-g4c9-f287-64xg.md) `GHSA-g4c9-f287-64xg`, `CVE-2025-10097` · npm `simstudio`: affected `<=0.1.19`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2025 · Tags: Other injection, Code injection - [Portabilis i-Educar Editar usuário educar_usuario_cad.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10099.md) `CVE-2025-10099` · CVE record: Portabilis i-Educar · CVSS 4.8 Medium · Not analysed yet · Published 8 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Time Tracker index.html cross site scripting](https://agentprime.io/advisories/CVE-2025-10088.md) `CVE-2025-10088` · CVE record: SourceCodester Time Tracker · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Online Polling System manage-profile.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10075.md) `CVE-2025-10075` · CVE record: SourceCodester Online Polling System · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar tipos cross site scripting](https://agentprime.io/advisories/CVE-2025-10074.md) `CVE-2025-10074` · CVE record: Portabilis i-Educar · CVSS 5.1 Medium · Not analysed yet · Published 8 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [rsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc.](https://agentprime.io/advisories/CVE-2025-57141.md) `CVE-2025-57141` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2025 · Tags: Code injection - [itsourcecode POS Point of Sale System empty_table.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10067.md) `CVE-2025-10067` · CVE record: itsourcecode POS Point of Sale System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [itsourcecode POS Point of Sale System dymanic_table.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10066.md) `CVE-2025-10066` · CVE record: itsourcecode POS Point of Sale System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [itsourcecode POS Point of Sale System dom_data_th.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10065.md) `CVE-2025-10065` · CVE record: itsourcecode POS Point of Sale System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [itsourcecode POS Point of Sale System dom_data_two_headers.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10064.md) `CVE-2025-10064` · CVE record: itsourcecode POS Point of Sale System · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .