# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Rebuild Comment/Guestbook cross site scripting](https://agentprime.io/advisories/CVE-2025-11276.md) `CVE-2025-11276` · CVE record: Rebuild · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [Eidos: One-click Remote Code Execution through Custom URL Handling](https://agentprime.io/advisories/CVE-2025-54374.md) `CVE-2025-54374` · CVE record: mayneyao eidos · CVSS 8.8 High · Not analysed yet · Published 3 Oct 2025 · Tags: Code injection - [Redis: Authenticated users can execute LUA scripts as a different user](https://agentprime.io/advisories/CVE-2025-46818.md) `CVE-2025-46818` · CVE record: redis redis · CVSS 6.0 Medium · Not analysed yet · Published 3 Oct 2025 · Tags: Code injection - [Cursor CLI Agent: Sensitive File Overwrite Bypass](https://agentprime.io/advisories/CVE-2025-61593.md) `CVE-2025-61593` · CVE record: cursor cursor · CVSS 7.1 High · Not analysed yet · Published 3 Oct 2025 · Tags: Code injection, CWE-178 - [Cursor is vulnerable to RCE via .code-workspace files using Prompt Injection](https://agentprime.io/advisories/CVE-2025-61590.md) `CVE-2025-61590` · CVE record: cursor cursor · CVSS 7.5 High · Not analysed yet · Published 3 Oct 2025 · Tags: Code injection - [Claude Code can execute commands prior to the startup trust dialog](https://agentprime.io/advisories/GHSA-4fgq-fpq9-mr3g.md) `GHSA-4fgq-fpq9-mr3g`, `CVE-2025-59536` · npm `@anthropic-ai/claude-code`: affected `<1.0.111`, fixed in `1.0.111` · CVSS 8.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.25 · Not analysed yet · Published 3 Oct 2025 · Tags: Code injection - [Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation](https://agentprime.io/advisories/CVE-2025-7825.md) `CVE-2025-7825` · CVE record: wpt00ls Schema Plugin For Divi, Gutenberg & Shortcodes · CVSS 6.3 Medium · Not analysed yet · Published 3 Oct 2025 · Tags: Code injection - [Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns](https://agentprime.io/advisories/GHSA-w2hg-2v4p-vmh6.md) `GHSA-w2hg-2v4p-vmh6`, `CVE-2025-54287`, `GO-2025-4004` · Go `github.com/lxc/lxd`: affected `>=0.0.0-20200331193331-03aab09f5b5c, <0.0.0-20250827065555-0494f5d47e41 || >=4.0.0, <5.21.4 || >=6.0.0, <6.5.0`, fixed in `0.0.0-20250827065555-0494f5d47e41`, `5.21.4`, `6.5.0` · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2025 · Tags: Code injection - [Dolibarr vulnerable to RCE via the computed field parameter](https://agentprime.io/advisories/GHSA-27hj-48r9-x2vx.md) `GHSA-27hj-48r9-x2vx`, `CVE-2025-56588`, `PKSA-shmy-ndn8-n6b3` · Packagist `dolibarr/dolibarr`: affected `<21.0.3`, fixed in `21.0.3` · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2025 · Tags: Code injection - [risc0 vulnerable to arbitrary code execution in guest via memory safety failure in \`sys_read\`](https://agentprime.io/advisories/GHSA-jqq4-c7wq-36h7.md) `GHSA-jqq4-c7wq-36h7`, `CVE-2025-61588` · crates.io `risc0-aggregation` and 3 more: affected `<0.9`, fixed in `0.9` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2025 · Tags: Code injection - [JIT miscompilation in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2025-11153.md) `CVE-2025-11153` · CVE record: Mozilla Firefox · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2025 · Tags: Code injection - [Knowage Contains a Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-59954.md) `CVE-2025-59954` · CVE record: KnowageLabs Knowage-Server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2025 · Tags: Code injection - [MinIO Java Client XML Tag Value Substitution Vulnerability](https://agentprime.io/advisories/GHSA-h7rh-xfpj-hpcm.md) `GHSA-h7rh-xfpj-hpcm`, `CVE-2025-59952` · Maven `io.minio:minio`: affected `<8.6.0`, fixed in `8.6.0` · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2025 · Tags: Other injection, Code injection, CWE-20 - [Gstarsoft GstarCAD File Renaming cross site scripting](https://agentprime.io/advisories/CVE-2025-11137.md) `CVE-2025-11137` · CVE record: Gstarsoft GstarCAD · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Cudy TR1200 Wireless Settings config cross site scripting](https://agentprime.io/advisories/CVE-2025-11134.md) `CVE-2025-11134` · CVE record: Cudy TR1200 · CVSS 4.8 Medium · Not analysed yet · Published 29 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [langleyfcu Online Banking System Error Message connection_error.php cross site scripting](https://agentprime.io/advisories/CVE-2025-11125.md) `CVE-2025-11125` · CVE record: langleyfcu Online Banking System · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Project Monitoring System postjob.php cross site scripting](https://agentprime.io/advisories/CVE-2025-11124.md) `CVE-2025-11124` · CVE record: code-projects Project Monitoring System · CVSS 5.1 Medium · Not analysed yet · Published 28 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [itsourcecode Hostel Management System POST Request index.php cross site scripting](https://agentprime.io/advisories/CVE-2025-11119.md) `CVE-2025-11119` · CVE record: itsourcecode Hostel Management System · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [PHPGurukul Employee Record Management System myprofile.php cross site scripting](https://agentprime.io/advisories/CVE-2025-11112.md) `CVE-2025-11112` · CVE record: PHPGurukul Employee Record Management System · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [westboy CicadasCMS Add Department save cross site scripting](https://agentprime.io/advisories/CVE-2025-11069.md) `CVE-2025-11069` · CVE record: westboy CicadasCMS · CVSS 4.8 Medium · Not analysed yet · Published 27 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [westboy CicadasCMS save cross site scripting](https://agentprime.io/advisories/CVE-2025-11068.md) `CVE-2025-11068` · CVE record: westboy CicadasCMS · CVSS 4.8 Medium · Not analysed yet · Published 27 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Projectworlds Visitor Management System Add Visitor myform.php cross site scripting](https://agentprime.io/advisories/CVE-2025-11067.md) `CVE-2025-11067` · CVE record: Projectworlds Visitor Management System · CVSS 4.8 Medium · Not analysed yet · Published 27 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [givanz Vvveb SVG File cross site scripting](https://agentprime.io/advisories/CVE-2025-11027.md) `CVE-2025-11027` · CVE record: givanz Vvveb · CVSS 4.8 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Total.js CMS Files Menu cross site scripting](https://agentprime.io/advisories/CVE-2025-11019.md) `CVE-2025-11019` · CVE record: Total.js CMS · CVSS 4.8 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2025-60114.md) `CVE-2025-60114` · CVE record: YayCommerce YayCurrency · CVSS 6.6 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Code injection - [MuYuCMS Template Management admin.php code injection](https://agentprime.io/advisories/CVE-2025-10993.md) `CVE-2025-10993` · CVE record: MuYuCMS · CVSS 5.1 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Other injection, Code injection - [Hutool allows remote code execution (RCE) via the QLExpressEngine class](https://agentprime.io/advisories/GHSA-gcfh-36x4-mgj6.md) `GHSA-gcfh-36x4-mgj6`, `CVE-2025-56769` · Maven `cn.hutool:hutool-extra`: affected `<5.8.40`, fixed in `5.8.40` · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Command injection, Code injection - [Changsha Developer Technology iView Editor Markdown cross site scripting](https://agentprime.io/advisories/CVE-2025-10949.md) `CVE-2025-10949` · CVE record: Changsha Developer Technology iView Editor · CVSS 4.8 Medium · Not analysed yet · Published 25 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [nuz007 smsboom dy.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10946.md) `CVE-2025-10946` · CVE record: nuz007 smsboom · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [nuz007 smsboom d.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10945.md) `CVE-2025-10945` · CVE record: nuz007 smsboom · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [yi-ge get-header-ip ip.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10944.md) `CVE-2025-10944` · CVE record: yi-ge get-header-ip · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [MikeCen WeChat-Face-Recognition wx.php valid cross site scripting](https://agentprime.io/advisories/CVE-2025-10943.md) `CVE-2025-10943` · CVE record: MikeCen WeChat-Face-Recognition · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Total.js CMS Layout admin layouts_save cross site scripting](https://agentprime.io/advisories/CVE-2025-10940.md) `CVE-2025-10940` · CVE record: Total.js CMS · CVSS 4.8 Medium · Not analysed yet · Published 25 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-59251.md) `CVE-2025-59251` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 7.6 High · Not analysed yet · Published 24 Sept 2025 · Tags: Code injection, Memory corruption - [Mangati NovoSGA XSS vulnerability in /admin](https://agentprime.io/advisories/GHSA-4c44-r8rm-3p39.md) `GHSA-4c44-r8rm-3p39`, `CVE-2025-10909`, `PKSA-1ybz-1mq4-2csr` · Packagist `novosga/novosga`: affected `<=2.2.9`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 24 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive](https://agentprime.io/advisories/CVE-2025-48868.md) `CVE-2025-48868` · CVE record: horilla-opensource horilla · CVSS 7.2 High · Not analysed yet · Published 24 Sept 2025 · Tags: Code injection - [Code injection in NVIDIA Megatron-LM](https://agentprime.io/advisories/CVE-2025-23354.md) `CVE-2025-23354` · CVE record: NVIDIA Megatron-LM · CVSS 7.8 High · Not analysed yet · Published 24 Sept 2025 · Tags: Code injection - [Code injection in NVIDIA Megatron-LM](https://agentprime.io/advisories/CVE-2025-23353.md) `CVE-2025-23353` · CVE record: NVIDIA Megatron-LM · CVSS 7.8 High · Not analysed yet · Published 24 Sept 2025 · Tags: Code injection - [Code injection in NVIDIA Megatron-LM](https://agentprime.io/advisories/CVE-2025-23349.md) `CVE-2025-23349` · CVE record: NVIDIA Megatron-LM · CVSS 7.8 High · Not analysed yet · Published 24 Sept 2025 · Tags: Code injection - [Code injection in NVIDIA Megatron-LM](https://agentprime.io/advisories/CVE-2025-23348.md) `CVE-2025-23348` · CVE record: NVIDIA Megatron-LM · CVSS 7.8 High · Not analysed yet · Published 24 Sept 2025 · Tags: Code injection - [Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service](https://agentprime.io/advisories/CVE-2025-5717.md) `CVE-2025-5717` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: Code injection - [WPCasa <= 1.4.1 - Unauthenticated Code Injection](https://agentprime.io/advisories/CVE-2025-9321.md) `CVE-2025-9321` · CVE record: wpsight WPCasa · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2025 · Tags: Code injection - [code-projects Simple Food Ordering System order.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10837.md) `CVE-2025-10837` · CVE record: code-projects Simple Food Ordering System · CVSS 5.1 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Advanced Views – Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI](https://agentprime.io/advisories/CVE-2025-10380.md) `CVE-2025-10380` · CVE record: wplakeorg Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2025 · Tags: Code injection - [PHPJabbers Restaurant Menu Maker preview.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10827.md) `CVE-2025-10827` · CVE record: PHPJabbers Restaurant Menu Maker · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [WordPress WP User Frontend Plugin <= 4.1.12 - Content Injection Vulnerability](https://agentprime.io/advisories/CVE-2025-58673.md) `CVE-2025-58673` · CVE record: weDevs WP User Frontend · CVSS 5.4 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Code injection - [PHPGurukul Car Rental Project search.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10794.md) `CVE-2025-10794` · CVE record: PHPGurukul Car Rental Project · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint.](https://agentprime.io/advisories/CVE-2025-57439.md) `CVE-2025-57439` · CVE record · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2025 · Tags: Code injection - [htmly Custom Field post cross site scripting](https://agentprime.io/advisories/CVE-2025-10758.md) `CVE-2025-10758` · CVE record: htmly · CVSS 4.8 Medium · Not analysed yet · Published 21 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [07FLYCMS/07FLY-CMS/07FlyCRM Login cross site scripting](https://agentprime.io/advisories/CVE-2025-10711.md) `CVE-2025-10711` · CVE record: 07FLYCMS and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [07FLYCMS/07FLY-CMS/07FlyCRM index.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10710.md) `CVE-2025-10710` · CVE record: 07FLYCMS and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature.](https://agentprime.io/advisories/CVE-2025-57644.md) `CVE-2025-57644` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Sept 2025 · Tags: Path traversal, Code injection, Server-side request forgery (SSRF), CWE-20 - [Server-side template injection (SSTI) vulnerability in PPress 0.0.9 allows attackers to execute arbitrary code via crafted themes.](https://agentprime.io/advisories/CVE-2025-54815.md) `CVE-2025-54815` · CVE record · CVSS 8.8 High · Not analysed yet · Published 19 Sept 2025 · Tags: Code injection - [wangchenyi1996 chat_forum q.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10642.md) `CVE-2025-10642` · CVE record: wangchenyi1996 chat_forum · CVSS 5.1 Medium · Not analysed yet · Published 18 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [itsourcecode Online Petshop Management System Admin Dashboard availableframe.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10632.md) `CVE-2025-10632` · CVE record: itsourcecode Online Petshop Management System · CVSS 5.1 Medium · Not analysed yet · Published 18 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [itsourcecode Online Petshop Management System Available Products addcnp.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10631.md) `CVE-2025-10631` · CVE record: itsourcecode Online Petshop Management System · CVSS 5.1 Medium · Not analysed yet · Published 18 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [jinjava has Sandbox Bypass via JavaType-Based Deserialization](https://agentprime.io/advisories/GHSA-m49c-g9wr-hv6v.md) `GHSA-m49c-g9wr-hv6v`, `CVE-2025-59340` · Maven `com.hubspot.jinjava:jinjava`: affected `>=2.8.0, <2.8.1 || >=2.7.0, <2.7.5`, fixed in `2.8.1`, `2.7.5` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2025 · Tags: Code injection - [itsourcecode E-Logbook with Health Monitoring System for COVID-19 print_reports_prev.php cross site scripting](https://agentprime.io/advisories/CVE-2025-10614.md) `CVE-2025-10614` · CVE record: itsourcecode E-Logbook with Health Monitoring System for COVID-19 · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Portabilis i-Educar ConfiguracaoMovimentoGeral cross site scripting](https://agentprime.io/advisories/CVE-2025-10606.md) `CVE-2025-10606` · CVE record: Portabilis i-Educar · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [Dyad Vulnerable to Remote Code Execution via Top-level Navigation in Preview Window](https://agentprime.io/advisories/CVE-2025-58766.md) `CVE-2025-58766` · CVE record: dyad-sh dyad · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2025 · Tags: Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .