# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [projectworlds Expense Management System Expense Categories create cross site scripting](https://agentprime.io/advisories/CVE-2025-12231.md) `CVE-2025-12231` · CVE record: projectworlds Expense Management System · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [projectworlds Expense Management System Currency create cross site scripting](https://agentprime.io/advisories/CVE-2025-12230.md) `CVE-2025-12230` · CVE record: projectworlds Expense Management System · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [projectworlds Expense Management System Roles Page create cross site scripting](https://agentprime.io/advisories/CVE-2025-12229.md) `CVE-2025-12229` · CVE record: projectworlds Expense Management System · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [projectworlds Expense Management System Users Page create cross site scripting](https://agentprime.io/advisories/CVE-2025-12228.md) `CVE-2025-12228` · CVE record: projectworlds Expense Management System · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [projectworlds Gate Pass Management System add-pass.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12227.md) `CVE-2025-12227` · CVE record: projectworlds Gate Pass Management System · CVSS 5.1 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [Iqbolshoh php-business-website contact.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12224.md) `CVE-2025-12224` · CVE record: Iqbolshoh php-business-website · CVSS 5.1 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2025-62959.md) `CVE-2025-62959` · CVE record: videowhisper Paid Videochat Turnkey Site · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2025 · Tags: Code injection - [Discussion Board – WordPress Forum Plugin <= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2025-8483.md) `CVE-2025-8483` · CVE record: marketingfire Discussion Board – WordPress Forum Plugin · CVSS 6.3 Medium · Not analysed yet · Published 25 Oct 2025 · Tags: Code injection - [Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws](https://agentprime.io/advisories/GHSA-227x-7mh8-3cf6.md) `GHSA-227x-7mh8-3cf6`, `CVE-2025-59823`, `GO-2025-3981` · Go `github.com/gardener/gardener-extension-provider-aws` and 3 more: affected `<1.64.0`, fixed in `1.64.0` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2025 · Tags: Code injection - [A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeover via manipulation o…](https://agentprime.io/advisories/CVE-2025-61136.md) `CVE-2025-61136` · CVE record · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2025 · Tags: Code injection - [WordPress s2Member plugin <= 250905 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2025-62023.md) `CVE-2025-62023` · CVE record: Cristián Lávaque s2Member · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2025 · Tags: Code injection - [WordPress Alone theme <= 7.8.3 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2025-60206.md) `CVE-2025-60206` · CVE record: Beplusthemes Alone · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2025 · Tags: Code injection - [WordPress WP Last Modified Info plugin <= 1.9.4 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2025-52756.md) `CVE-2025-52756` · CVE record: Sayan Datta WP Last Modified Info · CVSS 7.4 High · Not analysed yet · Published 22 Oct 2025 · Tags: Code injection - [WordPress Kalium theme <= 3.25 - Arbitrary Code Execution vulnerability](https://agentprime.io/advisories/CVE-2025-49926.md) `CVE-2025-49926` · CVE record: Laborator Kalium · CVSS 7.2 High · Not analysed yet · Published 22 Oct 2025 · Tags: Code injection - [HTML Injection in Accept-Language Header in danny-avila/librechat](https://agentprime.io/advisories/CVE-2025-8848.md) `CVE-2025-8848` · CVE record: danny-avila danny-avila/librechat · CVSS 4.8 Medium · Not analysed yet · Published 22 Oct 2025 · Tags: Code injection - [Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read](https://agentprime.io/advisories/GHSA-vffh-c9pq-4crh.md) `GHSA-vffh-c9pq-4crh` · npm `uptime-kuma`: affected `=2.0.0-dev.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2025 · Tags: Path traversal, Code injection - [ClipBucket v5 executes arbitrary PHP code](https://agentprime.io/advisories/CVE-2025-62429.md) `CVE-2025-62429` · CVE record: MacWarrior clipbucket-v5 · CVSS 7.2 High · Not analysed yet · Published 20 Oct 2025 · Tags: Code injection - [An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary code via the scrap_image.php component and the imageURL parameter](https://agentprime.io/advisories/CVE-2025-61488.md) `CVE-2025-61488` · CVE record · CVSS 7.6 High · Not analysed yet · Published 20 Oct 2025 · Tags: Code injection, Server-side request forgery (SSRF) - [LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting](https://agentprime.io/advisories/CVE-2025-11946.md) `CVE-2025-11946` · CVE record: LogicalDOC Community Edition · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [toeverything AFFiNE Avatar Upload Image Endpoint cross site scripting](https://agentprime.io/advisories/CVE-2025-11945.md) `CVE-2025-11945` · CVE record: toeverything AFFiNE · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [Duplicate Advisory: FlowiseAI Pre-Auth Arbitrary Code Execution](https://agentprime.io/advisories/GHSA-3g4j-r53p-22wx.md) `GHSA-3g4j-r53p-22wx` · npm `flowise`: affected `>=3.0.5, <3.0.6`, fixed in `3.0.6` · CVSS 9.1 Critical · Withdrawn · Not analysed yet · Published 17 Oct 2025 · Tags: Code injection - [yanyutao0402 ChanCMS gather.js getArticle code injection](https://agentprime.io/advisories/CVE-2025-11905.md) `CVE-2025-11905` · CVE record: yanyutao0402 ChanCMS · CVSS 5.3 Medium · Not analysed yet · Published 17 Oct 2025 · Tags: Other injection, Code injection - [A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory (/themes/defaut/css/minify.php).](https://agentprime.io/advisories/CVE-2025-57567.md) `CVE-2025-57567` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2025 · Tags: Code injection, Broken access control - [bagisto has Server Side Template Injection (SSTI) in Product Description](https://agentprime.io/advisories/GHSA-527q-4wqv-g9wj.md) `GHSA-527q-4wqv-g9wj`, `CVE-2025-62416`, `PKSA-tfym-n9wv-r1z9` · Packagist `bagisto/bagisto`: affected `<2.3.8`, fixed in `2.3.8` · CVSS 5.1 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: Code injection - [Apeman ID71 set_alias.cgi cross site scripting](https://agentprime.io/advisories/CVE-2025-11851.md) `CVE-2025-11851` · CVE record: Apeman ID71 · CVSS 5.1 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection](https://agentprime.io/advisories/GHSA-fwxx-wv44-7qfg.md) `GHSA-fwxx-wv44-7qfg`, `CVE-2025-41253` · Maven `org.springframework.cloud:spring-cloud-gateway-server`: affected `>=4.3.0, <4.3.2 || >=4.2.0, <4.2.6 || >=4.0.0, <=4.1.9 || <=3.1.10`, fixed in `4.3.2`, `4.2.6` · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2025 · Tags: Code injection - [F5OS vulnerability](https://agentprime.io/advisories/CVE-2025-61955.md) `CVE-2025-61955` · CVE record: F5 F5OS - Appliance and 1 more · CVSS 8.5 High · Not analysed yet · Published 15 Oct 2025 · Tags: Code injection - [WordPress Plugin is-human <= v1.4.2 Eval Injection RCE](https://agentprime.io/advisories/CVE-2011-10033.md) `CVE-2011-10033` · CVE record: is-human WordPress Plugin is-human WordPress Plugin · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2025 · Tags: Code injection - [ibi WebFOCUS - Unauthenticated RCE Vulnerability](https://agentprime.io/advisories/CVE-2025-11548.md) `CVE-2025-11548` · CVE record: ibi WebFOCUS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2025 · Tags: Code injection - [Code injection in Fortinet FortiClientMac](https://agentprime.io/advisories/CVE-2025-31365.md) `CVE-2025-31365` · CVE record: Fortinet FortiClientMac · CVSS 5.5 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Code injection - [ZTE ZXCDN product has a Struts RCE Vulnerability](https://agentprime.io/advisories/CVE-2025-46581.md) `CVE-2025-46581` · CVE record: ZTE ZXCDN · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2025 · Tags: Code injection - [Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers](https://agentprime.io/advisories/CVE-2025-41699.md) `CVE-2025-41699` · CVE record: Phoenix Contact CHARX SEC-3150 and 3 more · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2025 · Tags: Code injection - [Code Injection vulnerability in SAP Application Server for ABAP (BAPI Browser)](https://agentprime.io/advisories/CVE-2025-42901.md) `CVE-2025-42901` · CVE record: SAP_SE SAP Application Server for ABAP (BAPI Browser) · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Code injection - [Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine](https://agentprime.io/advisories/CVE-2025-37729.md) `CVE-2025-37729` · CVE record: Elastic Elastic Cloud Enterprise (ECE) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2025 · Tags: Code injection - [Happy DOM: VM Context Escape can lead to Remote Code Execution](https://agentprime.io/advisories/GHSA-37j7-fg3j-429f.md) `GHSA-37j7-fg3j-429f`, `CVE-2025-61927` · npm `happy-dom`: affected `<20.0.0`, fixed in `20.0.0` · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2025 · Tags: Code injection - [Astro's \`X-Forwarded-Host\` is reflected without validation](https://agentprime.io/advisories/GHSA-5ff5-9fcw-vg88.md) `GHSA-5ff5-9fcw-vg88`, `CVE-2025-61925` · npm `astro`: affected `<5.14.3`, fixed in `5.14.3` · CVSS 6.5 Medium · Not analysed yet · Published 10 Oct 2025 · Tags: Code injection, CWE-20 - [Cherry Studio allows one-click on a specific URL to cause a command to execute](https://agentprime.io/advisories/CVE-2025-61929.md) `CVE-2025-61929` · CVE record: CherryHQ cherry-studio · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2025 · Tags: Code injection - [pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters](https://agentprime.io/advisories/GHSA-cjjf-27cc-pvmv.md) `GHSA-cjjf-27cc-pvmv`, `CVE-2025-61773`, `PYSEC-2026-1816` · PyPI `pyload-ng`: affected `<0.5.0b3.dev91`, fixed in `0.5.0b3.dev91` · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2025 · Tags: Other injection, Cross-site scripting (XSS), Code injection, CWE-116 - [Arbitrary Code Execution in Grafana Image Renderer Plugin](https://agentprime.io/advisories/CVE-2025-11539.md) `CVE-2025-11539` · CVE record: Grafana grafana-image-renderer · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2025 · Tags: Code injection - [code-projects Voting System voters_add.php cross site scripting](https://agentprime.io/advisories/CVE-2025-11512.md) `CVE-2025-11512` · CVE record: code-projects Voting System · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Student Grades Management System Manage Users admin.php add_user cross site scripting](https://agentprime.io/advisories/CVE-2025-11485.md) `CVE-2025-11485` · CVE record: SourceCodester Student Grades Management System · CVSS 4.8 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [JhumanJ OpnForm Form Editor forms cross site scripting](https://agentprime.io/advisories/CVE-2025-11437.md) `CVE-2025-11437` · CVE record: JhumanJ OpnForm · CVSS 4.8 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [JhumanJ OpnForm submissions cross site scripting](https://agentprime.io/advisories/CVE-2025-11435.md) `CVE-2025-11435` · CVE record: JhumanJ OpnForm · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [itsourcecode Leave Management System Query Parameter controller.php redirect cross site scripting](https://agentprime.io/advisories/CVE-2025-11433.md) `CVE-2025-11433` · CVE record: itsourcecode Leave Management System · CVSS 5.1 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [projectworlds Advanced Library Management System edit_admin.php cross site scripting](https://agentprime.io/advisories/CVE-2025-11425.md) `CVE-2025-11425` · CVE record: projectworlds Advanced Library Management System · CVSS 4.8 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Voting System candidates_edit.php cross site scripting](https://agentprime.io/advisories/CVE-2025-11421.md) `CVE-2025-11421` · CVE record: code-projects Voting System · CVSS 5.1 Medium · Not analysed yet · Published 8 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [PHPGurukul Cyber Cafe Management System POST Parameter search.php cross site scripting](https://agentprime.io/advisories/CVE-2025-11390.md) `CVE-2025-11390` · CVE record: PHPGurukul Cyber Cafe Management System · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [jakowenko double-take API app.js app.use cross site scripting](https://agentprime.io/advisories/CVE-2025-11360.md) `CVE-2025-11360` · CVE record: jakowenko double-take · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [PyVista has Dependency Confusion Vulnerability in that leads to RCE](https://agentprime.io/advisories/CVE-2025-61774.md) `CVE-2025-61774` · CVE record: pyvista pyvista · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2025 · Tags: Code injection - [ILIAS Certificate Import code injection](https://agentprime.io/advisories/CVE-2025-11344.md) `CVE-2025-11344` · CVE record: ILIAS · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2025 · Tags: Other injection, Code injection - [Flowise vulnerable to RCE via Dynamic function constructor injection](https://agentprime.io/advisories/GHSA-hmgh-466j-fx4c.md) `GHSA-hmgh-466j-fx4c`, `CVE-2025-55346` · npm `flowise`: affected `<=2.2.7-patch.1`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.21 · Not analysed yet · Published 6 Oct 2025 · Tags: Code injection, CWE-627 - [langleyfcu Online Banking System Add Customer customer_add_action.php cross site scripting](https://agentprime.io/advisories/CVE-2025-11333.md) `CVE-2025-11333` · CVE record: langleyfcu Online Banking System · CVSS 4.8 Medium · Not analysed yet · Published 6 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [CmsEasy URL view.php cross site scripting](https://agentprime.io/advisories/CVE-2025-11332.md) `CVE-2025-11332` · CVE record: CmsEasy · CVSS 5.1 Medium · Not analysed yet · Published 6 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [Vanderlande Baggage 360 messages cross site scripting](https://agentprime.io/advisories/CVE-2025-11308.md) `CVE-2025-11308` · CVE record: Vanderlande Baggage 360 · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [qianfox FoxCMS Search cross site scripting](https://agentprime.io/advisories/CVE-2025-11306.md) `CVE-2025-11306` · CVE record: qianfox FoxCMS · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [ixmaps website2017 HTTP GET Request map.php cross site scripting](https://agentprime.io/advisories/CVE-2025-11291.md) `CVE-2025-11291` · CVE record: ixmaps website2017 · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [westboy CicadasCMS Template Management TemplateFileServiceImpl.java save cross site scripting](https://agentprime.io/advisories/CVE-2025-11289.md) `CVE-2025-11289` · CVE record: westboy CicadasCMS · CVSS 4.8 Medium · Not analysed yet · Published 5 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [Frappe LMS Course cross site scripting](https://agentprime.io/advisories/CVE-2025-11283.md) `CVE-2025-11283` · CVE record: Frappe LMS · CVSS 4.8 Medium · Not analysed yet · Published 5 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting](https://agentprime.io/advisories/CVE-2025-11282.md) `CVE-2025-11282` · CVE record: Frappe LMS · CVSS 4.8 Medium · Not analysed yet · Published 5 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection - [AllStarLink Supermon AllMon2 cross site scripting](https://agentprime.io/advisories/CVE-2025-11278.md) `CVE-2025-11278` · CVE record: AllStarLink Supermon · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .