# Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Amazon Web Services Advanced JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance](https://agentprime.io/advisories/GHSA-7xw4-g7mm-r4hh.md)
  `GHSA-7xw4-g7mm-r4hh` · Maven `software.amazon.jdbc:aws-advanced-jdbc-wrapper`: affected `<2.6.5`, fixed in `2.6.5` · CVSS 8.0 High · Not analysed yet · Published 13 Nov 2025 · Tags: Code injection
- [AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance](https://agentprime.io/advisories/GHSA-4jvf-wx3f-2x8q.md)
  `GHSA-4jvf-wx3f-2x8q`, `CVE-2025-12967`, `PYSEC-2026-1205` · PyPI `aws-advanced-python-wrapper`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 8.6 High · Not analysed yet · Published 13 Nov 2025 · Tags: Code injection
- [Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic](https://agentprime.io/advisories/CVE-2025-12733.md)
  `CVE-2025-12733` · CVE record: wpallimport WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets · CVSS 8.8 High · Not analysed yet · Published 13 Nov 2025 · Tags: Code injection
- [OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed](https://agentprime.io/advisories/GHSA-39hr-239p-fhqc.md)
  `GHSA-39hr-239p-fhqc`, `CVE-2025-64099` · Maven `org.openidentityplatform.openam:openam-oauth2`: affected `<16.0.3`, fixed in `16.0.3` · CVSS 8.1 High · Not analysed yet · Published 12 Nov 2025 · Tags: Other injection, Code injection
- [Code injection in Dell SmartFabric OS10 Software](https://agentprime.io/advisories/CVE-2024-48829.md)
  `CVE-2024-48829` · CVE record: Dell SmartFabric OS10 Software · CVSS 6.7 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: Code injection
- [soerennb eXtplorer Filename cross site scripting](https://agentprime.io/advisories/CVE-2025-13058.md)
  `CVE-2025-13058` · CVE record: soerennb eXtplorer · CVSS 5.1 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Code injection in NVIDIA NeMo Framework](https://agentprime.io/advisories/CVE-2025-33178.md)
  `CVE-2025-33178` · CVE record: NVIDIA NeMo Framework · CVSS 7.8 High · Not analysed yet · Published 11 Nov 2025 · Tags: Code injection
- [Code injection in NVIDIA NeMo Framework](https://agentprime.io/advisories/CVE-2025-23361.md)
  `CVE-2025-23361` · CVE record: NVIDIA NeMo Framework · CVSS 7.8 High · Not analysed yet · Published 11 Nov 2025 · Tags: Code injection
- [Code injection in NVIDIA Megatron-LM](https://agentprime.io/advisories/CVE-2025-23357.md)
  `CVE-2025-23357` · CVE record: NVIDIA Megatron-LM · CVSS 7.8 High · Not analysed yet · Published 11 Nov 2025 · Tags: Code injection
- [Elastic Theme Editor <= 0.0.3 - Authenticated (Subscriber+) Arbitrary File Upload](https://agentprime.io/advisories/CVE-2025-12637.md)
  `CVE-2025-12637` · CVE record: koopersmith Elastic Theme Editor · CVSS 8.8 High · Not analysed yet · Published 11 Nov 2025 · Tags: Code injection
- [Holiday class post calendar <= 7.1 - Unauthenticated Remote Code Execution via 'contents'](https://agentprime.io/advisories/CVE-2025-12813.md)
  `CVE-2025-12813` · CVE record: strix-bubol5 Holiday class post calendar · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Nov 2025 · Tags: Code injection
- [Code Injection vulnerability in SAP HANA JDBC Client](https://agentprime.io/advisories/CVE-2025-42895.md)
  `CVE-2025-42895` · CVE record: SAP_SE SAP HANA JDBC Client · CVSS 6.9 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Code injection
- [Code Injection vulnerability in SAP Solution Manager](https://agentprime.io/advisories/CVE-2025-42887.md)
  `CVE-2025-42887` · CVE record: SAP_SE SAP Solution Manager · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Nov 2025 · Tags: Code injection
- [qianfox FoxCMS Product.php edit cross site scripting](https://agentprime.io/advisories/CVE-2025-12920.md)
  `CVE-2025-12920` · CVE record: qianfox FoxCMS · CVSS 4.8 Medium · Not analysed yet · Published 9 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection](https://agentprime.io/advisories/CVE-2025-9334.md)
  `CVE-2025-9334` · CVE record: codesolz Better Find and Replace – AI-Powered Suggestions · CVSS 8.8 High · Not analysed yet · Published 8 Nov 2025 · Tags: Code injection
- [Ruijie Gateway EG & NBR Models v11.1(6)B9P1 - 11.9(4)B12P1 RCE](https://agentprime.io/advisories/CVE-2020-36870.md)
  `CVE-2020-36870` · CVE record: Beijing Star-Net Ruijie Network Technology Co., Ltd. RG-EG1000C and 4 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Nov 2025 · Tags: Code injection
- [Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events](https://agentprime.io/advisories/GHSA-cm35-v4vp-5xvx.md)
  `GHSA-cm35-v4vp-5xvx`, `CVE-2025-64496`, `PYSEC-2026-1729` · npm `open-webui` and 1 more: affected `<0.6.35`, fixed in `0.6.35` · CVSS 7.3 High · Not analysed yet · Published 7 Nov 2025 · Tags: Code injection, CWE-501, CWE-829, CWE-830
- [In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a paramet…](https://agentprime.io/advisories/CVE-2025-63690.md)
  `CVE-2025-63690` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Nov 2025 · Tags: Code injection
- [WordPress HAPPY plugin <= 1.0.7 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2025-49372.md)
  `CVE-2025-49372` · CVE record: VillaTheme HAPPY · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Nov 2025 · Tags: Code injection
- [WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.9 - Arbitrary Code Execution vulnerability](https://agentprime.io/advisories/CVE-2025-47588.md)
  `CVE-2025-47588` · CVE record: acowebs Dynamic Pricing With Discount Rules for WooCommerce · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Nov 2025 · Tags: Code injection
- [WordPress Widget Logic <= 6.0.5 - Remote Code Execution (RCE) Vulnerability](https://agentprime.io/advisories/CVE-2025-32222.md)
  `CVE-2025-32222` · CVE record: Widgetlogic.org Widget Logic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Nov 2025 · Tags: Code injection
- [Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)](https://agentprime.io/advisories/CVE-2025-11093.md)
  `CVE-2025-11093` · CVE record: WSO2 WSO2 Micro Integrator and 4 more · CVSS 8.4 High · Not analysed yet · Published 5 Nov 2025 · Tags: Code injection
- [expr-eval does not restrict functions passed to the evaluate function](https://agentprime.io/advisories/GHSA-jc85-fpwf-qm7x.md)
  `GHSA-jc85-fpwf-qm7x`, `CVE-2025-12735` · npm `expr-eval` and 1 more: affected `<=2.0.2`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2025 · Tags: Code injection
- [Cursor's Sensitive File Modification can Lead to NTFS Path Quirks](https://agentprime.io/advisories/CVE-2025-64108.md)
  `CVE-2025-64108` · CVE record: cursor cursor · CVSS 8.8 High · Not analysed yet · Published 4 Nov 2025 · Tags: Path traversal, Code injection
- [Xibo CMS: Remote Code Execution through module templates](https://agentprime.io/advisories/CVE-2025-62369.md)
  `CVE-2025-62369` · CVE record: xibosignage xibo-cms · CVSS 7.2 High · Not analysed yet · Published 4 Nov 2025 · Tags: Code injection
- [A remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via a crafted HTML page.](https://agentprime.io/advisories/CVE-2025-60785.md)
  `CVE-2025-60785` · CVE record · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2025 · Tags: Code injection
- [Kallyas <= 4.24.0 - Authenticated (Contributor+) Remote Code Execution](https://agentprime.io/advisories/CVE-2025-6990.md)
  `CVE-2025-6990` · CVE record: hogash KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme · CVSS 8.8 High · Not analysed yet · Published 1 Nov 2025 · Tags: Code injection
- [Advanced Ads <= 2.0.12 - Unauthenticated Limited Code Execution](https://agentprime.io/advisories/CVE-2025-10487.md)
  `CVE-2025-10487` · CVE record: monetizemore Advanced Ads – Ad Manager & AdSense · CVSS 7.3 High · Not analysed yet · Published 1 Nov 2025 · Tags: Code injection
- [LogicalDOC Community Edition API Key creation UI cross site scripting](https://agentprime.io/advisories/CVE-2025-12546.md)
  `CVE-2025-12546` · CVE record: LogicalDOC Community Edition · CVSS 5.1 Medium · Not analysed yet · Published 31 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Code injection in Veeam Backup and Replication](https://agentprime.io/advisories/CVE-2025-48984.md)
  `CVE-2025-48984` · CVE record: Veeam Backup and Replication · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2025 · Tags: Code injection
- [Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard ID](https://agentprime.io/advisories/CVE-2025-34277.md)
  `CVE-2025-34277` · CVE record: Nagios Log Server · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2025 · Tags: Code injection
- [An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter.](https://agentprime.io/advisories/CVE-2025-61196.md)
  `CVE-2025-61196` · CVE record · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2025 · Tags: Code injection
- [iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization.](https://agentprime.io/advisories/CVE-2025-50739.md)
  `CVE-2025-50739` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2025 · Tags: Code injection
- [zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.](https://agentprime.io/advisories/CVE-2025-60355.md)
  `CVE-2025-60355` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2025 · Tags: Code injection
- [alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted file upload.](https://agentprime.io/advisories/CVE-2025-56399.md)
  `CVE-2025-56399` · CVE record · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2025 · Tags: Code injection
- [code-projects E-Commerce Website supplier_update.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12335.md)
  `CVE-2025-12335` · CVE record: code-projects E-Commerce Website · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Student Grades Management System admin.php delete_user cross site scripting](https://agentprime.io/advisories/CVE-2025-12332.md)
  `CVE-2025-12332` · CVE record: SourceCodester Student Grades Management System · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects E-Commerce Website product_add.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12334.md)
  `CVE-2025-12334` · CVE record: code-projects E-Commerce Website · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects E-Commerce Website supplier_add.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12333.md)
  `CVE-2025-12333` · CVE record: code-projects E-Commerce Website · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Willow CMS Add Post add cross site scripting](https://agentprime.io/advisories/CVE-2025-12330.md)
  `CVE-2025-12330` · CVE record: Willow CMS · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [PHPGurukul Curfew e-Pass Management System view-pass-detail.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12312.md)
  `CVE-2025-12312` · CVE record: PHPGurukul Curfew e-Pass Management System · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [PHPGurukul Curfew e-Pass Management System edit-category-detail.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12311.md)
  `CVE-2025-12311` · CVE record: PHPGurukul Curfew e-Pass Management System · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [PHPGurukul Curfew e-Pass Management System admin-profile.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12303.md)
  `CVE-2025-12303` · CVE record: PHPGurukul Curfew e-Pass Management System · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Simple Food Ordering System editproduct.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12302.md)
  `CVE-2025-12302` · CVE record: code-projects Simple Food Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Simple Food Ordering System addcategory.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12300.md)
  `CVE-2025-12300` · CVE record: code-projects Simple Food Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Simple Food Ordering System addproduct.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12299.md)
  `CVE-2025-12299` · CVE record: code-projects Simple Food Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Simple Food Ordering System editcategory.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12298.md)
  `CVE-2025-12298` · CVE record: code-projects Simple Food Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 359 cross site scripting](https://agentprime.io/advisories/CVE-2025-12290.md)
  `CVE-2025-12290` · CVE record: Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1001 cross site scripting](https://agentprime.io/advisories/CVE-2025-12289.md)
  `CVE-2025-12289` · CVE record: Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Client Details System manage-users.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12282.md)
  `CVE-2025-12282` · CVE record: code-projects Client Details System · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Client Details System clientview.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12281.md)
  `CVE-2025-12281` · CVE record: code-projects Client Details System · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Client Details System update-clients.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12280.md)
  `CVE-2025-12280` · CVE record: code-projects Client Details System · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Client Details System welcome.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12279.md)
  `CVE-2025-12279` · CVE record: code-projects Client Details System · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [LearnHouse Account Setting previews cross site scripting](https://agentprime.io/advisories/CVE-2025-12269.md)
  `CVE-2025-12269` · CVE record: LearnHouse · CVSS 5.1 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [abhicodebox ModernShop search cross site scripting](https://agentprime.io/advisories/CVE-2025-12267.md)
  `CVE-2025-12267` · CVE record: abhicodebox ModernShop · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Zytec Dalian Zhuoyun Technology Central Authentication Service widget \_empty code injection](https://agentprime.io/advisories/CVE-2025-12266.md)
  `CVE-2025-12266` · CVE record: Zytec Dalian Zhuoyun Technology Central Authentication Service · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Other injection, Code injection
- [Wisencode Create Support Ticket create cross site scripting](https://agentprime.io/advisories/CVE-2025-12264.md)
  `CVE-2025-12264` · CVE record: Wisencode · CVSS 5.1 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [OpenWGA Admin UI cross site scripting](https://agentprime.io/advisories/CVE-2025-12251.md)
  `CVE-2025-12251` · CVE record: OpenWGA · CVSS 5.1 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [chatwoot Admin IframeLoader.vue cross site scripting](https://agentprime.io/advisories/CVE-2025-12246.md)
  `CVE-2025-12246` · CVE record: chatwoot · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Simple E-Banking System register.php cross site scripting](https://agentprime.io/advisories/CVE-2025-12244.md)
  `CVE-2025-12244` · CVE record: code-projects Simple E-Banking System · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Cross-site scripting (XSS), Code injection

Newest: <https://agentprime.io/advisories/tag/code-injection.md>
Older: <https://agentprime.io/advisories/tag/code-injection.md?cursor=WyIyMDI1LTEwLTI3VDA3OjMyOjA1LjEwMzAwMFoiLCJDVkUtMjAyNS0xMjI0NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=code-injection&cursor=WyIyMDI1LTExLTEzVDIyOjIyOjM0LjAwMDAwMFoiLCJHSFNBLTd3cTItMzJoNC05aGM5Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/code-injection/?cursor=WyIyMDI1LTExLTEzVDIyOjIyOjM0LjAwMDAwMFoiLCJHSFNBLTd3cTItMzJoNC05aGM5Il0>. Everything for agents: <https://agentprime.io/llms.txt>.