# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [alokjaiswal Hotel-Management-services-using-MYSQL-and-php Request Pending usersub.php cross site scripting](https://agentprime.io/advisories/CVE-2025-14200.md) `CVE-2025-14200` · CVE record: alokjaiswal Hotel-Management-services-using-MYSQL-and-php · CVSS 5.1 Medium · Not analysed yet · Published 7 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Employee Profile Management System view_personnel.php cross site scripting](https://agentprime.io/advisories/CVE-2025-14194.md) `CVE-2025-14194` · CVE record: code-projects Employee Profile Management System · CVSS 5.1 Medium · Not analysed yet · Published 7 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [TUUI vulnerable to Remote Code Execution (RCE) via XSS in Markdown ECharts Rendering](https://agentprime.io/advisories/CVE-2025-66562.md) `CVE-2025-66562` · CVE record: AI-QL tuui · CVSS 8.9 High · Not analysed yet · Published 5 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [JIZHICMS Comment addcomment.html cross site scripting](https://agentprime.io/advisories/CVE-2025-14013.md) `CVE-2025-14013` · CVE record: JIZHICMS · CVSS 4.8 Medium · Not analysed yet · Published 4 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [dayrui XunRuiCMS Domain Name Binding admin79f2ec220c7e.php cross site scripting](https://agentprime.io/advisories/CVE-2025-14007.md) `CVE-2025-14007` · CVE record: dayrui XunRuiCMS · CVSS 2.0 Low · Not analysed yet · Published 4 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [dayrui XunRuiCMS Add Data Validation admind45f74adbd95.php cross site scripting](https://agentprime.io/advisories/CVE-2025-14006.md) `CVE-2025-14006` · CVE record: dayrui XunRuiCMS · CVSS 5.1 Medium · Not analysed yet · Published 4 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [dayrui XunRuiCMS Add Display Name Field admind45f74adbd95.php cross site scripting](https://agentprime.io/advisories/CVE-2025-14005.md) `CVE-2025-14005` · CVE record: dayrui XunRuiCMS · CVSS 4.8 Medium · Not analysed yet · Published 4 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [DeepChat Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)](https://agentprime.io/advisories/CVE-2025-66222.md) `CVE-2025-66222` · CVE record: ThinkInAIXYZ deepchat · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Dec 2025 · Tags: Code injection - [Masa CMS Vulnerable to Pre-Auth RCE via JSON API](https://agentprime.io/advisories/CVE-2024-32641.md) `CVE-2024-32641` · CVE record: MasaCMS MasaCMS · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.13 · Not analysed yet · Published 3 Dec 2025 · Tags: Code injection - [Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form](https://agentprime.io/advisories/CVE-2025-13486.md) `CVE-2025-13486` · CVE record: hwk-fr Advanced Custom Fields: Extended · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.69 · Not analysed yet · Published 3 Dec 2025 · Tags: Code injection - [Industrial Video & Control Longwatch has a Code Injection vulnerability](https://agentprime.io/advisories/CVE-2025-13658.md) `CVE-2025-13658` · CVE record: Industrial Video & Control Longwatch · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Dec 2025 · Tags: Code injection - [vLLM vulnerable to remote code execution via transformers_utils/get_config](https://agentprime.io/advisories/GHSA-8fr4-5q9j-m8gm.md) `GHSA-8fr4-5q9j-m8gm`, `CVE-2025-66448`, `PYSEC-2026-2015` · PyPI `vllm`: affected `<0.11.1`, fixed in `0.11.1` · CVSS 7.1 High · Not analysed yet · Published 2 Dec 2025 · Tags: Code injection - [Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms](https://agentprime.io/advisories/GHSA-8535-hvm8-2hmv.md) `GHSA-8535-hvm8-2hmv`, `CVE-2025-66298`, `PKSA-b17c-1fcn-dgtx` · Packagist `getgrav/grav`: affected `<1.8.0-beta.27`, fixed in `1.8.0-beta.27` · CVSS 7.7 High · Not analysed yet · Published 2 Dec 2025 · Tags: Code injection - [Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass](https://agentprime.io/advisories/GHSA-662m-56v4-3r8f.md) `GHSA-662m-56v4-3r8f`, `CVE-2025-66294`, `PKSA-cyrn-zc8g-f5mw` · Packagist `getgrav/grav`: affected `<1.8.0-beta.27`, fixed in `1.8.0-beta.27` · CVSS 8.7 High · Not analysed yet · Published 2 Dec 2025 · Tags: Code injection - [Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection](https://agentprime.io/advisories/GHSA-858q-77wx-hhx6.md) `GHSA-858q-77wx-hhx6`, `CVE-2025-66297`, `PKSA-69s1-6gdk-gbrs` · Packagist `getgrav/grav`: affected `<1.8.0-beta.27`, fixed in `1.8.0-beta.27` · CVSS 7.4 High · Not analysed yet · Published 2 Dec 2025 · Tags: Code injection - [Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)](https://agentprime.io/advisories/GHSA-gjc5-8cfh-653x.md) `GHSA-gjc5-8cfh-653x`, `CVE-2025-66299`, `PKSA-83gv-619f-b6h7` · Packagist `getgrav/grav`: affected `<1.8.0-beta.27`, fixed in `1.8.0-beta.27` · CVSS 8.8 High · Not analysed yet · Published 2 Dec 2025 · Tags: Code injection - [jairiidriss RestaurantWebsite Make a Reservation cross site scripting](https://agentprime.io/advisories/CVE-2025-13802.md) `CVE-2025-13802` · CVE record: jairiidriss RestaurantWebsite · CVSS 5.3 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is re…](https://agentprime.io/advisories/CVE-2024-39148.md) `CVE-2024-39148` · CVE record · CVSS 8.1 High · Not analysed yet · Published 1 Dec 2025 · Tags: Code injection - [codingWithElias School Management System Edit Student Info student-view.php cross site scripting](https://agentprime.io/advisories/CVE-2025-13795.md) `CVE-2025-13795` · CVE record: codingWithElias School Management System · CVSS 4.8 Medium · Not analysed yet · Published 30 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [winston-dsouza Ecommerce-Website GET Parameter header_menu.php cross site scripting](https://agentprime.io/advisories/CVE-2025-13793.md) `CVE-2025-13793` · CVE record: winston-dsouza Ecommerce-Website · CVSS 5.3 Medium · Not analysed yet · Published 30 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [Qualitor getResumo.php eval code injection](https://agentprime.io/advisories/CVE-2025-13792.md) `CVE-2025-13792` · CVE record: Qualitor · CVSS 6.9 Medium · Not analysed yet · Published 30 Nov 2025 · Tags: Other injection, Code injection - [yungifez Skuul School Management System vulnerable to XSS via SVG](https://agentprime.io/advisories/GHSA-92x3-mfjp-j3h3.md) `GHSA-92x3-mfjp-j3h3`, `CVE-2025-13784`, `PKSA-222h-4358-m2cj` · Packagist `yungifez/skuul`: affected `<=2.6.5`, no fixed version yet · CVSS 4.8 Medium · Not analysed yet · Published 30 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [taosir WTCMS index.php fetch code injection](https://agentprime.io/advisories/CVE-2025-13786.md) `CVE-2025-13786` · CVE record: taosir WTCMS · CVSS 6.9 Medium · Not analysed yet · Published 30 Nov 2025 · Tags: Other injection, Code injection - [OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection](https://agentprime.io/advisories/CVE-2025-66224.md) `CVE-2025-66224` · CVE record: orangehrm orangehrm · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Nov 2025 · Tags: Code injection - [RCE in Wirtualna Uczelnia](https://agentprime.io/advisories/CVE-2025-12140.md) `CVE-2025-12140` · CVE record: Simple SA Wirtualna Uczelnia · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Nov 2025 · Tags: Code injection - [Apache CloudStack: Potential remote code execution on Javascript engine defined rules](https://agentprime.io/advisories/CVE-2025-59302.md) `CVE-2025-59302` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 4.7 Medium · Not analysed yet · Published 27 Nov 2025 · Tags: Code injection - [Template injection in Logpoint SIEM](https://agentprime.io/advisories/CVE-2025-66361.md) `CVE-2025-66361` · CVE record: Logpoint SIEM · CVSS 6.9 Medium · Not analysed yet · Published 27 Nov 2025 · Tags: Code injection - [Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack](https://agentprime.io/advisories/GHSA-q279-jhrf-cc6v.md) `GHSA-q279-jhrf-cc6v`, `CVE-2025-62593`, `PYSEC-2026-520` · PyPI `ray`: affected `<2.52.0`, fixed in `2.52.0` · CVSS 9.4 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.60 · Not analysed yet · Published 26 Nov 2025 · Tags: Code injection, Cross-site request forgery (CSRF) - [REDAXO CMS is vulnerable to RCE attack through its template management component](https://agentprime.io/advisories/GHSA-xj9j-gjxg-7jvq.md) `GHSA-xj9j-gjxg-7jvq`, `CVE-2025-64050`, `PKSA-wnfn-tqc3-fmcx` · Packagist `redaxo/source`: affected `<5.20.1`, fixed in `5.20.1` · CVSS 7.2 High · Not analysed yet · Published 25 Nov 2025 · Tags: Code injection - [esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in github.com/esm-dev/esm.sh](https://agentprime.io/advisories/GHSA-hcpf-qv9m-vfgp.md) `GHSA-hcpf-qv9m-vfgp`, `CVE-2025-65026`, `GO-2025-4139` · Go `github.com/esm-dev/esm.sh`: affected `<0.0.0-20251118065157-87d2f6497574`, fixed in `0.0.0-20251118065157-87d2f6497574` · CVSS 6.1 Medium · Not analysed yet · Published 25 Nov 2025 · Tags: Code injection - [Code injection in NVIDIA NeMo Framework](https://agentprime.io/advisories/CVE-2025-33204.md) `CVE-2025-33204` · CVE record: NVIDIA NeMo Framework · CVSS 7.8 High · Not analysed yet · Published 25 Nov 2025 · Tags: Code injection - [Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback](https://agentprime.io/advisories/CVE-2025-6389.md) `CVE-2025-6389` · CVE record: Sneeit Sneeit Framework · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.76 · Not analysed yet · Published 25 Nov 2025 · Tags: Code injection - [Eigenfocus Description cross site scripting](https://agentprime.io/advisories/CVE-2025-13584.md) `CVE-2025-13584` · CVE record: Eigenfocus · CVSS 5.1 Medium · Not analysed yet · Published 24 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [PHPGurukul Hostel Management System register-complaint.php cross site scripting](https://agentprime.io/advisories/CVE-2025-13577.md) `CVE-2025-13577` · CVE record: PHPGurukul Hostel Management System · CVSS 5.1 Medium · Not analysed yet · Published 24 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [Campcodes Complete Online Beauty Parlor Management System customer-list.php cross site scripting](https://agentprime.io/advisories/CVE-2025-13484.md) `CVE-2025-13484` · CVE record: Campcodes Complete Online Beauty Parlor Management System · CVSS 4.8 Medium · Not analysed yet · Published 20 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter](https://agentprime.io/advisories/GHSA-547r-qmjm-8hvw.md) `GHSA-547r-qmjm-8hvw`, `CVE-2025-65108` · npm `md-to-pdf`: affected `<5.2.5`, fixed in `5.2.5` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Nov 2025 · Tags: Code injection - [LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates](https://agentprime.io/advisories/GHSA-6qv9-48xg-fc7f.md) `GHSA-6qv9-48xg-fc7f`, `CVE-2025-65106`, `PYSEC-2026-1518` · PyPI `langchain-core`: affected `<0.3.80 || >=1.0.0, <1.0.7`, fixed in `0.3.80`, `1.0.7` · CVSS 8.3 High · Not analysed yet · Published 20 Nov 2025 · Tags: Code injection - [Public Knowledge Project omp/ojs Payment Instructions Setting paymentForm.tpl cross site scripting](https://agentprime.io/advisories/CVE-2025-13469.md) `CVE-2025-13469` · CVE record: Public Knowledge Project omp and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 20 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Online Shop Project register.php cross site scripting](https://agentprime.io/advisories/CVE-2025-13450.md) `CVE-2025-13450` · CVE record: SourceCodester Online Shop Project · CVSS 5.1 Medium · Not analysed yet · Published 20 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [icret EasyImages SVG Image upload.php cross site scripting](https://agentprime.io/advisories/CVE-2025-13415.md) `CVE-2025-13415` · CVE record: icret EasyImages · CVSS 5.1 Medium · Not analysed yet · Published 19 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [Campcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting](https://agentprime.io/advisories/CVE-2025-13412.md) `CVE-2025-13412` · CVE record: Campcodes Retro Basketball Shoes Online Store · CVSS 4.8 Medium · Not analysed yet · Published 19 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [Claude Code vulnerable to command execution prior to startup trust dialog](https://agentprime.io/advisories/GHSA-5hhx-v7f6-x7gv.md) `GHSA-5hhx-v7f6-x7gv`, `CVE-2025-65099` · npm `@anthropic-ai/claude-code`: affected `<1.0.39`, fixed in `1.0.39` · CVSS 7.7 High · Not analysed yet · Published 19 Nov 2025 · Tags: Code injection - [Code injection in Progress DataDirect Connect for JDBC for Amazon Redshift and others](https://agentprime.io/advisories/CVE-2025-10703.md) `CVE-2025-10703` · CVE record: Progress DataDirect Connect for JDBC for Amazon Redshift and 4 more · CVSS 8.6 High · Not analysed yet · Published 19 Nov 2025 · Tags: Code injection - [Code injection in Progress DataDirect Connect for JDBC for Amazon Redshift and others](https://agentprime.io/advisories/CVE-2025-10702.md) `CVE-2025-10702` · CVE record: Progress DataDirect Connect for JDBC for Amazon Redshift and 4 more · CVSS 8.6 High · Not analysed yet · Published 19 Nov 2025 · Tags: Code injection - [Code Snippets <= 3.9.1 - Authenticated (Contributor+) PHP Code Injection via extract() and PHP Filter Chains](https://agentprime.io/advisories/CVE-2025-13035.md) `CVE-2025-13035` · CVE record: codesnippetspro Code Snippets · CVSS 8.0 High · Not analysed yet · Published 19 Nov 2025 · Tags: Code injection - [Code injection in NVIDIA Isaac-GR00T N1.5](https://agentprime.io/advisories/CVE-2025-33184.md) `CVE-2025-33184` · CVE record: NVIDIA NVIDIA Isaac-GR00T N1.5 · CVSS 7.8 High · Not analysed yet · Published 18 Nov 2025 · Tags: Code injection - [Code injection in NVIDIA Isaac-GR00T N1.5](https://agentprime.io/advisories/CVE-2025-33183.md) `CVE-2025-33183` · CVE record: NVIDIA NVIDIA Isaac-GR00T N1.5 · CVSS 7.8 High · Not analysed yet · Published 18 Nov 2025 · Tags: Code injection - [SourceCodester Student Grades Management System Add New Grade grades.php cross site scripting](https://agentprime.io/advisories/CVE-2025-13349.md) `CVE-2025-13349` · CVE record: SourceCodester Student Grades Management System · CVSS 5.1 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Interview Management System editQuestion.php cross site scripting](https://agentprime.io/advisories/CVE-2025-13343.md) `CVE-2025-13343` · CVE record: SourceCodester Interview Management System · CVSS 5.1 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript st…](https://agentprime.io/advisories/CVE-2025-63693.md) `CVE-2025-63693` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Code injection - [Classified Listing – Classified ads & Business Directory Plugin <= 5.0.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Listing Description](https://agentprime.io/advisories/CVE-2025-7711.md) `CVE-2025-7711` · CVE record: techlabpro1 Classified Listing – AI-Powered Classified ads & Business Directory Plugin · CVSS 5.4 Medium · Not analysed yet · Published 17 Nov 2025 · Tags: Code injection - [code-projects Student Information System editprofile.php cross site scripting](https://agentprime.io/advisories/CVE-2025-13245.md) `CVE-2025-13245` · CVE record: code-projects Student Information System · CVSS 5.1 Medium · Not analysed yet · Published 16 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Student Information System register.php cross site scripting](https://agentprime.io/advisories/CVE-2025-13244.md) `CVE-2025-13244` · CVE record: code-projects Student Information System · CVSS 5.3 Medium · Not analysed yet · Published 16 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [projectsend File Editor/Custom Download Aliases cross site scripting](https://agentprime.io/advisories/CVE-2025-13232.md) `CVE-2025-13232` · CVE record: projectsend · CVSS 5.1 Medium · Not analysed yet · Published 16 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Simple Cafe Ordering System add_to_cart cross site scripting](https://agentprime.io/advisories/CVE-2025-13202.md) `CVE-2025-13202` · CVE record: code-projects Simple Cafe Ordering System · CVSS 5.1 Medium · Not analysed yet · Published 15 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage_customer cross site scripting](https://agentprime.io/advisories/CVE-2025-13186.md) `CVE-2025-13186` · CVE record: Bdtask Isshue Multi Store eCommerce Shopping Cart Solution and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 14 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [pojoin h3blog addtitle cross site scripting](https://agentprime.io/advisories/CVE-2025-13182.md) `CVE-2025-13182` · CVE record: pojoin h3blog · CVSS 5.1 Medium · Not analysed yet · Published 14 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [pojoin h3blog add cross site scripting](https://agentprime.io/advisories/CVE-2025-13181.md) `CVE-2025-13181` · CVE record: pojoin h3blog · CVSS 5.1 Medium · Not analysed yet · Published 14 Nov 2025 · Tags: Cross-site scripting (XSS), Code injection - [AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance](https://agentprime.io/advisories/GHSA-8wj8-cfxr-9374.md) `GHSA-8wj8-cfxr-9374` · npm `aws-advanced-nodejs-wrapper`: affected `<2.0.1`, fixed in `2.0.1` · CVSS 8.0 High · Not analysed yet · Published 13 Nov 2025 · Tags: Code injection - [AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance](https://agentprime.io/advisories/GHSA-7wq2-32h4-9hc9.md) `GHSA-7wq2-32h4-9hc9`, `GO-2025-4119` · Go `github.com/aws/aws-advanced-go-wrapper/auth-helpers` and 9 more: affected `<1.0.2`, fixed in `1.0.2` · CVSS 8.0 High · Not analysed yet · Published 13 Nov 2025 · Tags: Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .