# Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [ZZCMS Backend Website Settings siteconfig.php stripfxg code injection](https://agentprime.io/advisories/CVE-2025-14837.md)
  `CVE-2025-14837` · CVE record: ZZCMS · CVSS 5.1 Medium · Not analysed yet · Published 17 Dec 2025 · Tags: Other injection, Code injection
- [ChurchCRM has unauthenticated RCE in its Install Wizard](https://agentprime.io/advisories/CVE-2025-62521.md)
  `CVE-2025-62521` · CVE record: ChurchCRM CRM · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Dec 2025 · Tags: Code injection
- [Pagekit CMS is vulnerable to OS Command Injection via Storage component](https://agentprime.io/advisories/GHSA-m4f2-xpfq-h97v.md)
  `GHSA-m4f2-xpfq-h97v`, `CVE-2025-67164`, `PKSA-jj4g-dt34-dwmv` · Packagist `pagekit/pagekit`: affected `<=1.0.18`, no fixed version yet · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Dec 2025 · Tags: Command injection, Code injection, Unrestricted file upload
- [xiweicheng TMS create createComment cross site scripting](https://agentprime.io/advisories/CVE-2025-14801.md)
  `CVE-2025-14801` · CVE record: xiweicheng TMS · CVSS 4.8 Medium · Not analysed yet · Published 17 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller](https://agentprime.io/advisories/CVE-2025-14700.md)
  `CVE-2025-14700` · CVE record: Arcadia Technology, LLC Crafty Controller · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Dec 2025 · Tags: Code injection
- [RiteCMS v3.1.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the parse_special_tags() function.](https://agentprime.io/advisories/CVE-2025-67172.md)
  `CVE-2025-67172` · CVE record · CVSS 7.2 High · Not analysed yet · Published 17 Dec 2025 · Tags: Command injection, Code injection
- [Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI).](https://agentprime.io/advisories/CVE-2022-23851.md)
  `CVE-2022-23851` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Dec 2025 · Tags: Code injection
- [Code injection in Claris FileMaker Server](https://agentprime.io/advisories/CVE-2025-46295.md)
  `CVE-2025-46295` · CVE record: Claris FileMaker Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Dec 2025 · Tags: Code injection
- [Code injection in Hewlett Packard Enterprise (HPE) HPE OneView](https://agentprime.io/advisories/CVE-2025-37164.md)
  `CVE-2025-37164` · CVE record: Hewlett Packard Enterprise (HPE) HPE OneView · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.90 · Not analysed yet · Published 16 Dec 2025 · Tags: Code injection
- [Mermaid XSS vulnerability leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2025-67744.md)
  `CVE-2025-67744` · CVE record: ThinkInAIXYZ deepchat · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Dec 2025 · Tags: Code injection
- [Fickling has Code Injection vulnerability via pty.spawn()](https://agentprime.io/advisories/GHSA-r7v6-mfhq-g3m2.md)
  `GHSA-r7v6-mfhq-g3m2`, `CVE-2025-67748`, `PYSEC-2025-113` · PyPI `fickling`: affected `<0.1.6`, fixed in `0.1.6` · CVSS 7.1 High · Not analysed yet · Published 15 Dec 2025 · Tags: Code injection, Insecure deserialization, CWE-184
- [CTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine](https://agentprime.io/advisories/CVE-2025-14731.md)
  `CVE-2025-14731` · CVE record: CTCMS Content Management System · CVSS 5.3 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Code injection, CWE-791
- [CTCMS Content Management System Backend System Configuration Ct_Config.php code injection](https://agentprime.io/advisories/CVE-2025-14730.md)
  `CVE-2025-14730` · CVE record: CTCMS Content Management System · CVSS 5.1 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Other injection, Code injection
- [CTCMS Content Management System Backend App Configuration Ct_App.php save code injection](https://agentprime.io/advisories/CVE-2025-14729.md)
  `CVE-2025-14729` · CVE record: CTCMS Content Management System · CVSS 5.1 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Other injection, Code injection
- [vion707 DMadmin Backend AddonsController.class.php add cross site scripting](https://agentprime.io/advisories/CVE-2025-14722.md)
  `CVE-2025-14722` · CVE record: vion707 DMadmin · CVSS 4.8 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Zomplog 3.9 Remote Code Execution via Authenticated File Manipulation](https://agentprime.io/advisories/CVE-2023-53888.md)
  `CVE-2023-53888` · CVE record: Zomplog Zomplog · CVSS 8.6 High · Not analysed yet · Published 15 Dec 2025 · Tags: Code injection
- [Webedition CMS v2.9.8.8 Remote Code Execution via PHP Page Creation](https://agentprime.io/advisories/CVE-2023-53883.md)
  `CVE-2023-53883` · CVE record: Webedition Webedition CMS · CVSS 8.6 High · Not analysed yet · Published 15 Dec 2025 · Tags: Code injection
- [A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism.](https://agentprime.io/advisories/CVE-2025-66438.md)
  `CVE-2025-66438` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Dec 2025 · Tags: Code injection
- [An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0.](https://agentprime.io/advisories/CVE-2025-66437.md)
  `CVE-2025-66437` · CVE record · CVSS 8.8 High · Not analysed yet · Published 15 Dec 2025 · Tags: Code injection
- [An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0.](https://agentprime.io/advisories/CVE-2025-66436.md)
  `CVE-2025-66436` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Code injection
- [An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0.](https://agentprime.io/advisories/CVE-2025-66435.md)
  `CVE-2025-66435` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Code injection
- [An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0.](https://agentprime.io/advisories/CVE-2025-66434.md)
  `CVE-2025-66434` · CVE record · CVSS 8.8 High · Not analysed yet · Published 15 Dec 2025 · Tags: Code injection
- [A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may b...](https://agentprime.io/advisories/GHSA-774q-r975-vqwp.md)
  `GHSA-774q-r975-vqwp`, `CVE-2025-14691`, `PYSEC-2025-134` · PyPI `mayan-edms`: affected `<4.10.2`, fixed in `4.10.2` · CVSS 5.3 Medium · Not analysed yet · Published 14 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Student File Management System update_student.php cross site scripting](https://agentprime.io/advisories/CVE-2025-14663.md)
  `CVE-2025-14663` · CVE record: code-projects Student File Management System · CVSS 4.8 Medium · Not analysed yet · Published 14 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Student File Management System Update User update_user.php cross site scripting](https://agentprime.io/advisories/CVE-2025-14662.md)
  `CVE-2025-14662` · CVE record: code-projects Student File Management System · CVSS 4.8 Medium · Not analysed yet · Published 14 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Shortcode Loader <= 1.0 - Unauthenticated Arbitrary Shortcode Execution via 'code' Parameter](https://agentprime.io/advisories/CVE-2025-14539.md)
  `CVE-2025-14539` · CVE record: rang501 Shortcode Ajax · CVSS 5.4 Medium · Not analysed yet · Published 13 Dec 2025 · Tags: Code injection
- [Eval injection in Apple macOS](https://agentprime.io/advisories/CVE-2025-43466.md)
  `CVE-2025-43466` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Code injection
- [Eval injection in Apple macOS](https://agentprime.io/advisories/CVE-2025-43388.md)
  `CVE-2025-43388` · CVE record: Apple macOS · CVSS 3.3 Low · Not analysed yet · Published 12 Dec 2025 · Tags: Code injection
- [Qualitor viewDocumento.php cross site scripting](https://agentprime.io/advisories/CVE-2025-14580.md)
  `CVE-2025-14580` · CVE record: Qualitor · CVSS 5.1 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of \`new Function()\` in APIVersion Rule](https://agentprime.io/advisories/GHSA-55jh-84jv-8mx8.md)
  `GHSA-55jh-84jv-8mx8`, `CVE-2025-67750` · npm `lightning-flow-scanner`: affected `<6.10.6`, fixed in `6.10.6` · CVSS 8.4 High · Not analysed yet · Published 12 Dec 2025 · Tags: Code injection
- [MineAdmin has an insecure default password](https://agentprime.io/advisories/GHSA-x6mh-4w8x-p34v.md)
  `GHSA-x6mh-4w8x-p34v`, `CVE-2025-65854`, `PKSA-g1g3-pmx2-vy1t` · Packagist `mineadmin/mineadmin`: affected `<=3.0.9`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Dec 2025 · Tags: Code injection
- [Code Injection in Wave Term v0.12.2 allowing TCC Bypass](https://agentprime.io/advisories/CVE-2025-12843.md)
  `CVE-2025-12843` · CVE record: waveterm waveterm · CVSS 6.9 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Code injection
- [Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management](https://agentprime.io/advisories/CVE-2025-67727.md)
  `CVE-2025-67727` · CVE record: parse-community parse-server · CVSS 6.9 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Code injection, Privilege escalation
- [WPMasterToolKit (WPMTK) <= 2.13.0 - Authenticated (Contributor+) Code Injection](https://agentprime.io/advisories/CVE-2025-14166.md)
  `CVE-2025-14166` · CVE record: ludwigyou WPMasterToolKit (WPMTK) – All in one plugin · CVSS 5.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Code injection
- [FoF Pretty Mail has a server-side template injection vulnerability](https://agentprime.io/advisories/GHSA-947q-2xw3-gx9c.md)
  `GHSA-947q-2xw3-gx9c`, `CVE-2024-58303`, `PKSA-zqkh-gtty-c5yv` · Packagist `fof/pretty-mail`: affected `<=1.1.2`, no fixed version yet · CVSS 8.6 High · Not analysed yet · Published 12 Dec 2025 · Tags: Code injection
- [An eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows attackers to overwrite arbitrary files as root via scanning a crafted file.](https://agentprime.io/advisories/CVE-2025-65530.md)
  `CVE-2025-65530` · CVE record · CVSS 8.8 High · Not analysed yet · Published 12 Dec 2025 · Tags: Code injection
- [Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields](https://agentprime.io/advisories/CVE-2024-58293.md)
  `CVE-2024-58293` · CVE record: Akaunting Akaunting · CVSS 8.6 High · Not analysed yet · Published 11 Dec 2025 · Tags: Code injection
- [yangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scripting](https://agentprime.io/advisories/CVE-2025-14538.md)
  `CVE-2025-14538` · CVE record: yangshare warehouseManager 仓库管理系统 · CVSS 5.1 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [baowzh hfly advtext add cross site scripting](https://agentprime.io/advisories/CVE-2025-14519.md)
  `CVE-2025-14519` · CVE record: baowzh hfly · CVSS 5.1 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.](https://agentprime.io/advisories/CVE-2025-55313.md)
  `CVE-2025-55313` · CVE record · CVSS 7.8 High · Not analysed yet · Published 11 Dec 2025 · Tags: Code injection
- [PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings](https://agentprime.io/advisories/CVE-2024-58284.md)
  `CVE-2024-58284` · CVE record: PopojiCMS PopojiCMS · CVSS 8.6 High · Not analysed yet · Published 10 Dec 2025 · Tags: Code injection
- [XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection](https://agentprime.io/advisories/GHSA-9xc6-c2rm-f27p.md)
  `GHSA-9xc6-c2rm-f27p`, `CVE-2025-66474` · Maven `org.xwiki.rendering:xwiki-rendering-xml`: affected `<16.10.10 || >=17.0.0-rc-1, <17.4.3 || >=17.5.0-rc-1, <17.6.0-rc-1`, fixed in `16.10.10`, `17.4.3`, `17.6.0-rc-1` · CVSS 8.7 High · Not analysed yet · Published 10 Dec 2025 · Tags: Code injection
- [Barracuda RMM < 2025.1.1 Service Center Insecure Reflection RCE](https://agentprime.io/advisories/CVE-2025-34393.md)
  `CVE-2025-34393` · CVE record: Barracuda Networks RMM · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Dec 2025 · Tags: Code injection
- [The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot.](https://agentprime.io/advisories/CVE-2025-65829.md)
  `CVE-2025-65829` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 10 Dec 2025 · Tags: Code injection
- [A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request.](https://agentprime.io/advisories/CVE-2025-65602.md)
  `CVE-2025-65602` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Dec 2025 · Tags: Code injection
- [Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution.](https://agentprime.io/advisories/CVE-2025-65294.md)
  `CVE-2025-65294` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Dec 2025 · Tags: Code injection
- [Neuron MySQLSelectTool “read-only” bypass via \`SELECT ... INTO OUTFILE\` (file write → potential RCE)](https://agentprime.io/advisories/GHSA-j8g6-5gqc-mq36.md)
  `GHSA-j8g6-5gqc-mq36`, `CVE-2025-67509`, `PKSA-3v4g-ypy5-yqkt` · Packagist `neuron-core/neuron-ai`: affected `<2.8.12`, fixed in `2.8.12` · CVSS 8.2 High · Not analysed yet · Published 9 Dec 2025 · Tags: Code injection
- [Elysia affected by arbitrary code injection through cookie config](https://agentprime.io/advisories/GHSA-8vch-m3f4-q8jf.md)
  `GHSA-8vch-m3f4-q8jf`, `CVE-2025-66457` · npm `elysia`: affected `<1.4.18`, fixed in `1.4.18` · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: Code injection
- [ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2025-13642.md)
  `CVE-2025-13642` · CVE record: properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress · CVSS 5.4 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Code injection
- [WordPress GiveWP plugin <= 4.13.1 - Arbitrary Shortocde Execution vulnerability](https://agentprime.io/advisories/CVE-2025-66533.md)
  `CVE-2025-66533` · CVE record: Liquid Web / StellarWP GiveWP · CVSS 6.5 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Code injection
- [JIT miscompilation in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2025-14324.md)
  `CVE-2025-14324` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: Code injection
- [Code Injection vulnerability in SAP Solution Manager](https://agentprime.io/advisories/CVE-2025-42880.md)
  `CVE-2025-42880` · CVE record: SAP_SE SAP Solution Manager · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: Code injection
- [DeepChat's Incomplete XSS Fix Allows RCE through Mermaid Content](https://agentprime.io/advisories/CVE-2025-66481.md)
  `CVE-2025-66481` · CVE record: ThinkInAIXYZ deepchat · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server](https://agentprime.io/advisories/GHSA-j76j-5p5g-9wfr.md)
  `GHSA-j76j-5p5g-9wfr`, `CVE-2025-67489` · npm `@vitejs/plugin-rsc`: affected `<0.5.6`, fixed in `0.5.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Dec 2025 · Tags: Code injection
- [GreenCMS Menu Management CustomController.class.php cross site scripting](https://agentprime.io/advisories/CVE-2025-14244.md)
  `CVE-2025-14244` · CVE record: GreenCMS · CVSS 4.8 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Yealink SIP-T21P E2 Local Directory cross site scripting](https://agentprime.io/advisories/CVE-2025-14228.md)
  `CVE-2025-14228` · CVE record: Yealink SIP-T21P E2 · CVSS 5.1 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Online Banking System page cross site scripting](https://agentprime.io/advisories/CVE-2025-14221.md)
  `CVE-2025-14221` · CVE record: SourceCodester Online Banking System · CVSS 5.1 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session.](https://agentprime.io/advisories/CVE-2025-65271.md)
  `CVE-2025-65271` · CVE record · CVSS 8.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: Code injection
- [code-projects Chamber of Commerce Membership Management System Your Info membership_profile.php cross site scripting](https://agentprime.io/advisories/CVE-2025-14205.md)
  `CVE-2025-14205` · CVE record: code-projects Chamber of Commerce Membership Management System · CVSS 4.8 Medium · Not analysed yet · Published 7 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [alokjaiswal Hotel-Management-services-using-MYSQL-and-php dishsub.php cross site scripting](https://agentprime.io/advisories/CVE-2025-14201.md)
  `CVE-2025-14201` · CVE record: alokjaiswal Hotel-Management-services-using-MYSQL-and-php · CVSS 4.8 Medium · Not analysed yet · Published 7 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection

Newest: <https://agentprime.io/advisories/tag/code-injection.md>
Older: <https://agentprime.io/advisories/tag/code-injection.md?cursor=WyIyMDI1LTEyLTA3VDE4OjAyOjA1LjY0NTAwMFoiLCJDVkUtMjAyNS0xNDIwMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=code-injection&cursor=WyIyMDI1LTEyLTE4VDAxOjMyOjA3LjgwNjAwMFoiLCJDVkUtMjAyNS0xNDg1NiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/code-injection/?cursor=WyIyMDI1LTEyLTE4VDAxOjMyOjA3LjgwNjAwMFoiLCJDVkUtMjAyNS0xNDg1NiJd>. Everything for agents: <https://agentprime.io/llms.txt>.