# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Lucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags](https://agentprime.io/advisories/CVE-2025-14509.md) `CVE-2025-14509` · CVE record: villatheme Lucky Wheel for WooCommerce – Spin a Sale · CVSS 7.2 High · Not analysed yet · Published 30 Dec 2025 · Tags: Code injection - [SohuTV CacheCloud AppDataMigrateController.java index cross site scripting](https://agentprime.io/advisories/CVE-2025-15221.md) `CVE-2025-15221` · CVE record: SohuTV CacheCloud · CVSS 5.1 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [SohuTV CacheCloud LoginController.java init cross site scripting](https://agentprime.io/advisories/CVE-2025-15220.md) `CVE-2025-15220` · CVE record: SohuTV CacheCloud · CVSS 5.3 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [SohuTV CacheCloud MachineManageController.java doPodList cross site scripting](https://agentprime.io/advisories/CVE-2025-15219.md) `CVE-2025-15219` · CVE record: SohuTV CacheCloud · CVSS 5.1 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [Campcodes Park Ticketing System admin_class.php save_pricing cross site scripting](https://agentprime.io/advisories/CVE-2025-15214.md) `CVE-2025-15214` · CVE record: Campcodes Park Ticketing System · CVSS 4.8 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [Visual Studio Code Go extension has unexpected untrusted code execution](https://agentprime.io/advisories/GHSA-fjmr-7667-8v4p.md) `GHSA-fjmr-7667-8v4p`, `CVE-2025-68120`, `GO-2025-4249` · Go `github.com/golang/vscode-go`: affected `<0.52.1`, fixed in `0.52.1` · CVSS 5.4 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Code injection - [JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER1 (4.5.1.r4518 and earlier), and ER2 (4.…](https://agentprime.io/advisories/CVE-2025-66848.md) `CVE-2025-66848` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Dec 2025 · Tags: Code injection - [Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.param_eval](https://agentprime.io/advisories/GHSA-cffc-mxrf-mhh4.md) `GHSA-cffc-mxrf-mhh4`, `CVE-2025-71347` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 7.6 High · Not analysed yet · Published 29 Dec 2025 · Tags: Code injection, Insecure deserialization - [SohuTV CacheCloud QuartzManageController.java doQuartzList cross site scripting](https://agentprime.io/advisories/CVE-2025-15204.md) `CVE-2025-15204` · CVE record: SohuTV CacheCloud · CVSS 4.8 Medium · Not analysed yet · Published 29 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval](https://agentprime.io/advisories/GHSA-3329-ghmp-jmv5.md) `GHSA-3329-ghmp-jmv5`, `CVE-2025-71365`, `PYSEC-2026-4131` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 7.6 High · Not analysed yet · Published 29 Dec 2025 · Tags: Code injection, Insecure deserialization - [Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller](https://agentprime.io/advisories/GHSA-x843-g5mx-g377.md) `GHSA-x843-g5mx-g377`, `CVE-2025-71373` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 7.6 High · Not analysed yet · Published 29 Dec 2025 · Tags: Code injection, Insecure deserialization, CWE-693 - [SohuTV CacheCloud ResourceController.java index cross site scripting](https://agentprime.io/advisories/CVE-2025-15203.md) `CVE-2025-15203` · CVE record: SohuTV CacheCloud · CVSS 4.8 Medium · Not analysed yet · Published 29 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [SohuTV CacheCloud TaskController.java taskQueueList cross site scripting](https://agentprime.io/advisories/CVE-2025-15202.md) `CVE-2025-15202` · CVE record: SohuTV CacheCloud · CVSS 4.8 Medium · Not analysed yet · Published 29 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [SohuTV CacheCloud WebResourceController.java redirectNoPower cross site scripting](https://agentprime.io/advisories/CVE-2025-15201.md) `CVE-2025-15201` · CVE record: SohuTV CacheCloud · CVSS 5.1 Medium · Not analysed yet · Published 29 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [SohuTV CacheCloud AppClientDataShowController.java doIndex cross site scripting](https://agentprime.io/advisories/CVE-2025-15200.md) `CVE-2025-15200` · CVE record: SohuTV CacheCloud · CVSS 4.8 Medium · Not analysed yet · Published 29 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [Advanced Ads <= 2.0.14 - Authenticated (Editor+) Remote Code Execution via Shortcode](https://agentprime.io/advisories/CVE-2025-13592.md) `CVE-2025-13592` · CVE record: monetizemore Advanced Ads – Ad Manager & AdSense · CVSS 7.2 High · Not analysed yet · Published 29 Dec 2025 · Tags: Code injection - [WordPress IF AS Shortcode plugin <= 1.2 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2025-68897.md) `CVE-2025-68897` · CVE record: Mohammad I. Okfie IF AS Shortcode · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Dec 2025 · Tags: Code injection - [Frappe may be vulnerable remote code execution due to server-side template injection](https://agentprime.io/advisories/CVE-2025-68929.md) `CVE-2025-68929` · CVE record: frappe frappe · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Dec 2025 · Tags: Code injection - [Campcodes Complete Online Beauty Parlor Management System search-invoices.php cross site scripting](https://agentprime.io/advisories/CVE-2025-15188.md) `CVE-2025-15188` · CVE record: Campcodes Complete Online Beauty Parlor Management System · CVSS 4.8 Medium · Not analysed yet · Published 29 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [SohuTV CacheCloud AppController.java appCommandAnalysis cross site scripting](https://agentprime.io/advisories/CVE-2025-15175.md) `CVE-2025-15175` · CVE record: SohuTV CacheCloud · CVSS 5.1 Medium · Not analysed yet · Published 29 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [SohuTV CacheCloud AppManageController.java doAppAuditList cross site scripting](https://agentprime.io/advisories/CVE-2025-15174.md) `CVE-2025-15174` · CVE record: SohuTV CacheCloud · CVSS 5.1 Medium · Not analysed yet · Published 29 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [SohuTV CacheCloud InstanceController.java advancedAnalysis cross site scripting](https://agentprime.io/advisories/CVE-2025-15173.md) `CVE-2025-15173` · CVE record: SohuTV CacheCloud · CVSS 5.1 Medium · Not analysed yet · Published 29 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [SohuTV CacheCloud RedisConfigTemplateController.java preview cross site scripting](https://agentprime.io/advisories/CVE-2025-15172.md) `CVE-2025-15172` · CVE record: SohuTV CacheCloud · CVSS 5.1 Medium · Not analysed yet · Published 29 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [SohuTV CacheCloud ServerController.java index cross site scripting](https://agentprime.io/advisories/CVE-2025-15171.md) `CVE-2025-15171` · CVE record: SohuTV CacheCloud · CVSS 5.1 Medium · Not analysed yet · Published 29 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [Advaya Softech GEMS ERP Portal Error Message home.jsp cross site scripting](https://agentprime.io/advisories/CVE-2025-15170.md) `CVE-2025-15170` · CVE record: Advaya Softech GEMS ERP Portal · CVSS 5.3 Medium · Not analysed yet · Published 29 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [rawchen ecms Add New Product updateProductServlet.java updateProductServlet cross site scripting](https://agentprime.io/advisories/CVE-2025-15149.md) `CVE-2025-15149` · CVE record: rawchen ecms · CVSS 4.8 Medium · Not analysed yet · Published 28 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [CmsEasy Backend Template Management template_admin.php savetemp_action code injection](https://agentprime.io/advisories/CVE-2025-15148.md) `CVE-2025-15148` · CVE record: CmsEasy · CVSS 5.1 Medium · Not analysed yet · Published 28 Dec 2025 · Tags: Other injection, Code injection - [SohuTV CacheCloud UserManageController.java doUserList cross site scripting](https://agentprime.io/advisories/CVE-2025-15146.md) `CVE-2025-15146` · CVE record: SohuTV CacheCloud · CVSS 4.8 Medium · Not analysed yet · Published 28 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [SohuTV CacheCloud TotalManageController.java doTotalList cross site scripting](https://agentprime.io/advisories/CVE-2025-15145.md) `CVE-2025-15145` · CVE record: SohuTV CacheCloud · CVSS 4.8 Medium · Not analysed yet · Published 28 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [dayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross site scripting](https://agentprime.io/advisories/CVE-2025-15144.md) `CVE-2025-15144` · CVE record: dayrui XunRuiCMS · CVSS 5.3 Medium · Not analysed yet · Published 28 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [yourmaileyes MOOC Submission MainController.java subreview cross site scripting](https://agentprime.io/advisories/CVE-2025-15134.md) `CVE-2025-15134` · CVE record: yourmaileyes MOOC · CVSS 5.1 Medium · Not analysed yet · Published 28 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [shanyu SyCms Administrative Panel FileManageController.class.php addPost code injection](https://agentprime.io/advisories/CVE-2025-15130.md) `CVE-2025-15130` · CVE record: shanyu SyCms · CVSS 5.1 Medium · Not analysed yet · Published 28 Dec 2025 · Tags: Other injection, Code injection - [ChenJinchuang Lin-CMS-TP5 File Upload LocalUploader.php upload code injection](https://agentprime.io/advisories/CVE-2025-15129.md) `CVE-2025-15129` · CVE record: ChenJinchuang Lin-CMS-TP5 · CVSS 5.3 Medium · Not analysed yet · Published 28 Dec 2025 · Tags: Other injection, Code injection - [1-click Remote Code Execution (RCE) vulnerability in Eigent](https://agentprime.io/advisories/CVE-2025-68952.md) `CVE-2025-68952` · CVE record: eigent-ai eigent · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Dec 2025 · Tags: Code injection - [Eval injection in Xspeeder SXZOS](https://agentprime.io/advisories/CVE-2025-54322.md) `CVE-2025-54322` · CVE record: Xspeeder SXZOS · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 27 Dec 2025 · Tags: Code injection - [postmanlabs httpbin core.py cross site scripting](https://agentprime.io/advisories/CVE-2025-15095.md) `CVE-2025-15095` · CVE record: postmanlabs httpbin · CVSS 5.1 Medium · Not analysed yet · Published 26 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [sunkaifei FlyCMS User Login UserController.java userLogin cross site scripting](https://agentprime.io/advisories/CVE-2025-15094.md) `CVE-2025-15094` · CVE record: sunkaifei FlyCMS · CVSS 5.3 Medium · Not analysed yet · Published 26 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [sunkaifei FlyCMS Admin Login IndexAdminController.java cross site scripting](https://agentprime.io/advisories/CVE-2025-15093.md) `CVE-2025-15093` · CVE record: sunkaifei FlyCMS · CVSS 5.3 Medium · Not analysed yet · Published 26 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2025-13773.md) `CVE-2025-13773` · CVE record: tychesoftwares Print Invoice & Delivery Notes for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Dec 2025 · Tags: Code injection - [code-projects Student Information System profile.php cross site scripting](https://agentprime.io/advisories/CVE-2025-15052.md) `CVE-2025-15052` · CVE record: code-projects Student Information System · CVSS 5.1 Medium · Not analysed yet · Published 24 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of...](https://agentprime.io/advisories/PYSEC-2025-216.md) `PYSEC-2025-216`, `CVE-2025-14928` · PyPI `transformers`: affected `<=4.57.0`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Code injection - [Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ...](https://agentprime.io/advisories/PYSEC-2025-215.md) `PYSEC-2025-215`, `CVE-2025-14927` · PyPI `transformers`: affected `<=4.57.0`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Code injection - [Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hu...](https://agentprime.io/advisories/PYSEC-2025-214.md) `PYSEC-2025-214`, `CVE-2025-14926` · PyPI `transformers`: affected `<=4.57.0`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Code injection - [CMSimple_XH 1.7.4 Authenticated Remote Code Execution via Content Editing](https://agentprime.io/advisories/CVE-2021-47736.md) `CVE-2021-47736` · CVE record: Cmsimple-Xh CMSimple_XH · CVSS 8.6 High · Not analysed yet · Published 23 Dec 2025 · Tags: Code injection - [CMSimple 5.4 Authenticated Remote Code Execution via Template Editing](https://agentprime.io/advisories/CVE-2021-47735.md) `CVE-2021-47735` · CVE record: Cmsimple Cmsimple · CVSS 8.6 High · Not analysed yet · Published 23 Dec 2025 · Tags: Code injection - [LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh.](https://agentprime.io/advisories/CVE-2025-65817.md) `CVE-2025-65817` · CVE record · CVSS 8.8 High · Not analysed yet · Published 22 Dec 2025 · Tags: Code injection - [Campcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scripting](https://agentprime.io/advisories/CVE-2025-14991.md) `CVE-2025-14991` · CVE record: Campcodes Complete Online Beauty Parlor Management System · CVSS 4.8 Medium · Not analysed yet · Published 21 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Simple Stock System chatuser.php cross site scripting](https://agentprime.io/advisories/CVE-2025-14962.md) `CVE-2025-14962` · CVE record: code-projects Simple Stock System · CVSS 5.3 Medium · Not analysed yet · Published 19 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection - [Dive has Cross-Site Scripting vulnerability that can escalate to Remote Code Execution](https://agentprime.io/advisories/CVE-2025-66580.md) `CVE-2025-66580` · CVE record: OpenAgentPlatform Dive · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Dec 2025 · Tags: Code injection - [AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt](https://agentprime.io/advisories/CVE-2025-34433.md) `CVE-2025-34433` · CVE record: World Wide Broadcast Network AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Dec 2025 · Tags: Code injection - [Template injection in Mintlify Platform](https://agentprime.io/advisories/CVE-2025-67843.md) `CVE-2025-67843` · CVE record: Mintlify Mintlify Platform · CVSS 8.3 High · Not analysed yet · Published 19 Dec 2025 · Tags: Code injection - [An issue in GT Edge AI Community Edition Versions before v2.0.12 allows attackers to execute arbitrary code via injecting a crafted JSON payload into the Prompt window.](https://agentprime.io/advisories/CVE-2025-63665.md) `CVE-2025-63665` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Dec 2025 · Tags: Code injection - [Microsoft Purview eDiscovery Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-64676.md) `CVE-2025-64676` · CVE record: Microsoft Microsoft Purview · CVSS 7.2 High · Not analysed yet · Published 18 Dec 2025 · Tags: Path traversal, Code injection - [Azure Container Apps Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-65037.md) `CVE-2025-65037` · CVE record: Microsoft Azure Container Apps · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: Code injection - [Codigo Markdown Editor 1.0.1 Electron Arbitrary Code Execution via Markdown File](https://agentprime.io/advisories/CVE-2023-53940.md) `CVE-2023-53940` · CVE record: Alfonzm Codigo Markdown Editor · CVSS 8.4 High · Not analysed yet · Published 18 Dec 2025 · Tags: Code injection - [tinacms is vulnerable to arbitrary code execution](https://agentprime.io/advisories/GHSA-529f-9qwm-9628.md) `GHSA-529f-9qwm-9628`, `CVE-2025-68278` · npm `tinacms` and 2 more: affected `<3.1.1`, fixed in `3.1.1` · CVSS 7.3 High · Not analysed yet · Published 18 Dec 2025 · Tags: Code injection - [WordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2025-66078.md) `CVE-2025-66078` · CVE record: jetmonsters Hotel Booking Lite · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2025 · Tags: Code injection - [WordPress Molla - Multipurpose Responsive Shopify theme <= 1.5.13 - Arbitrary Code Execution vulnerability](https://agentprime.io/advisories/CVE-2025-60070.md) `CVE-2025-60070` · CVE record: The4 Molla · CVSS 6.5 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Code injection - [WordPress Javo Core plugin <= 3.0.0.266 - Arbitrary Code Execution vulnerability](https://agentprime.io/advisories/CVE-2025-60068.md) `CVE-2025-60068` · CVE record: javothemes Javo Core · CVSS 6.5 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Code injection - [y_project RuoYi getnames code injection](https://agentprime.io/advisories/CVE-2025-14856.md) `CVE-2025-14856` · CVE record: y_project RuoYi · CVSS 5.3 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Other injection, Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .