# Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [LangChain has incomplete f-string validation in prompt templates](https://agentprime.io/advisories/GHSA-926x-3r5x-gfhw.md)
  `GHSA-926x-3r5x-gfhw`, `CVE-2026-40087`, `PYSEC-2026-2563` · PyPI `langchain-core`: affected `<0.3.84 || >=1.0.0a1, <1.2.28`, fixed in `0.3.84`, `1.2.28` · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Code injection, CWE-20
- [openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting](https://agentprime.io/advisories/CVE-2026-5808.md)
  `CVE-2026-5808` · CVE record: openstatusHQ openstatus · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Easy Blog Site update.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5806.md)
  `CVE-2026-5806` · CVE record: code-projects Easy Blog Site · CVSS 5.1 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Vim Ex command injection in Vims NetBeans integration](https://agentprime.io/advisories/CVE-2026-39881.md)
  `CVE-2026-39881` · CVE record: vim vim · CVSS 5.0 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Code injection
- [PraisonAI has Template Injection in Agent Tool Definitions](https://agentprime.io/advisories/GHSA-hwg5-x759-7wjg.md)
  `GHSA-hwg5-x759-7wjg`, `CVE-2026-39891`, `PYSEC-2026-2917` · PyPI `praisonai`: affected `<4.5.115`, fixed in `4.5.115` · CVSS 8.8 High · Not analysed yet · Published 8 Apr 2026 · Tags: Code injection
- [InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape](https://agentprime.io/advisories/CVE-2026-35477.md)
  `CVE-2026-35477` · CVE record: inventree InvenTree · CVSS 5.5 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Code injection
- [stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution](https://agentprime.io/advisories/GHSA-jpcj-7wfg-mqxv.md)
  `GHSA-jpcj-7wfg-mqxv`, `CVE-2026-31040`, `PYSEC-2026-3076` · PyPI `stata-mcp`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2026 · Tags: Code injection, CWE-20
- [Zammad has a server-side template injection leading to RCE via AI Agent](https://agentprime.io/advisories/CVE-2026-34724.md)
  `CVE-2026-34724` · CVE record: zammad zammad · CVSS 8.7 High · Not analysed yet · Published 8 Apr 2026 · Tags: Code injection
- [Eval Injection in Rapid7 Insight Agent](https://agentprime.io/advisories/CVE-2026-4837.md)
  `CVE-2026-4837` · CVE record: Rapid7 Insight Agent · CVSS 6.6 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Code injection
- [SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions](https://agentprime.io/advisories/GHSA-phhp-9rm9-6gr2.md)
  `GHSA-phhp-9rm9-6gr2`, `CVE-2026-39846`, `GO-2026-5540` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260407035653-2f416e5253f1`, fixed in `0.0.0-20260407035653-2f416e5253f1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Code injection in Six Apart Ltd. Movable Type and others](https://agentprime.io/advisories/CVE-2026-25776.md)
  `CVE-2026-25776` · CVE record: Six Apart Ltd. Movable Type and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2026 · Tags: Code injection
- [PowerJob's GroovyEvaluator.evaluate endpoint vulnerable to code injection](https://agentprime.io/advisories/GHSA-wpwf-v25w-54g3.md)
  `GHSA-wpwf-v25w-54g3`, `CVE-2026-5739` · Maven `tech.powerjob:powerjob-server-starter`: affected `>=5.1.0, <=5.1.2`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Other injection, Code injection
- [yaffa vulnerable to Cross Site Scripting](https://agentprime.io/advisories/GHSA-pq95-94c9-j987.md)
  `GHSA-pq95-94c9-j987`, `CVE-2025-70844`, `PKSA-bprf-j9w1-t7bq` · Packagist `kantorge/yaffa`: affected `<=2.0.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [ChurchCRM Affected by Unauthenticated RCE in Install Wizard](https://agentprime.io/advisories/CVE-2026-39337.md)
  `CVE-2026-39337` · CVE record: ChurchCRM CRM · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: Code injection
- [Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()](https://agentprime.io/advisories/CVE-2026-22666.md)
  `CVE-2026-22666` · CVE record: Dolibarr Dolibarr ERP/CRM · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.16 · Not analysed yet · Published 7 Apr 2026 · Tags: Code injection
- [Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans](https://agentprime.io/advisories/GHSA-rxpj-7qvf-xv32.md)
  `GHSA-rxpj-7qvf-xv32`, `BIT-activemq-2026-34197`, `CVE-2026-34197` · Maven `org.apache.activemq:activemq-all` and 1 more: affected `<5.19.5 || >=6.0.0, <6.2.3`, fixed in `5.19.5`, `6.2.3` · CVSS 8.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.98 · Not analysed yet · Published 7 Apr 2026 · Tags: Command injection, Code injection, CWE-20
- [Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.](https://agentprime.io/advisories/CVE-2026-30460.md)
  `CVE-2026-30460` · CVE record · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Code injection
- [Dual DHCP DNS Server 8.01 improperly accepts and caches UDP DNS responses without validating that the response originates from a legitimate configured upstream DNS server.](https://agentprime.io/advisories/CVE-2025-71058.md)
  `CVE-2025-71058` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: Code injection
- [Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution.](https://agentprime.io/advisories/CVE-2024-36057.md)
  `CVE-2024-36057` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: Code injection
- [code-projects Online Hotel Booking Booking Endpoint booknow.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5705.md)
  `CVE-2026-5705` · CVE record: code-projects Online Hotel Booking · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Code injection in dye template expressions](https://agentprime.io/advisories/CVE-2026-35197.md)
  `CVE-2026-35197` · CVE record: mattieb dye · CVSS 6.6 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Code injection
- [Workbench Affected by Remote Code Execution (RCE) via Malicious Cookie in Timezone Conversion](https://agentprime.io/advisories/CVE-2026-35178.md)
  `CVE-2026-35178` · CVE record: forceworkbench forceworkbench · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Apr 2026 · Tags: Code injection
- [Cyber-III Student-Management-System Class Schedule Deletion Endpoint delete_batch.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5671.md)
  `CVE-2026-5671` · CVE record: Cyber-III Student-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Cyber-III Student-Management-System add%20notice.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5668.md)
  `CVE-2026-5668` · CVE record: Cyber-III Student-Management-System · CVSS 4.8 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [GLPI has a Server-Side Template Injection via Double-Compilation](https://agentprime.io/advisories/CVE-2026-26026.md)
  `CVE-2026-26026` · CVE record: glpi-project glpi · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 6 Apr 2026 · Tags: Code injection
- [code-projects Online Shoe Store Add Product admin_feature.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5647.md)
  `CVE-2026-5647` · CVE record: code-projects Online Shoe Store · CVSS 4.8 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Cyber-III Student-Management-System batch-notice.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5644.md)
  `CVE-2026-5644` · CVE record: Cyber-III Student-Management-System · CVSS 4.8 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Cyber-III Student-Management-System Admin Add Endpoint notice.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5643.md)
  `CVE-2026-5643` · CVE record: Cyber-III Student-Management-System · CVSS 4.8 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injection](https://agentprime.io/advisories/CVE-2026-5631.md)
  `CVE-2026-5631` · CVE record: assafelovic gpt-researcher · CVSS 6.9 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Other injection, Code injection
- [assafelovic gpt-researcher Report API app.py cross site scripting](https://agentprime.io/advisories/CVE-2026-5630.md)
  `CVE-2026-5630` · CVE record: assafelovic gpt-researcher · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [assafelovic gpt-researcher WebSocket researcher.py cross site scripting](https://agentprime.io/advisories/CVE-2026-5625.md)
  `CVE-2026-5625` · CVE record: assafelovic gpt-researcher · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [givanz Vvvebjs File Upload Endpoint upload.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5615.md)
  `CVE-2026-5615` · CVE record: givanz Vvvebjs · CVSS 5.3 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [premAI-io premsql followup.py eval code injection](https://agentprime.io/advisories/CVE-2026-5594.md)
  `CVE-2026-5594` · CVE record: premAI-io premsql · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, Code injection
- [Fosowl agenticSeek query Endpoint PyInterpreter.py PyInterpreter.execute code injection](https://agentprime.io/advisories/CVE-2026-5584.md)
  `CVE-2026-5584` · CVE record: Fosowl agenticSeek · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, Code injection
- [Akaunting Invoice/Billing cross site scripting](https://agentprime.io/advisories/CVE-2026-5568.md)
  `CVE-2026-5568` · CVE record: Akaunting · CVSS 5.1 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [PyBlade: SSTI/RCE via Bypassed AST Validation in sandbox.py](https://agentprime.io/advisories/GHSA-23jg-5f8m-gw8c.md)
  `GHSA-23jg-5f8m-gw8c`, `CVE-2026-5559`, `PYSEC-2026-2975` · PyPI `pyblade`: affected `>=0.1.8-alpha, <=0.2.0-alpha`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Code injection, CWE-791
- [provectus kafka-ui Endpoint testexecutions validateAccess code injection](https://agentprime.io/advisories/CVE-2026-5562.md)
  `CVE-2026-5562` · CVE record: provectus kafka-ui · CVSS 6.9 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, Code injection
- [badlogic pi-mono loader.ts discoverAndLoadExtensions code injection](https://agentprime.io/advisories/CVE-2026-5556.md)
  `CVE-2026-5556` · CVE record: badlogic pi-mono · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Other injection, Code injection
- [code-projects Simple Laundry System Parameter modstaffinfo.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5542.md)
  `CVE-2026-5542` · CVE record: code-projects Simple Laundry System · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Simple Laundry System Parameter modmemberinfo.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5541.md)
  `CVE-2026-5541` · CVE record: code-projects Simple Laundry System · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Simple Laundry System Parameter modifymember.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5539.md)
  `CVE-2026-5539` · CVE record: code-projects Simple Laundry System · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [badlogic pi-mono SVG Artifact SvgArtifact.ts cross site scripting](https://agentprime.io/advisories/CVE-2026-5533.md)
  `CVE-2026-5533` · CVE record: badlogic pi-mono · CVSS 5.3 Medium · Not analysed yet · Published 5 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Smart VPN 1.1.3.0 Denial of Service via Search](https://agentprime.io/advisories/CVE-2018-25239.md)
  `CVE-2018-25239` · CVE record: SmartVPN Smart VPN · CVSS 6.9 Medium · Not analysed yet · Published 4 Apr 2026 · Tags: Code injection
- [Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing F…](https://agentprime.io/advisories/CVE-2026-3309.md)
  `CVE-2026-3309` · CVE record: properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress · CVSS 6.5 Medium · Not analysed yet · Published 4 Apr 2026 · Tags: Code injection
- [BentoML: SSTI via Unsandboxed Jinja2 in Dockerfile Generation](https://agentprime.io/advisories/GHSA-v959-cwq9-7hr6.md)
  `GHSA-v959-cwq9-7hr6`, `CVE-2026-35044`, `PYSEC-2026-159` · PyPI `bentoml`: affected `<1.4.38`, fixed in `1.4.38` · CVSS 8.8 High · Not analysed yet · Published 3 Apr 2026 · Tags: Code injection
- [RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component](https://agentprime.io/advisories/CVE-2026-28797.md)
  `CVE-2026-28797` · CVE record: infiniflow ragflow · CVSS 8.7 High · Not analysed yet · Published 3 Apr 2026 · Tags: Command injection, Code injection, CWE-20
- [Casdoor vulnerable to Stored XSS via Application formCss / formSideHtml](https://agentprime.io/advisories/GHSA-w799-7525-rpr6.md)
  `GHSA-w799-7525-rpr6`, `CVE-2026-5468`, `GO-2026-5697` · Go `github.com/casdoor/casdoor`: affected `<=1.1000.0`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Kedro has Arbitrary Code Execution via Malicious Logging Configuration](https://agentprime.io/advisories/GHSA-9cqf-439c-j96r.md)
  `GHSA-9cqf-439c-j96r`, `CVE-2026-35171`, `PYSEC-2026-72` · PyPI `kedro`: affected `<1.3.0`, fixed in `1.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Apr 2026 · Tags: Code injection, Insecure deserialization
- [Krayin CRM is vulnerable to Cross-site Scripting (XSS)](https://agentprime.io/advisories/GHSA-9m2v-hc5g-5jpv.md)
  `GHSA-9m2v-hc5g-5jpv`, `CVE-2026-5370`, `PKSA-9rzv-szxy-ckw5` · Packagist `krayin/laravel-crm`: affected `<=2.2.0`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Duplicate Advisory: Agno: Arbitrary code execution via \`eval()\` on \`field_type\` in \`FunctionCall\`](https://agentprime.io/advisories/GHSA-77rh-m34w-rv36.md)
  `GHSA-77rh-m34w-rv36`, `CVE-2026-35002`, `GHSA-m4w4-3r8h-jw98`, `PYSEC-2026-256` · PyPI `agno`: affected `<2.3.24`, fixed in `2.3.24` · CVSS 9.3 Critical · Withdrawn · Not analysed yet · Published 2 Apr 2026 · Tags: Code injection
- [Xiaopi Panel WAF Firewall demo.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5332.md)
  `CVE-2026-5332` · CVE record: Xiaopi Panel · CVSS 5.1 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)](https://agentprime.io/advisories/CVE-2026-2701.md)
  `CVE-2026-2701` · CVE record: Progress ShareFile Storage Zones Controller · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.55 · Not analysed yet · Published 2 Apr 2026 · Tags: Command injection, Code injection, Unrestricted file upload
- [SourceCodester Simple Customer Relationship Management System Create Ticket create-ticket.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5325.md)
  `CVE-2026-5325` · CVE record: SourceCodester Simple Customer Relationship Management System · CVSS 5.1 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Spam Protect for Contact Form 7 < 1.2.10 - Editor+ Remote Code Execution](https://agentprime.io/advisories/CVE-2026-1540.md)
  `CVE-2026-1540` · CVE record: Unknown Spam Protect for Contact Form 7 · CVSS 7.2 High · Not analysed yet · Published 2 Apr 2026 · Tags: Code injection
- [itsourcecode Payroll Management System navbar.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5319.md)
  `CVE-2026-5319` · CVE record: itsourcecode Payroll Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [lodash vulnerable to Code Injection via \`\_.template\` imports key names](https://agentprime.io/advisories/GHSA-r5fr-rjxr-66jc.md)
  `GHSA-r5fr-rjxr-66jc`, `CVE-2026-4800` · npm `lodash` and 3 more: affected `>=4.0.0, <4.18.0`, fixed in `4.18.0` · CVSS 8.1 High · Not analysed yet · Published 1 Apr 2026 · Tags: Code injection
- [dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration](https://agentprime.io/advisories/GHSA-35xm-qvjg-8m42.md)
  `GHSA-35xm-qvjg-8m42`, `CVE-2026-34725` · npm `dbgate-web`: affected `>=7.0.0, <7.1.5`, fixed in `7.1.5` · CVSS 8.3 High · Not analysed yet · Published 1 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Libinput: libinput: unauthorized code execution and information disclosure through lua bytecode plugins](https://agentprime.io/advisories/CVE-2026-35093.md)
  `CVE-2026-35093` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 8.8 High · Not analysed yet · Published 1 Apr 2026 · Tags: Code injection
- [MetInfo CMS Unauthenticated PHP Code Injection RCE](https://agentprime.io/advisories/CVE-2026-29014.md)
  `CVE-2026-29014` · CVE record: MetInfo CMS MetInfo CMS · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.39 · Not analysed yet · Published 1 Apr 2026 · Tags: Code injection
- [code-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting](https://agentprime.io/advisories/CVE-2026-5255.md)
  `CVE-2026-5255` · CVE record: code-projects Simple Laundry System · CVSS 5.3 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection

Newest: <https://agentprime.io/advisories/tag/code-injection.md>
Older: <https://agentprime.io/advisories/tag/code-injection.md?cursor=WyIyMDI2LTA0LTAxVDA1OjE1OjE0LjE2NDAwMFoiLCJDVkUtMjAyNi01MjU1Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=code-injection&cursor=WyIyMDI2LTA0LTA4VDIyOjAwOjE3LjY2MDAwMFoiLCJDVkUtMjAyNi01ODEwIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/code-injection/?cursor=WyIyMDI2LTA0LTA4VDIyOjAwOjE3LjY2MDAwMFoiLCJDVkUtMjAyNi01ODEwIl0>. Everything for agents: <https://agentprime.io/llms.txt>.