# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection](https://agentprime.io/advisories/GHSA-rr49-f9g6-c9r5.md) `GHSA-rr49-f9g6-c9r5`, `CVE-2026-57149`, `PYSEC-2026-4138` · PyPI `plone-app-portlets`: affected `>=5.0.0, <5.0.8 || >=6.0.0, <6.0.4 || >=7.0.0, <7.0.2`, fixed in `5.0.8`, `6.0.4`, `7.0.2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection - [Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-12370.md) `CVE-2026-12370` · CVE record: Zohocorp ManageEngine OpManager and 2 more · CVSS 7.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection - [Emacs: emacs: arbitrary code execution in flymake mode](https://agentprime.io/advisories/CVE-2026-96442.md) `CVE-2026-96442` · CVE record: GNU Emacs GNU Emacs and 4 more · CVSS 7.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection - [YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache](https://agentprime.io/advisories/CVE-2026-75799.md) `CVE-2026-75799` · CVE record: Unknown YAHMAN Add-ons · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection - [onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting](https://agentprime.io/advisories/CVE-2026-96258.md) `CVE-2026-96258` · CVE record: onSite internet GmbH Auktion NG Auktionssoftware · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Smart Attendance System with QR Code Scanner Self-Registration student_signup.php prepend cross site scripting](https://agentprime.io/advisories/CVE-2026-95957.md) `CVE-2026-95957` · CVE record: SourceCodester Smart Attendance System with QR Code Scanner · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [webpy web.py 0.76 is vulnerable to server-side template injection (SSTI).](https://agentprime.io/advisories/CVE-2026-79310.md) `CVE-2026-79310` · CVE record · CVSS 8.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection - [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18162.md) `CVE-2026-18162` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection - [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18123.md) `CVE-2026-18123` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 7.6 High · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection - [Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability](https://agentprime.io/advisories/GHSA-vxg7-f2jj-jmqm.md) `GHSA-vxg7-f2jj-jmqm`, `CVE-2026-76819`, `GO-2026-6575` · Go `github.com/projectdiscovery/nuclei/v3`: affected `>=3.0.0, <3.10.0`, fixed in `3.10.0` · CVSS 8.6 High · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection, Memory corruption - [MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)](https://agentprime.io/advisories/GHSA-6vmq-24h2-pj7j.md) `GHSA-6vmq-24h2-pj7j`, `CVE-2026-77271`, `PYSEC-2026-4087` · PyPI `mcp-atlassian`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 8.3 High · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal, Code injection - [dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting](https://agentprime.io/advisories/CVE-2026-95657.md) `CVE-2026-95657` · CVE record: dgtlmoon Changedetection.io · CVSS 5.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-75703.md) `CVE-2026-75703` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection - [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-84412.md) `CVE-2026-84412` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection - [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-89276.md) `CVE-2026-89276` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection - [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-75721.md) `CVE-2026-75721` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection - [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-75699.md) `CVE-2026-75699` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection - [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-73369.md) `CVE-2026-73369` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection - [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-89275.md) `CVE-2026-89275` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection - [Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins](https://agentprime.io/advisories/CVE-2026-70410.md) `CVE-2026-70410` · CVE record: Apache Software Foundation Apache Calcite Avatica · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection - [mtrano APENCMS Template weasel.php eval code injection](https://agentprime.io/advisories/CVE-2026-95501.md) `CVE-2026-95501` · CVE record: mtrano APENCMS · CVSS 4.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Other injection, Code injection - [sfturing hosp_order Public Search Handlers HospitalController.java cross site scripting](https://agentprime.io/advisories/CVE-2026-95396.md) `CVE-2026-95396` · CVE record: sfturing hosp_order · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data\[xs_reviw_summery\]' Parameter](https://agentprime.io/advisories/CVE-2026-92235.md) `CVE-2026-92235` · CVE record: roxnor WP Ultimate Review · CVSS 8.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection - [Information Disclosure vulnerability in SAP Fiori Launchpad](https://agentprime.io/advisories/CVE-2026-76974.md) `CVE-2026-76974` · CVE record: SAP_SE SAP Fiori Launchpad · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection - [xuxueli xxl-job insert cross site scripting](https://agentprime.io/advisories/CVE-2026-94426.md) `CVE-2026-94426` · CVE record: xuxueli xxl-job · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Code injection in OpenStack Octavia](https://agentprime.io/advisories/CVE-2026-94572.md) `CVE-2026-94572` · CVE record: OpenStack Octavia · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Code injection - [Code injection in OpenStack Octavia](https://agentprime.io/advisories/CVE-2026-94571.md) `CVE-2026-94571` · CVE record: OpenStack Octavia · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Code injection - [Hyve5 Leantime Project Dashboard show.blade.php cross site scripting](https://agentprime.io/advisories/CVE-2026-94211.md) `CVE-2026-94211` · CVE record: Hyve5 Leantime · CVSS 4.8 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting](https://agentprime.io/advisories/CVE-2026-94210.md) `CVE-2026-94210` · CVE record: Hyve5 Leantime · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Omega Solution HRM OS SVG File Upload view cross site scripting](https://agentprime.io/advisories/CVE-2026-94150.md) `CVE-2026-94150` · CVE record: Omega Solution HRM OS · CVSS 4.8 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [xuxueli xxl-job Task Management JobInfoController.java cross site scripting](https://agentprime.io/advisories/CVE-2026-94145.md) `CVE-2026-94145` · CVE record: xuxueli xxl-job · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [RooCMS Frontend Rendering site_pagePHP.php eval code injection](https://agentprime.io/advisories/CVE-2026-94103.md) `CVE-2026-94103` · CVE record: RooCMS · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Other injection, Code injection - [A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary…](https://agentprime.io/advisories/CVE-2026-88405.md) `CVE-2026-88405` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Code injection - [A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary…](https://agentprime.io/advisories/CVE-2026-88404.md) `CVE-2026-88404` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Code injection - [An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code ex…](https://agentprime.io/advisories/CVE-2026-78847.md) `CVE-2026-78847` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Code injection - [Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to the setServerConfig API endpo…](https://agentprime.io/advisories/CVE-2026-67827.md) `CVE-2026-67827` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Code injection - [newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting](https://agentprime.io/advisories/CVE-2026-94045.md) `CVE-2026-94045` · CVE record: newbee-ltd newbee-mall · CVSS 5.1 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7](https://agentprime.io/advisories/CVE-2026-88856.md) `CVE-2026-88856` · CVE record: OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joomla and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Sept 2026 · Tags: Code injection - [SourceCodester Drug Recommendation System index.php cross site scripting](https://agentprime.io/advisories/CVE-2026-94035.md) `CVE-2026-94035` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Drug Recommendation System Password Change change_password cross site scripting](https://agentprime.io/advisories/CVE-2026-94034.md) `CVE-2026-94034` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.1 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Drug Recommendation System User Management add_user cross site scripting](https://agentprime.io/advisories/CVE-2026-94033.md) `CVE-2026-94033` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.1 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Drug Recommendation System add_symptom cross site scripting](https://agentprime.io/advisories/CVE-2026-94016.md) `CVE-2026-94016` · CVE record: SourceCodester Drug Recommendation System · CVSS 4.8 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Code injection in Vanderbilt University REDCap](https://agentprime.io/advisories/CVE-2026-90817.md) `CVE-2026-90817` · CVE record: Vanderbilt University REDCap · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Sept 2026 · Tags: Path traversal, Code injection - [DedeCMS mytag_js.php code injection](https://agentprime.io/advisories/CVE-2026-94004.md) `CVE-2026-94004` · CVE record: DedeCMS · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, Code injection - [openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer](https://agentprime.io/advisories/CVE-2026-94109.md) `CVE-2026-94109` · CVE record: openequella openEQUELLA · CVSS 8.6 High · Not analysed yet · Published 20 Sept 2026 · Tags: Code injection - [code-projects Assessment Management add-single-mark.php cross site scripting](https://agentprime.io/advisories/CVE-2026-93977.md) `CVE-2026-93977` · CVE record: code-projects Assessment Management · CVSS 5.1 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Assessment Management add-user.php cross site scripting](https://agentprime.io/advisories/CVE-2026-93976.md) `CVE-2026-93976` · CVE record: code-projects Assessment Management · CVSS 4.8 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Assessment Management User Editing edit-user.php cross site scripting](https://agentprime.io/advisories/CVE-2026-93975.md) `CVE-2026-93975` · CVE record: code-projects Assessment Management · CVSS 4.8 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection](https://agentprime.io/advisories/CVE-2026-87067.md) `CVE-2026-87067` · CVE record: Unknown Forminator Forms · CVSS 8.5 High · Not analysed yet · Published 20 Sept 2026 · Tags: Code injection - [olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting](https://agentprime.io/advisories/CVE-2026-93956.md) `CVE-2026-93956` · CVE record: olivier-ls PHP-FTS · CVSS 5.1 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection - [OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE](https://agentprime.io/advisories/CVE-2026-93985.md) `CVE-2026-93985` · CVE record: Openpanel-dev openpanel · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Sept 2026 · Tags: Code injection - [DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM](https://agentprime.io/advisories/CVE-2026-78030.md) `CVE-2026-78030` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Sept 2026 · Tags: Code injection - [Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Fi…](https://agentprime.io/advisories/CVE-2026-85658.md) `CVE-2026-85658` · CVE record: properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress · CVSS 8.1 High · Not analysed yet · Published 19 Sept 2026 · Tags: Code injection - [The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter](https://agentprime.io/advisories/CVE-2026-4327.md) `CVE-2026-4327` · CVE record: sebwordpress The Welcomizer · CVSS 8.8 High · Not analysed yet · Published 19 Sept 2026 · Tags: Code injection - [Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-92807.md) `CVE-2026-92807` · CVE record: pdfcrowd Save as PDF Plugin by PDFCrowd · CVSS 8.8 High · Not analysed yet · Published 19 Sept 2026 · Tags: Code injection - [WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content](https://agentprime.io/advisories/CVE-2026-89274.md) `CVE-2026-89274` · CVE record: brechtvds WP Recipe Maker · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Sept 2026 · Tags: Code injection - [Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter](https://agentprime.io/advisories/CVE-2026-92229.md) `CVE-2026-92229` · CVE record: wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Sept 2026 · Tags: Code injection - [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-82340.md) `CVE-2026-82340` · CVE record: IBM Guardium Data Protection · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Code injection - [Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist](https://agentprime.io/advisories/CVE-2026-93759.md) `CVE-2026-93759` · CVE record: MongoDB Inc. Mongoid · CVSS 8.8 High · Not analysed yet · Published 18 Sept 2026 · Tags: Code injection - [Icinga 2 DSL Injection via Unescaped Import Template Name](https://agentprime.io/advisories/CVE-2026-61552.md) `CVE-2026-61552` · CVE record: Icinga icinga2 · CVSS 7.2 High · Not analysed yet · Published 18 Sept 2026 · Tags: Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .