# Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.](https://agentprime.io/advisories/CVE-2026-0863.md)
  `CVE-2026-0863` · CVE record · CVSS 8.5 High · Not analysed yet · Published 18 Jan 2026 · Tags: Code injection
- [LigeroSmart index.pl cross site scripting](https://agentprime.io/advisories/CVE-2026-1049.md)
  `CVE-2026-1049` · CVE record: LigeroSmart · CVSS 5.1 Medium · Not analysed yet · Published 17 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [LigeroSmart index.pl cross site scripting](https://agentprime.io/advisories/CVE-2026-1048.md)
  `CVE-2026-1048` · CVE record: LigeroSmart · CVSS 5.1 Medium · Not analysed yet · Published 17 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter](https://agentprime.io/advisories/GHSA-5882-5rx9-xgxp.md)
  `GHSA-5882-5rx9-xgxp`, `CVE-2026-26216`, `PYSEC-2026-33` · PyPI `crawl4ai`: affected `<0.8.0`, fixed in `0.8.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jan 2026 · Tags: Code injection
- [Dive allows One-click Remote Code Execution through Deep Links for MCP Install](https://agentprime.io/advisories/CVE-2026-23523.md)
  `CVE-2026-23523` · CVE record: OpenAgentPlatform Dive · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jan 2026 · Tags: Code injection
- [AVEVA Process Optimization Code Injection](https://agentprime.io/advisories/CVE-2025-64691.md)
  `CVE-2025-64691` · CVE record: AVEVA Process Optimization · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jan 2026 · Tags: Code injection
- [AVEVA Process Optimization Code Injection](https://agentprime.io/advisories/CVE-2025-61937.md)
  `CVE-2025-61937` · CVE record: AVEVA Process Optimization · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jan 2026 · Tags: Code injection
- [Shopware Has Improper Control of Generation of Code in Twig rendered views](https://agentprime.io/advisories/GHSA-7cw6-7h3h-v8pf.md)
  `GHSA-7cw6-7h3h-v8pf`, `CVE-2026-23498`, `PKSA-bc17-t4m6-cf6m`, `PKSA-sj7p-kg8p-gg2k` · Packagist `shopware/core` and 1 more: affected `>=6.7.0.0, <6.7.6.1`, fixed in `6.7.6.1` · CVSS 7.2 High · Not analysed yet · Published 14 Jan 2026 · Tags: Code injection
- [enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain](https://agentprime.io/advisories/GHSA-7qm7-455j-5p63.md)
  `GHSA-7qm7-455j-5p63`, `CVE-2026-22686` · npm `enclave-vm`: affected `<2.7.0`, fixed in `2.7.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2026 · Tags: Code injection, CWE-693
- [Cursor has a Terminal Tool Allowlist Bypass via Environment Variables](https://agentprime.io/advisories/CVE-2026-22708.md)
  `CVE-2026-22708` · CVE record: cursor cursor · CVSS 7.2 High · Not analysed yet · Published 14 Jan 2026 · Tags: Other injection, Command injection, Code injection, Privilege escalation
- [4images 1.9 - Remote Command Execution (RCE)](https://agentprime.io/advisories/CVE-2022-50806.md)
  `CVE-2022-50806` · CVE record: 4Homepages 4images · CVSS 8.6 High · Not analysed yet · Published 13 Jan 2026 · Tags: Code injection
- [Eigent Allows Arbitrary Code Execution via pull_request_target CI Workflow](https://agentprime.io/advisories/CVE-2026-22869.md)
  `CVE-2026-22869` · CVE record: eigent-ai eigent · CVSS 8.9 High · Not analysed yet · Published 13 Jan 2026 · Tags: Code injection
- [UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation](https://agentprime.io/advisories/GHSA-vrgw-pc9c-qrrc.md)
  `GHSA-vrgw-pc9c-qrrc`, `CVE-2025-68924` · NuGet `UmbracoForms`: affected `<=8.13.16`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 13 Jan 2026 · Tags: Code injection, Insecure deserialization, Broken access control, CWE-829
- [openc3-api Vulnerable to Unauthenticated Remote Code Execution](https://agentprime.io/advisories/GHSA-w757-4qv9-mghp.md)
  `GHSA-w757-4qv9-mghp`, `CVE-2025-68271` · RubyGems `openc3`: affected `>=5.0.6, <6.10.2`, fixed in `6.10.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jan 2026 · Tags: Code injection
- [Envoy Extension Policy lua scripts injection causes arbitrary command execution](https://agentprime.io/advisories/GHSA-xrwg-mqj6-6m22.md)
  `GHSA-xrwg-mqj6-6m22`, `BIT-envoy-gateway-2026-22771`, `CVE-2026-22771`, `GO-2026-4312` · Go `github.com/envoyproxy/gateway`: affected `<1.5.7 || >=1.6.0-rc.0, <1.6.2`, fixed in `1.5.7`, `1.6.2` · CVSS 8.8 High · Not analysed yet · Published 13 Jan 2026 · Tags: Code injection
- [Config-Upload Code Injection](https://agentprime.io/advisories/CVE-2025-41717.md)
  `CVE-2025-41717` · CVE record: Phoenix Contact TC ROUTER 3002T-3G and 4 more · CVSS 8.8 High · Not analysed yet · Published 13 Jan 2026 · Tags: Code injection
- [Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)](https://agentprime.io/advisories/CVE-2026-0500.md)
  `CVE-2026-0500` · CVE record: SAP_SE SAP Wily Introscope Enterprise Manager (WorkStation) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jan 2026 · Tags: Code injection
- [Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)](https://agentprime.io/advisories/CVE-2026-0498.md)
  `CVE-2026-0498` · CVE record: SAP_SE SAP S/4HANA (Private Cloud and On-Premise) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jan 2026 · Tags: Code injection
- [Code Injection vulnerability in SAP Landscape Transformation](https://agentprime.io/advisories/CVE-2026-0491.md)
  `CVE-2026-0491` · CVE record: SAP_SE SAP Landscape Transformation · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jan 2026 · Tags: Code injection
- [Luxul XWR-600 Web Administration cross site scripting](https://agentprime.io/advisories/CVE-2025-15505.md)
  `CVE-2025-15505` · CVE record: Luxul XWR-600 · CVSS 4.8 Medium · Not analysed yet · Published 11 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting](https://agentprime.io/advisories/GHSA-xf94-h87h-g9wr.md)
  `GHSA-xf94-h87h-g9wr`, `CVE-2026-0824` · npm `@questdb/web-console`: affected `<1.1.10`, fixed in `1.1.10` · CVSS 5.1 Medium · Not analysed yet · Published 10 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [AccessAlly < 3.3.2 Unauthenticated Arbitrary PHP Code Execution](https://agentprime.io/advisories/CVE-2020-36875.md)
  `CVE-2020-36875` · CVE record: ACCESSALLY, INC. AccessAlly · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2026 · Tags: Code injection
- [PHPGurukul Staff Leave Management System SVG File adminviews.py UPDATE_STAFF cross site scripting](https://agentprime.io/advisories/CVE-2026-0730.md)
  `CVE-2026-0730` · CVE record: PHPGurukul Staff Leave Management System · CVSS 4.8 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing…](https://agentprime.io/advisories/CVE-2025-66916.md)
  `CVE-2025-66916` · CVE record · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jan 2026 · Tags: Code injection
- [JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs.](https://agentprime.io/advisories/CVE-2025-66913.md)
  `CVE-2025-66913` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jan 2026 · Tags: Code injection
- [OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE](https://agentprime.io/advisories/GHSA-5f29-2333-h9c7.md)
  `GHSA-5f29-2333-h9c7`, `CVE-2026-22244` · Maven `org.open-metadata:platform`: affected `>=1.5.0, <1.11.4`, fixed in `1.11.4` · CVSS 8.5 High · Not analysed yet · Published 7 Jan 2026 · Tags: Code injection
- [pnpm vulnerable to Command Injection via environment variable substitution](https://agentprime.io/advisories/GHSA-2phv-j68v-wwqx.md)
  `GHSA-2phv-j68v-wwqx`, `CVE-2025-69262` · npm `pnpm`: affected `>=6.25.0, <10.27.0`, fixed in `10.27.0` · CVSS 7.6 High · Not analysed yet · Published 7 Jan 2026 · Tags: Command injection, Code injection
- [carbone Code Injection vulnerability](https://agentprime.io/advisories/GHSA-6rcw-ww3x-xqwm.md)
  `GHSA-6rcw-ww3x-xqwm`, `CVE-2024-14020` · npm `carbone`: affected `<3.5.6`, fixed in `3.5.6` · CVSS 2.3 Low · Not analysed yet · Published 7 Jan 2026 · Tags: Code injection, Prototype pollution
- [projectworlds House Rental and Property Listing complaint.php cross site scripting](https://agentprime.io/advisories/CVE-2026-0642.md)
  `CVE-2026-0642` · CVE record: projectworlds House Rental and Property Listing · CVSS 4.8 Medium · Not analysed yet · Published 6 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [n8n Vulnerable to RCE via Arbitrary File Write](https://agentprime.io/advisories/GHSA-v364-rw7m-3263.md)
  `GHSA-v364-rw7m-3263`, `CVE-2026-21877` · npm `n8n`: affected `>=0.123.0, <1.121.3`, fixed in `1.121.3` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jan 2026 · Tags: Code injection, Unrestricted file upload
- [Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior](https://agentprime.io/advisories/GHSA-255j-qw47-wjh5.md)
  `GHSA-255j-qw47-wjh5`, `CVE-2025-68455`, `PKSA-hcvs-d728-5zyw` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1, <4.16.17 || >=5.0.0-RC1, <5.8.21`, fixed in `4.16.17`, `5.8.21` · CVSS 8.6 High · Not analysed yet · Published 5 Jan 2026 · Tags: Code injection
- [Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI](https://agentprime.io/advisories/GHSA-742x-x762-7383.md)
  `GHSA-742x-x762-7383`, `CVE-2025-68454`, `PKSA-9rbz-gy92-qjtd` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1, <4.16.17 || >=5.0.0-RC1, <5.8.21`, fixed in `4.16.17`, `5.8.21` · CVSS 5.2 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Code injection
- [muffon has One-click Remote Code Execution via XSS and Custom URL Handling](https://agentprime.io/advisories/CVE-2025-55204.md)
  `CVE-2025-55204` · CVE record: staniel359 muffon · CVSS 8.8 High · Not analysed yet · Published 5 Jan 2026 · Tags: Code injection
- [Xinhu Rainrock RockOA API rockfun.php cross site scripting](https://agentprime.io/advisories/CVE-2026-0588.md)
  `CVE-2026-0588` · CVE record: Xinhu Rainrock RockOA · CVSS 5.1 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Xinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scripting](https://agentprime.io/advisories/CVE-2026-0587.md)
  `CVE-2026-0587` · CVE record: Xinhu Rainrock RockOA · CVSS 5.1 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Online Product Reservation System prod.php cross site scripting](https://agentprime.io/advisories/CVE-2026-0586.md)
  `CVE-2026-0586` · CVE record: code-projects Online Product Reservation System · CVSS 5.3 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester API Key Manager App Import Key cross site scripting](https://agentprime.io/advisories/CVE-2026-0580.md)
  `CVE-2026-0580` · CVE record: SourceCodester API Key Manager App · CVSS 5.1 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [zhanglun lettura RSS ContentRender.tsx cross site scripting](https://agentprime.io/advisories/CVE-2025-15454.md)
  `CVE-2025-15454` · CVE record: zhanglun lettura · CVSS 2.3 Low · Not analysed yet · Published 5 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [xnx3 wangmarket Backend Variable Search variableList.do variableList cross site scripting](https://agentprime.io/advisories/CVE-2025-15452.md)
  `CVE-2025-15452` · CVE record: xnx3 wangmarket · CVSS 4.8 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [xnx3 wangmarket System Variables variableSave.do cross site scripting](https://agentprime.io/advisories/CVE-2025-15451.md)
  `CVE-2025-15451` · CVE record: xnx3 wangmarket · CVSS 4.8 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users](https://agentprime.io/advisories/GHSA-mqhg-v22x-pqj8.md)
  `GHSA-mqhg-v22x-pqj8`, `CVE-2026-21449`, `PKSA-xfmk-zmw2-3qhw` · Packagist `bagisto/bagisto`: affected `<2.3.10`, fixed in `2.3.10` · CVSS 7.4 High · Not analysed yet · Published 2 Jan 2026 · Tags: Code injection
- [Bagisto has Normal & Blind SSTI from low-privilege user when ordering product](https://agentprime.io/advisories/GHSA-5j4h-4f72-qpm6.md)
  `GHSA-5j4h-4f72-qpm6`, `CVE-2026-21448`, `PKSA-td46-kz3d-nfhj` · Packagist `bagisto/bagisto`: affected `<2.3.10`, fixed in `2.3.10` · CVSS 8.9 High · Not analysed yet · Published 2 Jan 2026 · Tags: Code injection
- [Bagisto SSTI vulnerability in type parameter can lead to RCE](https://agentprime.io/advisories/GHSA-9hvg-qw5q-wqwp.md)
  `GHSA-9hvg-qw5q-wqwp`, `CVE-2026-21450`, `PKSA-fhhx-v12v-v3yr` · Packagist `bagisto/bagisto`: affected `<2.3.10`, fixed in `2.3.10` · CVSS 7.3 High · Not analysed yet · Published 2 Jan 2026 · Tags: Code injection
- [Malware Remover](https://agentprime.io/advisories/CVE-2025-11837.md)
  `CVE-2025-11837` · CVE record: QNAP Systems Inc. Malware Remover · CVSS 8.1 High · Not analysed yet · Published 2 Jan 2026 · Tags: Code injection
- [Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package](https://agentprime.io/advisories/GHSA-93jc-vqqc-vvvh.md)
  `GHSA-93jc-vqqc-vvvh`, `CVE-2025-68619` · npm `signalk-server`: affected `<2.9.0`, fixed in `2.9.0` · CVSS 7.3 High · Not analysed yet · Published 2 Jan 2026 · Tags: Code injection
- [LigeroSmart Environment Variable cross site scripting](https://agentprime.io/advisories/CVE-2025-15437.md)
  `CVE-2025-15437` · CVE record: LigeroSmart · CVSS 5.1 Medium · Not analysed yet · Published 2 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [xnx3 wangmarket Add Global Variable save.do cross site scripting](https://agentprime.io/advisories/CVE-2025-15416.md)
  `CVE-2025-15416` · CVE record: xnx3 wangmarket · CVSS 4.8 Medium · Not analysed yet · Published 1 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [iCMS POST Parameter ConfigAdmincp.php save code injection](https://agentprime.io/advisories/CVE-2025-15394.md)
  `CVE-2025-15394` · CVE record: iCMS · CVSS 5.1 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Other injection, Code injection
- [Kohana KodiCMS Layout API Endpoint file.php save code injection](https://agentprime.io/advisories/CVE-2025-15393.md)
  `CVE-2025-15393` · CVE record: Kohana KodiCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Other injection, Code injection
- [elinicksic Razgover Chat Message send.php cross site scripting](https://agentprime.io/advisories/CVE-2019-25262.md)
  `CVE-2019-25262` · CVE record: elinicksic Razgover · CVSS 5.1 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [EyouCMS Ask Module Ask.php cross site scripting](https://agentprime.io/advisories/CVE-2025-15374.md)
  `CVE-2025-15374` · CVE record: EyouCMS · CVSS 5.1 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Philipinho Simple-PHP-Blog login.php cross site scripting](https://agentprime.io/advisories/CVE-2025-15223.md)
  `CVE-2025-15223` · CVE record: Philipinho Simple-PHP-Blog · CVSS 5.3 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [youlaitech vue3-element-admin Notice index.vue cross site scripting](https://agentprime.io/advisories/CVE-2025-15372.md)
  `CVE-2025-15372` · CVE record: youlaitech vue3-element-admin · CVSS 4.8 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [Picklescan is vulnerable to RCE via missing detection when calling built-in python \_operator.attrgetter](https://agentprime.io/advisories/GHSA-46h3-79wf-xr6c.md)
  `GHSA-46h3-79wf-xr6c`, `CVE-2025-71367` · PyPI `picklescan`: affected `<0.0.34`, fixed in `0.0.34` · CVSS 7.6 High · Not analysed yet · Published 30 Dec 2025 · Tags: Code injection, Insecure deserialization
- [Picklescan is vulnerable to RCE via missing detection when calling built-in python \_operator.methodcaller](https://agentprime.io/advisories/GHSA-955r-x9j8-7rhh.md)
  `GHSA-955r-x9j8-7rhh`, `CVE-2025-71375` · PyPI `picklescan`: affected `<0.0.34`, fixed in `0.0.34` · CVSS 7.6 High · Not analysed yet · Published 30 Dec 2025 · Tags: Code injection, Insecure deserialization
- [Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.\_eval_length](https://agentprime.io/advisories/GHSA-6556-fwc2-fg2p.md)
  `GHSA-6556-fwc2-fg2p`, `CVE-2025-71339`, `PYSEC-2026-1783` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 7.6 High · Not analysed yet · Published 30 Dec 2025 · Tags: Code injection, Insecure deserialization
- [Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef](https://agentprime.io/advisories/GHSA-rrxm-2pvv-m66x.md)
  `GHSA-rrxm-2pvv-m66x`, `CVE-2025-71372` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 7.6 High · Not analysed yet · Published 30 Dec 2025 · Tags: Code injection, Insecure deserialization
- [08CMS Novel System Template mtpls.inc.php code injection](https://agentprime.io/advisories/CVE-2025-15250.md)
  `CVE-2025-15250` · CVE record: 08CMS Novel System · CVSS 5.1 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Other injection, Code injection
- [zhujunliang3 work_platform Content cross site scripting](https://agentprime.io/advisories/CVE-2025-15249.md)
  `CVE-2025-15249` · CVE record: zhujunliang3 work_platform · CVSS 5.1 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection
- [sunhailin12315 product-review 商品评价系统 Write a Review cross site scripting](https://agentprime.io/advisories/CVE-2025-15248.md)
  `CVE-2025-15248` · CVE record: sunhailin12315 product-review 商品评价系统 · CVSS 5.1 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Cross-site scripting (XSS), Code injection

Newest: <https://agentprime.io/advisories/tag/code-injection.md>
Older: <https://agentprime.io/advisories/tag/code-injection.md?cursor=WyIyMDI1LTEyLTMwVDEyOjMyOjEwLjU2MzAwMFoiLCJDVkUtMjAyNS0xNTI0OCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=code-injection&cursor=WyIyMDI2LTAxLTE5VDAyOjMyOjA2LjY0ODAwMFoiLCJDVkUtMjAyNi0xMTM0Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/code-injection/?cursor=WyIyMDI2LTAxLTE5VDAyOjMyOjA2LjY0ODAwMFoiLCJDVkUtMjAyNi0xMTM0Il0>. Everything for agents: <https://agentprime.io/llms.txt>.