# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [YiFang CMS D_singlePageGroup.php update cross site scripting](https://agentprime.io/advisories/CVE-2026-3743.md) `CVE-2026-3743` · CVE record: YiFang CMS · CVSS 5.1 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [YiFang CMS D_singlePage.php update cross site scripting](https://agentprime.io/advisories/CVE-2026-3742.md) `CVE-2026-3742` · CVE record: YiFang CMS · CVSS 5.1 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [YiFang CMS D_friendLink.php update cross site scripting](https://agentprime.io/advisories/CVE-2026-3741.md) `CVE-2026-3741` · CVE record: YiFang CMS · CVSS 5.1 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [RustSec Advisory](https://agentprime.io/advisories/GHSA-9c4h-pwmf-m6fj.md) `GHSA-9c4h-pwmf-m6fj`, `CVE-2026-30960`, `RUSTSEC-2026-0038` · crates.io `rssn`: affected `>=0.1.20, <0.2.9`, fixed in `0.2.9` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Mar 2026 · Tags: Code injection, Privilege escalation, CWE-695, CWE-754 - [1024-lab/lab1024 SmartAdmin FreeMarker Template MailService.java freemarkerResolverContent special elements used in a template engine](https://agentprime.io/advisories/CVE-2026-3725.md) `CVE-2026-3725` · CVE record: 1024-lab SmartAdmin and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Code injection, CWE-791 - [1024-lab/lab1024 SmartAdmin Help Documentation HelpDocAddForm.java cross site scripting](https://agentprime.io/advisories/CVE-2026-3721.md) `CVE-2026-3721` · CVE record: 1024-lab SmartAdmin and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [1024-lab/lab1024 SmartAdmin Notice notice-form-drawer.vue cross site scripting](https://agentprime.io/advisories/CVE-2026-3720.md) `CVE-2026-3720` · CVE record: 1024-lab SmartAdmin and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [Wavlink WL-WN579X3-C adm.cgi sub_401AD4 cross site scripting](https://agentprime.io/advisories/CVE-2026-3716.md) `CVE-2026-3716` · CVE record: Wavlink WL-WN579X3-C · CVSS 4.8 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [OpenCart Incomplete Fix CVE-2024-36694 template.php save special elements used in a template engine](https://agentprime.io/advisories/CVE-2026-3714.md) `CVE-2026-3714` · CVE record: OpenCart · CVSS 5.1 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Code injection, CWE-791 - [SourceCodester Loan Management System index.php cross site scripting](https://agentprime.io/advisories/CVE-2026-3702.md) `CVE-2026-3702` · CVE record: SourceCodester Loan Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE](https://agentprime.io/advisories/GHSA-h343-gg57-2q67.md) `GHSA-h343-gg57-2q67`, `CVE-2026-30887` · npm `@oneuptime/common`: affected `<10.0.18`, fixed in `10.0.18` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Mar 2026 · Tags: Code injection - [Easy PHP Settings <= 1.0.4 - Authenticated (Administrator+) PHP Code Injection via 'wp_memory_limit' Setting](https://agentprime.io/advisories/CVE-2026-3352.md) `CVE-2026-3352` · CVE record: shahadul878 Easy PHP Settings · CVSS 7.2 High · Not analysed yet · Published 7 Mar 2026 · Tags: Code injection - [Mesa: Checking out of untrusted code in \`benchmarks.yml\` workflow may lead to code execution in privileged runner](https://agentprime.io/advisories/CVE-2026-29075.md) `CVE-2026-29075` · CVE record: mesa mesa · CVSS 8.3 High · Not analysed yet · Published 6 Mar 2026 · Tags: Code injection - [WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'](https://agentprime.io/advisories/CVE-2026-2830.md) `CVE-2026-2830` · CVE record: wpallimport WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets · CVSS 6.1 Medium · Not analysed yet · Published 6 Mar 2026 · Tags: Code injection - [Natro Macro: Code Injection through Pattern/Path files](https://agentprime.io/advisories/CVE-2026-28801.md) `CVE-2026-28801` · CVE record: NatroTeam NatroMacro · CVSS 6.6 Medium · Not analysed yet · Published 6 Mar 2026 · Tags: Code injection - [Chartbrew: Remote Code Execution (RCE) via Vulnerable API](https://agentprime.io/advisories/CVE-2026-25888.md) `CVE-2026-25888` · CVE record: chartbrew chartbrew · CVSS 8.8 High · Not analysed yet · Published 6 Mar 2026 · Tags: Code injection - [Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query](https://agentprime.io/advisories/CVE-2026-25887.md) `CVE-2026-25887` · CVE record: chartbrew chartbrew · CVSS 7.2 High · Not analysed yet · Published 6 Mar 2026 · Tags: Code injection - [HSC Cybersecurity Mailinspector URL mliUserValidation.php cross site scripting](https://agentprime.io/advisories/CVE-2026-3610.md) `CVE-2026-3610` · CVE record: HSC Cybersecurity Mailinspector · CVSS 5.3 Medium · Not analysed yet · Published 6 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-28134.md) `CVE-2026-28134` · CVE record: Crocoblock JetEngine · CVSS 8.5 High · Not analysed yet · Published 5 Mar 2026 · Tags: Code injection - [WordPress Widget Options plugin <= 4.1.3 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-27984.md) `CVE-2026-27984` · CVE record: Marketing Fire Widget Options · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Code injection - [WordPress Builderall Builder for WordPress plugin <= 3.0.1 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-22390.md) `CVE-2026-22390` · CVE record: Builderall Builderall Builder for WordPress · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Code injection - [An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files.](https://agentprime.io/advisories/CVE-2025-70995.md) `CVE-2025-70995` · CVE record · CVSS 8.8 High · Not analysed yet · Published 5 Mar 2026 · Tags: Code injection - [changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()](https://agentprime.io/advisories/GHSA-6fmw-82m7-jq6p.md) `GHSA-6fmw-82m7-jq6p`, `CVE-2026-29039`, `PYSEC-2026-2128` · PyPI `changedetection-io`: affected `<0.54.4`, fixed in `0.54.4` · CVSS 8.8 High · Not analysed yet · Published 4 Mar 2026 · Tags: Code injection - [locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection](https://agentprime.io/advisories/GHSA-fp25-p6mj-qqg6.md) `GHSA-fp25-p6mj-qqg6`, `CVE-2026-29091` · npm `locutus`: affected `<3.0.0`, fixed in `3.0.0` · CVSS 8.1 High · Not analysed yet · Published 4 Mar 2026 · Tags: Code injection - [Client Isolation Bypass via GTK Manipulation](https://agentprime.io/advisories/CVE-2026-23808.md) `CVE-2026-23808` · CVE record: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8) · CVSS 5.4 Medium · Not analysed yet · Published 4 Mar 2026 · Tags: Code injection - [Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.](https://agentprime.io/advisories/CVE-2025-70341.md) `CVE-2025-70341` · CVE record · CVSS 7.8 High · Not analysed yet · Published 4 Mar 2026 · Tags: Code injection, Broken access control - [OpenClaw hook transform path containment missed symlink-resolved escapes](https://agentprime.io/advisories/GHSA-659f-22xc-98f2.md) `GHSA-659f-22xc-98f2` · npm `openclaw`: affected `<2026.2.22`, fixed in `2026.2.22` · CVSS 4.0, no score published · Not analysed yet · Published 3 Mar 2026 · Tags: Code injection - [Craft CMS has potential authenticated Remote Code Execution via Twig SSTI](https://agentprime.io/advisories/GHSA-qc86-q28f-ggww.md) `GHSA-qc86-q28f-ggww`, `CVE-2026-28784`, `PKSA-q22m-n7fg-cqgy` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1, <4.17.0-beta.1 || >=5.0.0-RC1, <5.9.0-beta.1`, fixed in `4.17.0-beta.1`, `5.9.0-beta.1` · CVSS 8.6 High · Not analysed yet · Published 3 Mar 2026 · Tags: Code injection - [Craft CMS has Twig Function Blocklist Bypass](https://agentprime.io/advisories/GHSA-5fvc-7894-ghp4.md) `GHSA-5fvc-7894-ghp4`, `CVE-2026-28783`, `PKSA-x1f7-3vrt-jvfj` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1, <4.17.0-beta.1 || >=5.0.0-RC1, <5.9.0-beta.1`, fixed in `4.17.0-beta.1`, `5.9.0-beta.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2026 · Tags: Code injection, CWE-184 - [Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates](https://agentprime.io/advisories/GHSA-v47q-jxvr-p68x.md) `GHSA-v47q-jxvr-p68x`, `CVE-2026-28697`, `PKSA-jqb9-4xf5-mdn1` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1, <4.17.0-beta.1 || >=5.0.0-RC1, <5.9.0-beta.1`, fixed in `4.17.0-beta.1`, `5.9.0-beta.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2026 · Tags: Code injection - [Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget](https://agentprime.io/advisories/GHSA-94rc-cqvm-m4pw.md) `GHSA-94rc-cqvm-m4pw`, `CVE-2026-28695`, `PKSA-n7dz-mnbq-y23y` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1, <4.17.0-beta.1 || >=5.8.7, <5.9.0-beta.1`, fixed in `4.17.0-beta.1`, `5.9.0-beta.1` · CVSS 7.5 High · Not analysed yet · Published 3 Mar 2026 · Tags: Path traversal, Code injection - [Apache Ranger has a Code Injection vulnerability](https://agentprime.io/advisories/GHSA-c87w-642h-m97h.md) `GHSA-c87w-642h-m97h`, `CVE-2025-59059` · Maven `org.apache.ranger:ranger-plugins-common`: affected `<2.8.0`, fixed in `2.8.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2026 · Tags: Code injection - [Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI Name parameter.](https://agentprime.io/advisories/CVE-2024-55022.md) `CVE-2024-55022` · CVE record · CVSS 8.8 High · Not analysed yet · Published 3 Mar 2026 · Tags: Code injection - [An issue was discovered in Nokia Impact before Mobile 23_FP1.](https://agentprime.io/advisories/CVE-2023-31044.md) `CVE-2023-31044` · CVE record · CVSS 2.0 Low · Not analysed yet · Published 3 Mar 2026 · Tags: Code injection - [AFFiNE: One-click Remote Code Execution through Custom URL Handling](https://agentprime.io/advisories/CVE-2026-21853.md) `CVE-2026-21853` · CVE record: toeverything AFFiNE · CVSS 8.8 High · Not analysed yet · Published 2 Mar 2026 · Tags: Code injection - [Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview](https://agentprime.io/advisories/CVE-2026-3132.md) `CVE-2026-3132` · CVE record: Jewel Theme Master Addons for Elementor Premium · CVSS 8.8 High · Not analysed yet · Published 2 Mar 2026 · Tags: Code injection - [Chamilo: Evaluation of untrusted user input leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2025-50187.md) `CVE-2025-50187` · CVE record: chamilo chamilo-lms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Mar 2026 · Tags: Code injection - [itsourcecode University Management System att_single_view.php cross site scripting](https://agentprime.io/advisories/CVE-2026-3412.md) `CVE-2026-3412` · CVE record: itsourcecode University Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [eosphoros-ai db-gpt Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection](https://agentprime.io/advisories/CVE-2026-3409.md) `CVE-2026-3409` · CVE record: eosphoros-ai db-gpt · CVSS 6.9 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Other injection, Code injection - [PHPGurukul Student Record Management System edit-subject.php cross site scripting](https://agentprime.io/advisories/CVE-2026-3403.md) `CVE-2026-3403` · CVE record: PHPGurukul Student Record Management System · CVSS 4.8 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [PHPGurukul Student Record Management System edit-course.php cross site scripting](https://agentprime.io/advisories/CVE-2026-3402.md) `CVE-2026-3402` · CVE record: PHPGurukul Student Record Management System · CVSS 4.8 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.](https://agentprime.io/advisories/CVE-2026-26720.md) `CVE-2026-26720` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Mar 2026 · Tags: Code injection - [sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin_change_picture.php.](https://agentprime.io/advisories/CVE-2026-26699.md) `CVE-2026-26699` · CVE record · CVSS 7.2 High · Not analysed yet · Published 2 Mar 2026 · Tags: Code injection - [An issue was discovered in Tenda W20E V4.0br_V15.11.0.6.](https://agentprime.io/advisories/CVE-2026-24107.md) `CVE-2026-24107` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Mar 2026 · Tags: Code injection - [An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi.](https://agentprime.io/advisories/CVE-2026-24105.md) `CVE-2026-24105` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Mar 2026 · Tags: Code injection - [MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection](https://agentprime.io/advisories/CVE-2026-3395.md) `CVE-2026-3395` · CVE record: MaxSite CMS · CVSS 6.9 Medium · Not analysed yet · Published 1 Mar 2026 · Tags: Other injection, Code injection - [Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs](https://agentprime.io/advisories/GHSA-cpv7-q2wx-m8rw.md) `GHSA-cpv7-q2wx-m8rw`, `CVE-2026-28425`, `PKSA-skzr-by55-tmc5` · Packagist `statamic/cms`: affected `<5.73.16 || >=6.0.0-alpha.1, <6.7.2`, fixed in `5.73.16`, `6.7.2` · CVSS 8.0 High · Not analysed yet · Published 1 Mar 2026 · Tags: Code injection - [Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()](https://agentprime.io/advisories/GHSA-5c6j-r48x-rmvq.md) `GHSA-5c6j-r48x-rmvq` · npm `serialize-javascript`: affected `<7.0.3`, fixed in `7.0.3` · CVSS 8.1 High · Not analysed yet · Published 28 Feb 2026 · Tags: Code injection - [OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)](https://agentprime.io/advisories/GHSA-82g8-464f-2mv7.md) `GHSA-82g8-464f-2mv7`, `CVE-2026-4039` · npm `openclaw`: affected `<2026.2.21`, fixed in `2026.2.21` · CVSS 5.3 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Other injection, Code injection, CWE-15, CWE-1341 - [Langflow has Remote Code Execution in CSV Agent](https://agentprime.io/advisories/GHSA-3645-fxcv-hqr4.md) `GHSA-3645-fxcv-hqr4`, `CVE-2026-27966`, `PYSEC-2026-376` · PyPI `langflow`: affected `<=1.8.0rc2`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.35 · Not analysed yet · Published 27 Feb 2026 · Tags: Code injection - [Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2026-21658.md) `CVE-2026-21658` · CVE record: Johnson Controls Frick Controls Quantum HD · CVSS 8.8 High · Not analysed yet · Published 27 Feb 2026 · Tags: Code injection - [Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2026-21657.md) `CVE-2026-21657` · CVE record: Johnson Controls Frick Controls Quantum HD · CVSS 8.8 High · Not analysed yet · Published 27 Feb 2026 · Tags: Code injection - [Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2026-21656.md) `CVE-2026-21656` · CVE record: Johnson Controls Frick Controls Quantum HD · CVSS 8.8 High · Not analysed yet · Published 27 Feb 2026 · Tags: Code injection - [SourceCodester Doctor Appointment System Sign Up register.php cross site scripting](https://agentprime.io/advisories/CVE-2026-3302.md) `CVE-2026-3302` · CVE record: SourceCodester Doctor Appointment System · CVSS 5.3 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Cross-site scripting (XSS), Code injection - [Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/CVE-2026-26938.md) `CVE-2026-26938` · CVE record: Elastic Kibana · CVSS 8.6 High · Not analysed yet · Published 26 Feb 2026 · Tags: Code injection - [Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the ...](https://agentprime.io/advisories/GHSA-cfr2-mp74-3763.md) `GHSA-cfr2-mp74-3763`, `CVE-2026-27961`, `PYSEC-2026-7` · PyPI `agenta`: affected `<0.86.8`, fixed in `0.86.8` · CVSS 8.8 High · Not analysed yet · Published 26 Feb 2026 · Tags: Code injection - [Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluator. Agenta used RestrictedPython as a s...](https://agentprime.io/advisories/GHSA-pmgp-2m3v-34mq.md) `GHSA-pmgp-2m3v-34mq`, `CVE-2026-27952`, `PYSEC-2026-6` · PyPI `agenta`: affected `<0.48.1`, fixed in `0.48.1` · CVSS 8.8 High · Not analysed yet · Published 26 Feb 2026 · Tags: Code injection - [An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java component](https://agentprime.io/advisories/CVE-2026-26682.md) `CVE-2026-26682` · CVE record · CVSS 7.8 High · Not analysed yet · Published 26 Feb 2026 · Tags: Code injection - [n8n: Expression Sandbox Escape Leads to RCE](https://agentprime.io/advisories/GHSA-vpcf-gvg4-6qwr.md) `GHSA-vpcf-gvg4-6qwr`, `CVE-2026-27577` · npm `n8n`: affected `<1.123.22 || >=2.0.0, <2.9.3 || >=2.10.0, <2.10.1`, fixed in `1.123.22`, `2.9.3`, `2.10.1` · CVSS 9.4 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 25 Feb 2026 · Tags: Code injection - [n8n has Arbitrary Command Execution via File Write and Git Operations](https://agentprime.io/advisories/GHSA-x2mw-7j39-93xq.md) `GHSA-x2mw-7j39-93xq`, `CVE-2026-27498` · npm `n8n`: affected `<1.123.8 || >=2.0.0, <2.2.0`, fixed in `1.123.8`, `2.2.0` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Feb 2026 · Tags: Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .