# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [code-projects Simple Laundry System Parameter modify.php cross site scripting](https://agentprime.io/advisories/CVE-2026-4849.md) `CVE-2026-4849` · CVE record: code-projects Simple Laundry System · CVSS 5.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml](https://agentprime.io/advisories/GHSA-jfjg-vc52-wqvf.md) `GHSA-jfjg-vc52-wqvf`, `CVE-2026-33744`, `PYSEC-2026-157` · PyPI `bentoml`: affected `<1.4.37`, fixed in `1.4.37` · CVSS 7.8 High · Not analysed yet · Published 26 Mar 2026 · Tags: Code injection - [dameng100 muucmf list.html cross site scripting](https://agentprime.io/advisories/CVE-2026-4848.md) `CVE-2026-4848` · CVE record: dameng100 muucmf · CVSS 5.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [dameng100 muucmf list.html cross site scripting](https://agentprime.io/advisories/CVE-2026-4847.md) `CVE-2026-4847` · CVE record: dameng100 muucmf · CVSS 5.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [dameng100 muucmf autoReply.html cross site scripting](https://agentprime.io/advisories/CVE-2026-4846.md) `CVE-2026-4846` · CVE record: dameng100 muucmf · CVSS 5.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [dameng100 muucmf index.html cross site scripting](https://agentprime.io/advisories/CVE-2026-4845.md) `CVE-2026-4845` · CVE record: dameng100 muucmf · CVSS 5.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Accounting System Web Application add_costumer.php cross site scripting](https://agentprime.io/advisories/CVE-2026-4835.md) `CVE-2026-4835` · CVE record: code-projects Accounting System · CVSS 5.1 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.](https://agentprime.io/advisories/CVE-2026-30457.md) `CVE-2026-30457` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Mar 2026 · Tags: Code injection - [n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode](https://agentprime.io/advisories/GHSA-58qr-rcgv-642v.md) `GHSA-58qr-rcgv-642v`, `CVE-2026-33660` · npm `n8n`: affected `<1.123.27 || >=2.0.0-rc.0, <2.13.3 || >=2.14.0, <2.14.1`, fixed in `1.123.27`, `2.13.3`, `2.14.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: SQL injection, Code injection - [thumbler allows OS Command Injection](https://agentprime.io/advisories/GHSA-mvhf-547c-h55r.md) `GHSA-mvhf-547c-h55r`, `CVE-2026-26833` · npm `thumbler`: affected `<=1.1.2`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Command injection, Code injection - [textract is vulnerable to OS Command Injection](https://agentprime.io/advisories/GHSA-9pcj-m5rr-p28g.md) `GHSA-9pcj-m5rr-p28g`, `CVE-2026-26831` · npm `textract`: affected `<=2.5.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Command injection, Code injection - [WordPress Nelio AB Testing plugin <= 8.2.7 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-32573.md) `CVE-2026-32573` · CVE record: Nelio Software Nelio AB Testing · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Code injection - [WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-32525.md) `CVE-2026-32525` · CVE record: jetmonsters JetFormBuilder · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Code injection - [WordPress Total Poll Lite plugin <= 4.12.0 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-27044.md) `CVE-2026-27044` · CVE record: TotalSuite Total Poll Lite · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Code injection - [WordPress Widget Wrangler plugin <= 2.3.9 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-25447.md) `CVE-2026-25447` · CVE record: Jonathan Daggerhart Widget Wrangler · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Code injection - [WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-25366.md) `CVE-2026-25366` · CVE record: Themeisle Woody ad snippets · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Code injection - [WordPress Post Snippets plugin <= 4.0.12 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-25001.md) `CVE-2026-25001` · CVE record: Saad Iqbal Post Snippets · CVSS 8.5 High · Not analysed yet · Published 25 Mar 2026 · Tags: Code injection - [pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter](https://agentprime.io/advisories/GHSA-q5mh-72xg-628w.md) `GHSA-q5mh-72xg-628w`, `CVE-2026-26830` · npm `pdf-image`: affected `<=2.0.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: Command injection, Code injection - [A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution](https://agentprime.io/advisories/GHSA-w5pc-m664-r62v.md) `GHSA-w5pc-m664-r62v`, `CVE-2026-33622`, `GO-2026-4824` · Go `github.com/pinchtab/pinchtab` and 1 more: affected `>=0.8.3`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Code injection, Broken access control, CWE-693 - [Unauthenticated arbitrary PHP class instantiation](https://agentprime.io/advisories/CVE-2026-23923.md) `CVE-2026-23923` · CVE record: Zabbix Zabbix · CVSS 6.9 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Code injection - [Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior](https://agentprime.io/advisories/GHSA-2fph-6v5w-89hh.md) `GHSA-2fph-6v5w-89hh`, `CVE-2026-33157`, `PKSA-twkq-r2c1-87qq` · Packagist `craftcms/cms`: affected `>=5.6.0, <5.9.13`, fixed in `5.9.13` · CVSS 8.6 High · Not analysed yet · Published 24 Mar 2026 · Tags: Code injection - [Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation](https://agentprime.io/advisories/CVE-2026-33336.md) `CVE-2026-33336` · CVE record: go-vikunja vikunja · CVSS 6.5 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Code injection - [Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration](https://agentprime.io/advisories/CVE-2026-33334.md) `CVE-2026-33334` · CVE record: go-vikunja vikunja · CVSS 6.5 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Code injection, Privilege escalation - [Arbitrary Code Execution via Crafted Bytecode in dendibakh/perf-ninja](https://agentprime.io/advisories/CVE-2026-4745.md) `CVE-2026-4745` · CVE record: dendibakh perf-ninja · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Code injection - [projectworlds Lawyer Management System lawyer_booking.php cross site scripting](https://agentprime.io/advisories/CVE-2026-4626.md) `CVE-2026-4626` · CVE record: projectworlds Lawyer Management System · CVSS 5.1 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [bolo-blog Article Title article cross site scripting](https://agentprime.io/advisories/CVE-2026-4616.md) `CVE-2026-4616` · CVE record: bolo-blog · CVSS 4.8 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula](https://agentprime.io/advisories/CVE-2026-4001.md) `CVE-2026-4001` · CVE record: acowebs Woocommerce Custom Product Addons Pro · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Mar 2026 · Tags: Code injection - [Critical Remote Code Execution vulnerability reported in Windchill](https://agentprime.io/advisories/CVE-2026-4681.md) `CVE-2026-4681` · CVE record: PTC Windchill PDMLink and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Mar 2026 · Tags: Code injection - [Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin](https://agentprime.io/advisories/GHSA-hxqw-6qv7-cqfv.md) `GHSA-hxqw-6qv7-cqfv`, `CVE-2026-32276`, `PKSA-41bx-mcct-sk3j` · Packagist `opensource-workshop/connect-cms`: affected `<1.41.1 || >=2.0.0, <2.41.1`, fixed in `1.41.1`, `2.41.1` · CVSS 8.8 High · Not analysed yet · Published 23 Mar 2026 · Tags: Code injection - [projectworlds Lawyer Management System lawyers.php cross site scripting](https://agentprime.io/advisories/CVE-2026-4596.md) `CVE-2026-4596` · CVE record: projectworlds Lawyer Management System · CVSS 5.1 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Exam Form Submission update_s6.php cross site scripting](https://agentprime.io/advisories/CVE-2026-4595.md) `CVE-2026-4595` · CVE record: code-projects Exam Form Submission · CVSS 4.8 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint](https://agentprime.io/advisories/GHSA-fh3m-562m-w4f6.md) `GHSA-fh3m-562m-w4f6`, `CVE-2026-24516`, `GO-2026-4854` · Go `github.com/digitalocean/droplet-agent`: affected `<=0.0.0-20260107162243-1101ffcb5672`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 23 Mar 2026 · Tags: Command injection, Code injection - [code-projects Exam Form Submission update_s3.php cross site scripting](https://agentprime.io/advisories/CVE-2026-4578.md) `CVE-2026-4578` · CVE record: code-projects Exam Form Submission · CVSS 4.8 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Exam Form Submission update_s4.php cross site scripting](https://agentprime.io/advisories/CVE-2026-4577.md) `CVE-2026-4577` · CVE record: code-projects Exam Form Submission · CVSS 4.8 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Exam Form Submission update_s5.php cross site scripting](https://agentprime.io/advisories/CVE-2026-4576.md) `CVE-2026-4576` · CVE record: code-projects Exam Form Submission · CVSS 4.8 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Exam Form Submission update_s2.php cross site scripting](https://agentprime.io/advisories/CVE-2026-4575.md) `CVE-2026-4575` · CVE record: code-projects Exam Form Submission · CVSS 4.8 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Limited Remote Code Execution](https://agentprime.io/advisories/CVE-2025-10679.md) `CVE-2025-10679` · CVE record: reviewx ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema · CVSS 7.3 High · Not analysed yet · Published 23 Mar 2026 · Tags: Code injection - [yangzongzhuan RuoYi Quartz Job job code injection](https://agentprime.io/advisories/CVE-2026-4564.md) `CVE-2026-4564` · CVE record: yangzongzhuan RuoYi · CVSS 5.1 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: Other injection, Code injection - [code-projects Exam Form Submission update_s1.php cross site scripting](https://agentprime.io/advisories/CVE-2026-4557.md) `CVE-2026-4557` · CVE record: code-projects Exam Form Submission · CVSS 5.3 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [Wavlink WL-WN578W2 POST Request login.cgi cross site scripting](https://agentprime.io/advisories/CVE-2026-4544.md) `CVE-2026-4544` · CVE record: Wavlink WL-WN578W2 · CVSS 4.8 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [Foundation Agents MetaGPT operator.py code_generate code injection](https://agentprime.io/advisories/CVE-2026-4515.md) `CVE-2026-4515` · CVE record: Foundation Agents MetaGPT · CVSS 5.3 Medium · Not analysed yet · Published 21 Mar 2026 · Tags: Other injection, Code injection - [PbootCMS Parameter MemberController.php alert_location cross site scripting](https://agentprime.io/advisories/CVE-2026-4510.md) `CVE-2026-4510` · CVE record: PbootCMS · CVSS 5.3 Medium · Not analysed yet · Published 21 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter](https://agentprime.io/advisories/CVE-2026-4004.md) `CVE-2026-4004` · CVE record: eoxia Task Manager · CVSS 6.5 Medium · Not analysed yet · Published 21 Mar 2026 · Tags: Code injection - [Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2024-13785.md) `CVE-2024-13785` · CVE record: reputeinfosystems Contact Form, Survey, Quiz & Popup Form Builder – ARForms · CVSS 5.6 Medium · Not analysed yet · Published 21 Mar 2026 · Tags: Code injection - [MindSQL is vulnerable to Code Injection through its ask_db function](https://agentprime.io/advisories/GHSA-m6m4-34cj-4hh7.md) `GHSA-m6m4-34cj-4hh7`, `CVE-2026-4506`, `PYSEC-2026-2649` · PyPI `mindsql`: affected `<=0.2.1`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 21 Mar 2026 · Tags: Other injection, Code injection - [Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process](https://agentprime.io/advisories/CVE-2026-3584.md) `CVE-2026-3584` · CVE record: wpchill Kali Forms — Contact Form & Drag-and-Drop Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2026 · Tags: Code injection - [AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin](https://agentprime.io/advisories/GHSA-xggw-g9pm-9qhh.md) `GHSA-xggw-g9pm-9qhh`, `CVE-2026-33479`, `PKSA-4kfk-t6qg-77z2` · Packagist `wwbn/avideo`: affected `<=26.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 20 Mar 2026 · Tags: Code injection - [atjiu pybbs CommentApiController.java create cross site scripting](https://agentprime.io/advisories/CVE-2026-4495.md) `CVE-2026-4495` · CVE record: atjiu pybbs · CVSS 5.1 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [atjiu pybbs TopicApiController.java create cross site scripting](https://agentprime.io/advisories/CVE-2026-4494.md) `CVE-2026-4494` · CVE record: atjiu pybbs · CVSS 5.1 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)](https://agentprime.io/advisories/CVE-2026-33130.md) `CVE-2026-33130` · CVE record: louislam uptime-kuma · CVSS 6.5 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: File inclusion, Code injection - [itsourcecode University Management System admin_single_student_update.php cross site scripting](https://agentprime.io/advisories/CVE-2026-4474.md) `CVE-2026-4474` · CVE record: itsourcecode University Management System · CVSS 4.8 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Cross-site scripting (XSS), Code injection - [SysAK v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd.](https://agentprime.io/advisories/CVE-2024-44722.md) `CVE-2024-44722` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2026 · Tags: Code injection - [SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass](https://agentprime.io/advisories/CVE-2026-29103.md) `CVE-2026-29103` · CVE record: SuiteCRM SuiteCRM · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: Code injection, CWE-358 - [SuiteCRM has Authenticated RCE in Modules](https://agentprime.io/advisories/CVE-2026-29102.md) `CVE-2026-29102` · CVE record: SuiteCRM SuiteCRM · CVSS 7.2 High · Not analysed yet · Published 19 Mar 2026 · Tags: Code injection - [Intake has a Command Injection via shell() Expansion in Parameter Defaults](https://agentprime.io/advisories/GHSA-37g4-qqqv-7m99.md) `GHSA-37g4-qqqv-7m99`, `CVE-2026-33310`, `PYSEC-2026-2185` · PyPI `intake`: affected `<=2.0.9`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 19 Mar 2026 · Tags: Command injection, Code injection - [Langflow has an Arbitrary File Write (RCE) via v2 API](https://agentprime.io/advisories/GHSA-g2j9-7rj2-gm6c.md) `GHSA-g2j9-7rj2-gm6c`, `CVE-2026-33309`, `PYSEC-2026-79` · PyPI `langflow`: affected `>=1.2.0, <1.9.0`, fixed in `1.9.0` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.14 · Not analysed yet · Published 19 Mar 2026 · Tags: Path traversal, Code injection, Broken access control - [An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter component](https://agentprime.io/advisories/CVE-2026-30694.md) `CVE-2026-30694` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: Code injection - [An issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the test connection function](https://agentprime.io/advisories/CVE-2026-30402.md) `CVE-2026-30402` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: Code injection - [OS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint t…](https://agentprime.io/advisories/CVE-2025-67113.md) `CVE-2025-67113` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: Code injection - [dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver](https://agentprime.io/advisories/GHSA-pxrr-hq57-q35p.md) `GHSA-pxrr-hq57-q35p`, `CVE-2026-33154`, `PYSEC-2026-2147` · PyPI `dynaconf`: affected `<3.2.13`, fixed in `3.2.13` · CVSS 7.5 High · Not analysed yet · Published 18 Mar 2026 · Tags: Command injection, Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .