# Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes](https://agentprime.io/advisories/CVE-2017-20285.md)
  `CVE-2017-20285` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection, Insecure deserialization
- [osCommerce osCommerce2 Newsletter Management newsletters.php include code injection](https://agentprime.io/advisories/CVE-2026-105226.md)
  `CVE-2026-105226` · CVE record: osCommerce osCommerce2 · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, Code injection
- [osCommerce osCommerce2 Payment payment.php include code injection](https://agentprime.io/advisories/CVE-2026-105225.md)
  `CVE-2026-105225` · CVE record: osCommerce osCommerce2 · CVSS 4.8 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, Code injection
- [code-projects Human Resource Management System Live Event History liveEventHistory.php cross site scripting](https://agentprime.io/advisories/CVE-2026-105188.md)
  `CVE-2026-105188` · CVE record: code-projects Human Resource Management System · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Human Resource Management Event Creation EventStore.php cross site scripting](https://agentprime.io/advisories/CVE-2026-105173.md)
  `CVE-2026-105173` · CVE record: code-projects Human Resource Management · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export.](https://agentprime.io/advisories/CVE-2026-88393.md)
  `CVE-2026-88393` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection
- [Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/\*\*, so /h2-console is exposed with no authentication and t…](https://agentprime.io/advisories/CVE-2026-88391.md)
  `CVE-2026-88391` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection
- [InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection](https://agentprime.io/advisories/CVE-2026-105135.md)
  `CVE-2026-105135` · CVE record: InternLM MindSearch · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, Code injection
- [Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting](https://agentprime.io/advisories/CVE-2026-105099.md)
  `CVE-2026-105099` · CVE record: Omega Solution CoinEx Crypto · CVSS 5.1 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output](https://agentprime.io/advisories/CVE-2026-92084.md)
  `CVE-2026-92084` · CVE record: beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Oct 2026 · Tags: Code injection
- [WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)](https://agentprime.io/advisories/CVE-2026-100157.md)
  `CVE-2026-100157` · CVE record: roxnor WP Ultimate Review · CVSS 6.5 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Code injection
- [WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter](https://agentprime.io/advisories/CVE-2026-103519.md)
  `CVE-2026-103519` · CVE record: roxnor WP Ultimate Review · CVSS 5.4 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Code injection
- [All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter](https://agentprime.io/advisories/CVE-2026-100152.md)
  `CVE-2026-100152` · CVE record: smub All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) · CVSS 6.5 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Code injection
- [Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection v…](https://agentprime.io/advisories/CVE-2026-92536.md)
  `CVE-2026-92536` · CVE record: properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress · CVSS 8.8 High · Not analysed yet · Published 3 Oct 2026 · Tags: Code injection
- [Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF](https://agentprime.io/advisories/GHSA-jqmf-mx4f-hfr6.md)
  `GHSA-jqmf-mx4f-hfr6`, `CVE-2026-114107` · PyPI `vibe-trading-ai`: affected `>=0.1.0, <0.1.7`, fixed in `0.1.7` · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Command injection, Code injection, Server-side request forgery (SSRF), CWE-116
- [Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway](https://agentprime.io/advisories/CVE-2026-90970.md)
  `CVE-2026-90970` · CVE record: GitLab GitLab AI Gateway · CVSS 9.9 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.17 · Not analysed yet · Published 2 Oct 2026 · Tags: Code injection
- [SourceCodester Student Result Management System Announcement new_announcement.php cross site scripting](https://agentprime.io/advisories/CVE-2026-104612.md)
  `CVE-2026-104612` · CVE record: SourceCodester Student Result Management System · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution](https://agentprime.io/advisories/CVE-2026-10026.md)
  `CVE-2026-10026` · CVE record: CTX CTX Feed Pro · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Code injection
- [agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/\_coding/\_shell.py).](https://agentprime.io/advisories/CVE-2026-51922.md)
  `CVE-2026-51922` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Code injection
- [FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().](https://agentprime.io/advisories/CVE-2026-51918.md)
  `CVE-2026-51918` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Code injection
- [FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code.](https://agentprime.io/advisories/CVE-2026-51917.md)
  `CVE-2026-51917` · CVE record · CVSS 7.3 High · Not analysed yet · Published 2 Oct 2026 · Tags: Code injection
- [vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py).](https://agentprime.io/advisories/CVE-2026-51911.md)
  `CVE-2026-51911` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Code injection
- [sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.](https://agentprime.io/advisories/CVE-2026-51898.md)
  `CVE-2026-51898` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Code injection
- [NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files](https://agentprime.io/advisories/CVE-2026-55251.md)
  `CVE-2026-55251` · CVE record: netbox-community devicetype-library · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Code injection, CWE-494, CWE-829
- [Foreman: foreman: arbitrary code execution via safemode sandbox bypass](https://agentprime.io/advisories/CVE-2026-96658.md)
  `CVE-2026-96658` · CVE record: Red Hat Red Hat Satellite 6.16 for RHEL 8 and 4 more · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2026 · Tags: Code injection
- [vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection](https://agentprime.io/advisories/GHSA-647f-g98j-qq25.md)
  `GHSA-647f-g98j-qq25`, `CVE-2026-92937` · npm `vm2`: affected `>=3.11.6, <3.11.7`, fixed in `3.11.7` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Code injection, CWE-693
- [JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)](https://agentprime.io/advisories/GHSA-3jqq-pw4j-pqcj.md)
  `GHSA-3jqq-pw4j-pqcj`, `CVE-2026-102830`, `PYSEC-2026-4056`, `PYSEC-2026-4059` · PyPI `jupyterlab` and 1 more: affected `>=3.0.0, <4.5.11 || >=4.6.0, <4.6.4`, fixed in `4.5.11`, `4.6.4` · CVSS 6.8 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-625
- [rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting](https://agentprime.io/advisories/CVE-2026-103686.md)
  `CVE-2026-103686` · CVE record: rhukster dom-sanitizer · CVSS 5.1 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine](https://agentprime.io/advisories/CVE-2026-103540.md)
  `CVE-2026-103540` · CVE record: formtools.org Form Tools · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Code injection, CWE-791
- [Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field](https://agentprime.io/advisories/CVE-2026-92966.md)
  `CVE-2026-92966` · CVE record: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Code injection
- [deeptutor 1.4.0 contains code injection in ExecTool.execute.](https://agentprime.io/advisories/CVE-2026-51881.md)
  `CVE-2026-51881` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Code injection
- [GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution](https://agentprime.io/advisories/GHSA-239g-whfq-7xj9.md)
  `GHSA-239g-whfq-7xj9`, `CVE-2026-87817`, `PYSEC-2026-3982` · PyPI `gitpython`: affected `<3.1.60`, fixed in `3.1.60` · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection, CWE-427
- [Kiteworks Email Protection Gateway Remote Code Execution](https://agentprime.io/advisories/CVE-2026-102130.md)
  `CVE-2026-102130` · CVE record: Kiteworks Email Protection Gateway · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection, Unrestricted file upload
- [Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity](https://agentprime.io/advisories/CVE-2026-102131.md)
  `CVE-2026-102131` · CVE record: Kiteworks Email Protection Gateway · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection, CWE-178
- [Kiteworks Core Remote Code Execution through Server-Side Template Injection](https://agentprime.io/advisories/CVE-2026-102142.md)
  `CVE-2026-102142` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [Kiteworks Email Protection Gateway remote code execution](https://agentprime.io/advisories/CVE-2026-102097.md)
  `CVE-2026-102097` · CVE record: Kiteworks Email Protection Gateway · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal, Code injection
- [Kiteworks Email Protection Gateway unsafe reflection](https://agentprime.io/advisories/CVE-2026-102094.md)
  `CVE-2026-102094` · CVE record: Kiteworks Email Protection Gateway · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [Taskcluster: Unauthenticated remote code execution in \`web-server\` via GraphQL \`filter\` argument (sift \`$where\`)](https://agentprime.io/advisories/CVE-2026-55094.md)
  `CVE-2026-55094` · CVE record: taskcluster taskcluster · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection, Privilege escalation, Authentication bypass, CWE-20
- [WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-96349.md)
  `CVE-2026-96349` · CVE record: SiteSkite SiteSkite · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-94389.md)
  `CVE-2026-94389` · CVE record: AcyMailing Newsletter Team AcyMailing SMTP Newsletter · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.](https://agentprime.io/advisories/CVE-2026-87830.md)
  `CVE-2026-87830` · CVE record: Apache Software Foundation Apache WSS4J · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [Moodle: arbitrary class instantiation via report builder audience classname](https://agentprime.io/advisories/CVE-2026-102580.md)
  `CVE-2026-102580` · CVE record · CVSS 2.2 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [gedelumbung HospitalManagement Guest Book buku_tamu.php kirim cross site scripting](https://agentprime.io/advisories/CVE-2026-102847.md)
  `CVE-2026-102847` · CVE record: gedelumbung HospitalManagement · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.](https://agentprime.io/advisories/CVE-2026-51872.md)
  `CVE-2026-51872` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct executi…](https://agentprime.io/advisories/CVE-2026-51871.md)
  `CVE-2026-51871` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.](https://agentprime.io/advisories/CVE-2026-51866.md)
  `CVE-2026-51866` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.](https://agentprime.io/advisories/CVE-2026-51861.md)
  `CVE-2026-51861` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary.](https://agentprime.io/advisories/CVE-2026-51858.md)
  `CVE-2026-51858` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary.](https://agentprime.io/advisories/CVE-2026-51857.md)
  `CVE-2026-51857` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python…](https://agentprime.io/advisories/CVE-2026-51856.md)
  `CVE-2026-51856` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution](https://agentprime.io/advisories/CVE-2026-86131.md)
  `CVE-2026-86131` · CVE record: WatchGuard Fireware OS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Code injection, Weak cryptography or TLS, CWE-829
- [Naichen ThinkCMF Email Template MailController.php templatePut special elements in template engine](https://agentprime.io/advisories/CVE-2026-102771.md)
  `CVE-2026-102771` · CVE record: Naichen ThinkCMF · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Code injection, CWE-791
- [Toptech TMS7 and TopHAT Eval Injection](https://agentprime.io/advisories/CVE-2026-69662.md)
  `CVE-2026-69662` · CVE record: Toptech Systems TMS7 and 1 more · CVSS 2.1 Low · Not analysed yet · Published 29 Sept 2026 · Tags: Code injection
- [PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()](https://agentprime.io/advisories/GHSA-r6hr-vr92-vv28.md)
  `GHSA-r6hr-vr92-vv28`, `CVE-2026-65954`, `PKSA-kh6k-gs3g-dgr6` · Packagist `phpcsstandards/phpcsutils`: affected `>=1.0.0-alpha1, <1.2.3`, fixed in `1.2.3` · CVSS 8.6 High · Not analysed yet · Published 29 Sept 2026 · Tags: Code injection
- [Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4](https://agentprime.io/advisories/CVE-2026-102425.md)
  `CVE-2026-102425` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Code injection
- [GluonTS arbitrary command execution during model deserialization](https://agentprime.io/advisories/CVE-2026-100308.md)
  `CVE-2026-100308` · CVE record: AWS gluonts · CVSS 8.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: Code injection, Insecure deserialization
- [Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x](https://agentprime.io/advisories/CVE-2026-84154.md)
  `CVE-2026-84154` · CVE record: Dassault Systèmes GEOVIA Geospatial Data Manager · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Code injection
- [coolbeans1212 MateisHomePage-Website users.php cross site scripting](https://agentprime.io/advisories/CVE-2026-102292.md)
  `CVE-2026-102292` · CVE record: coolbeans1212 MateisHomePage-Website · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting](https://agentprime.io/advisories/CVE-2026-102290.md)
  `CVE-2026-102290` · CVE record: CodeCanyon Rocket LMS · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [mwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting](https://agentprime.io/advisories/CVE-2026-102264.md)
  `CVE-2026-102264` · CVE record: mwasikz robo-cafe-rms · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection

Newest: <https://agentprime.io/advisories/tag/code-injection.md>
Older: <https://agentprime.io/advisories/tag/code-injection.md?cursor=WyIyMDI2LTA5LTI5VDA0OjMwOjEzLjk2ODAwMFoiLCJDVkUtMjAyNi0xMDIyNjQiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=code-injection&cursor=WyIyMDI2LTEwLTA1VDA4OjM0OjM4LjEwMjAwMFoiLCJDVkUtMjAyNi0xMDQ4MTEiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/code-injection/?cursor=WyIyMDI2LTEwLTA1VDA4OjM0OjM4LjEwMjAwMFoiLCJDVkUtMjAyNi0xMDQ4MTEiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.