Code injection.

FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia

• signalwire freeswitch
• Command injection
• Code injection

SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection

• SuiteCRM
• Code injection

LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>

• LMFDB
• Code injection

Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

• Code injection

<2.4.3 · fixed in 2.4.3

PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings Files

• PyMoDAQ
• pymodaq_data
• Code injection
• Insecure deserialization

h5io before 0.2.6 Arbitrary Code Execution via read_hdf5

• h5io
• Code injection
• Insecure deserialization

OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`

• tinyhumansai openhuman
• Code injection
• Broken access control

Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading

• Apache Software Foundation Apache OFBiz
• Code injection

Apache OFBiz: Content renderer runs a service name stored on the row

• Apache Software Foundation Apache OFBiz
• Code injection

Apache OFBiz: renderLink compiles link parameters as FreeMarker source

• Apache Software Foundation Apache OFBiz
• Code injection

Apache OFBiz: Unsandboxed Groovy compiled from a service parameter

• Apache Software Foundation Apache OFBiz
• Code injection

Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE

• Apache Software Foundation Apache OFBiz
• Code injection

Apache OFBiz: Unauthenticated RCE via login-page widget injection

• Apache Software Foundation Apache OFBiz
• Code injection

Apache OFBiz: Authenticated Code Execution Vulnerability

• Apache Software Foundation Apache OFBiz
• Broken access control
• Code injection

eosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template engine

• eosphoros-ai DB-GPT
• Code injection
• CWE-791

Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing

• Apache Software Foundation Apache Juneau
• Code injection

eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection

• eosphoros-ai DB-GPT
• Other injection
• Code injection

SourceCodester Online Food Ordering System Category Management add_category.php cross site scripting

• SourceCodester Online Food Ordering System
• Cross-site scripting (XSS)
• Code injection

NPC-Worldwide npcpy sft.py load_sft_model code injection

• NPC-Worldwide npcpy
• Other injection
• Code injection

EmpireSoft EmpireCMS index.php cross site scripting

• EmpireSoft EmpireCMS
• Cross-site scripting (XSS)
• Code injection

InfiniFlow RAGFlow Images API file_utils.py cross site scripting

• InfiniFlow RAGFlow
• Cross-site scripting (XSS)
• Code injection

DataGerry < 3.3.0 SSTI via DocAPI Template Rendering

• DataGerry
• Cross-site scripting (XSS)
• Code injection

Code execution through double evaluation in address replacement rules

• SEPPmail AG SEPPmail Secure Email Gateway (SEG)
• Code injection

Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability

• Quest Foglight for Databases
• Code injection

Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters

• AWS amazon-redshift-jdbc-driver
• Code injection

Report Deserialization Code Execution

• Perforce Puppet Enterprise
• Code injection
• Insecure deserialization

Stanza: RCE via pickle deserialization in the lemmatizer

• Code injection
• Insecure deserialization

>=1.14.0, <1.15.0 · fixed in 1.15.0

fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

• koxudaxi fastapi-code-generator
• Code injection
• CWE-116

fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

• koxudaxi fastapi-code-generator
• Code injection
• CWE-116

fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

• koxudaxi fastapi-code-generator
• Code injection
• CWE-116

Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access

• Cross-site scripting (XSS)
• Code injection

<1.0.1 · fixed in 1.0.1

Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

• Code injection
• CWE-116

<1.0.1 · fixed in 1.0.1

Elo backends have code injection via unvalidated emission of programmatic AST fields

• SQL injection
• Code injection

<1.0.1 · fixed in 1.0.1

Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection

• Ziroom ZHOME A0101
• Other injection
• Code injection

AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone

• AzuraCast
• Code injection

Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting

• Welcart e-Commerce Plugin
• Cross-site scripting (XSS)
• Code injection

s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter

• clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
• Code injection

Template injection in the publishing component of awslabs Virtual Engineering Workbench

• AWS virtual-engineering-workbench
• Code injection

Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1

• regularlabs.com Sourcerer Free extension for Joomla
• regularlabs.com Sourcerer Pro extension for Joomla
• Code injection

Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5

• php-web-design.com StageIt extension for Joomla
• Code injection

dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection

• dayrui XunRuiCMS
• Other injection
• Code injection

dayrui XunRuiCMS Email Template Rendering Notice.php _get_tpl_content code injection

• dayrui XunRuiCMS
• Other injection
• Code injection

mathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scripting

• mathurvishal CloudClassroom-PHP-Project
• Cross-site scripting (XSS)
• Code injection

mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php cross site scripting

• mathurvishal CloudClassroom-PHP-Project
• Cross-site scripting (XSS)
• Code injection

beecue FastBee Groovy Script Executor script code injection

• beecue FastBee
• Other injection
• Code injection

Ruijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scripting

• Ruijie RG-ES205GC
• Ruijie RG-ES206GC-P
• Cross-site scripting (XSS)
• Code injection

Prefab UI Pyodide sandbox escape to host RCE

• PrefectHQ prefab-ui
• Code injection
• Privilege escalation

Typemill SvgSanitizer.php saveImage cross site scripting

• Typemill
• Cross-site scripting (XSS)
• Code injection

PostyBirb Plus Submission Description Editor DescriptionInput.tsx cross site scripting

• PostyBirb Plus
• Cross-site scripting (XSS)
• Code injection

ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates

• ShowDoc
• Code injection

Konflux-ci: remote code execution via eval() in manifest scripts

• Code injection

Konflux-ci: jq filter injection in github workflow issue management

• Code injection

Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag

• kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
• Code injection

Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name

• kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
• Code injection

TAKO AI Agent for Okta: Authenticated Python execution through validator bypass

• fctr-id okta-ai-agent
• Code injection

Refitter: C# source injection through OpenAPI header parameter names

• christianhelle refitter
• Code injection
• CWE-116

Refitter: C# source injection through OpenAPI content-type map keys

• christianhelle refitter
• Code injection
• CWE-116

Refitter: C# source injection through OpenAPI path keys

• christianhelle refitter
• Code injection
• CWE-1116

ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks

• mqttsnet thinglinks
• Command injection
• Code injection

OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy

• osac-project osac-operator
• Code injection
• Server-side request forgery (SSRF)