Advisories · Weakness

Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-46059 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

langchain-ai v0.3.51 was discovered to contain an indirect prompt injection vulnerability in the GmailToolkit component.
- Code injection
Not analysed yet 29 Jul 2025
CVE-2025-4056 CVE record

CVSS 7.5 High

Glib: glib crash after long command line
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Code injection
Not analysed yet 28 Jul 2025
CVE-2025-8222 CVE record

CVSS 5.1 Medium

jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java cross site scripting
- jerryshensjf JPACookieShop 蛋糕商城JPA版
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Jul 2025
CVE-2025-8221 CVE record

CVSS 5.3 Medium

jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsCustController.java goodsSearch cross site scripting
- jerryshensjf JPACookieShop 蛋糕商城JPA版
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Jul 2025
CVE-2025-8211 CVE record

CVSS 5.1 Medium

Roothub SystemConfigAdminController.java edit cross site scripting
- Roothub
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 26 Jul 2025
CVE-2025-8206 CVE record

CVSS 2.3 Low

Comodo Dragon IP DNS Leakage Detector cross site scripting
- Comodo Dragon
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 26 Jul 2025
CVE-2025-8191 CVE record

CVSS 5.1 Medium

macrozheng mall Swagger UI index.html cross site scripting
- macrozheng mall
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 26 Jul 2025
CVE-2025-8167 CVE record

CVSS 5.1 Medium

code-projects Church Donation System edit_members.php cross site scripting
- code-projects Church Donation System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 25 Jul 2025
CVE-2025-34114 CVE record

CVSS 8.4 High

OpenBlow Missing Critical Security Headers
- Laser Romae s.r.l. OpenBlow
- Code injection
- CWE-749
Not analysed yet 25 Jul 2025
CVE-2025-8155 CVE record

CVSS 5.1 Medium

D-Link DCS-6010L Management Application vb.htm cross site scripting
- D-Link DCS-6010L
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 25 Jul 2025
CVE-2025-29631 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

OS command injection in Gardyn Home Kit Firmware
- Gardyn Home Kit Firmware
- Command injection
- Code injection
Not analysed yet 25 Jul 2025
CVE-2025-29629 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Information disclosure in Gardyn Home Kit Firmware
- Gardyn Home Kit Firmware
- Code injection
- Information disclosure
Not analysed yet 25 Jul 2025
CVE-2025-8115 CVE record

CVSS 5.1 Medium

PHPGurukul Taxi Stand Management System new-autoortaxi-entry-form.php cross site scripting
- PHPGurukul Taxi Stand Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 24 Jul 2025
CVE-2016-15044 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Kaltura < 11.1.0-2 PHP Object Injection RCE
- Kaltura Video Platform
- Code injection
- Insecure deserialization
Not analysed yet 23 Jul 2025
CVE-2018-25114 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

osCommerce 2.3.4.1 Installer Unauthenticated Configuration File Injection PHP Code Execution
- osCommerce Online Merchant
- Code injection
- Unrestricted file upload
Not analysed yet 23 Jul 2025
CVE-2025-54451 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Code injection in Samsung Electronics MagicINFO 9 Server
- Samsung Electronics MagicINFO 9 Server
- Code injection
Not analysed yet 23 Jul 2025
CVE-2025-42947 CVE record

CVSS 5.5 Medium

Code Injection vulnerability in SAP FICA ODN framework
- SAP_SE SAP FICA ODN framework
- Code injection
Not analysed yet 23 Jul 2025
CVE-2025-8030 CVE record

CVSS 8.1 High

Potential user-assisted code execution in “Copy as cURL” command
- Mozilla Firefox
- Mozilla Thunderbird
- Code injection
Not analysed yet 22 Jul 2025
CVE-2025-6213 CVE record

CVSS 7.2 High

Nginx Cache Purge Preload <= 2.1.1 - Authenticated (Administrator+) Remote Code Execution
- psauxit Nginx Cache Purge Preload
- Code injection
Not analysed yet 22 Jul 2025
CVE-2025-7951 CVE record

CVSS 5.1 Medium

code-projects Public Chat Room send_message.php cross site scripting
- code-projects Public Chat Room
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 22 Jul 2025
CVE-2025-7946 CVE record

CVSS 5.3 Medium

PHPGurukul Apartment Visitors Management System HTTP POST Request search-visitor.php cross site scripting
- PHPGurukul Apartment Visitors Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 22 Jul 2025
CVE-2025-51482 CVE record

CVSS 8.8 High

Remote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows remote attackers to execute arbitrary Python code and system commands via crafted…
- Code injection
Not analysed yet 22 Jul 2025
CVE-2025-7944 CVE record

CVSS 5.3 Medium

PHPGurukul Taxi Stand Management System search.php cross site scripting
- PHPGurukul Taxi Stand Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 21 Jul 2025
CVE-2025-7943 CVE record

CVSS 5.3 Medium

PHPGurukul Taxi Stand Management System search-autoortaxi.php cross site scripting
- PHPGurukul Taxi Stand Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 21 Jul 2025
CVE-2025-7942 CVE record

CVSS 5.1 Medium

PHPGurukul Taxi Stand Management System admin-profile.php cross site scripting
- PHPGurukul Taxi Stand Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 21 Jul 2025
CVE-2025-7941 CVE record

CVSS 5.1 Medium

PHPGurukul Time Table Generator System profile.php cross site scripting
- PHPGurukul Time Table Generator System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 21 Jul 2025
CVE-2025-7926 CVE record

CVSS 5.1 Medium

PHPGurukul Online Banquet Booking System booking-search.php cross site scripting
- PHPGurukul Online Banquet Booking System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 21 Jul 2025
CVE-2025-7925 CVE record

CVSS 5.3 Medium

PHPGurukul Online Banquet Booking System login.php cross site scripting
- PHPGurukul Online Banquet Booking System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 21 Jul 2025
CVE-2025-7924 CVE record

CVSS 5.1 Medium

PHPGurukul Online Banquet Booking System admin-profile.php cross site scripting
- PHPGurukul Online Banquet Booking System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 21 Jul 2025
CVE-2025-0664 CVE record

CVSS 6.7 Medium

Code injection in Trellix Endpoint Security (HX) Agent
- Trellix Endpoint Security (HX) Agent
- Code injection
Not analysed yet 21 Jul 2025
CVE-2025-7902 CVE record

CVSS 5.1 Medium

yangzongzhuan RuoYi SysNoticeController.java addSave cross site scripting
- yangzongzhuan RuoYi
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 20 Jul 2025
CVE-2025-7901 CVE record

CVSS 5.3 Medium

yangzongzhuan RuoYi Swagger UI index.html cross site scripting
- yangzongzhuan RuoYi
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 20 Jul 2025
webssh PyPI

CVSS 5.3 Medium

A vulnerability, which was classified as problematic, has been found in Huashengdun WebSSH up to 1.6.2. Affected by this issue is some unknown functionality of the component Login Page. The manipul...
- Cross-site scripting (XSS)
- Code injection
<1.6.3 · fixed in 1.6.3

GHSA-9cg4-9hv5-3376 · CVE-2025-7885 Not analysed yet 20 Jul 2025
CVE-2025-7887 CVE record

CVSS 5.3 Medium

Zavy86 WikiDocs template.inc.php cross site scripting
- Zavy86 WikiDocs
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 20 Jul 2025
CVE-2025-7872 CVE record

CVSS 5.1 Medium

Portabilis i-Diario justificativas-de-falta cross site scripting
- Portabilis i-Diario
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 20 Jul 2025
CVE-2025-7871 CVE record

CVSS 5.1 Medium

Portabilis i-Diario conteudos cross site scripting
- Portabilis i-Diario
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 20 Jul 2025
CVE-2025-7870 CVE record

CVSS 5.1 Medium

Portabilis i-Diario justificativas-de-falta Endpoint doc_uploader.rb cross site scripting
- Portabilis i-Diario
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 20 Jul 2025
CVE-2025-7869 CVE record

CVSS 5.1 Medium

Portabilis i-Educar Turma Module educar_turma_tipo_det.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 20 Jul 2025
CVE-2025-7868 CVE record

CVSS 5.1 Medium

Portabilis i-Educar Calendar educar_calendario_dia_motivo_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 20 Jul 2025
CVE-2025-7867 CVE record

CVSS 5.1 Medium

Portabilis i-Educar Agenda agenda.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 20 Jul 2025
CVE-2025-7866 CVE record

CVSS 5.1 Medium

Portabilis i-Educar Disabilities Module educar_deficiencia_lst.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 20 Jul 2025
CVE-2025-7865 CVE record

CVSS 5.1 Medium

thinkgem JeeSite XSS Filter EncodeUtils.java xssFilter cross site scripting
- thinkgem JeeSite
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 20 Jul 2025
CVE-2025-7858 CVE record

CVSS 5.1 Medium

PHPGurukul Apartment Visitors Management System HTTP POST Request admin-profile.php cross site scripting
- PHPGurukul Apartment Visitors Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 19 Jul 2025
CVE-2025-7857 CVE record

CVSS 5.1 Medium

PHPGurukul Apartment Visitors Management System HTTP POST Request bwdates-passreports-details.php cross site scripting
- PHPGurukul Apartment Visitors Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 19 Jul 2025
CVE-2025-7856 CVE record

CVSS 5.1 Medium

PHPGurukul Apartment Visitors Management System HTTP POST Request pass-details.php cross site scripting
- PHPGurukul Apartment Visitors Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 19 Jul 2025
CVE-2025-7840 CVE record

CVSS 5.1 Medium

Campcodes Online Movie Theater Seat Reservation System Reserve Your Seat Page index.php cross site scripting
- Campcodes Online Movie Theater Seat Reservation System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 19 Jul 2025
CVE-2025-7819 CVE record

CVSS 4.8 Medium

PHPGurukul Apartment Visitors Management System HTTP POST Request create-pass.php cross site scripting
- PHPGurukul Apartment Visitors Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 19 Jul 2025
CVE-2025-7818 CVE record

CVSS 5.1 Medium

PHPGurukul Apartment Visitors Management System HTTP POST Request category.php cross site scripting
- PHPGurukul Apartment Visitors Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 19 Jul 2025
CVE-2025-7817 CVE record

CVSS 5.1 Medium

PHPGurukul Apartment Visitors Management System HTTP POST Request bwdates-reports.php cross site scripting
- PHPGurukul Apartment Visitors Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 19 Jul 2025
CVE-2025-7816 CVE record

CVSS 5.1 Medium

PHPGurukul Apartment Visitors Management System HTTP POST Request visitor-detail.php cross site scripting
- PHPGurukul Apartment Visitors Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 19 Jul 2025
CVE-2025-7815 CVE record

CVSS 4.8 Medium

PHPGurukul Apartment Visitors Management System HTTP POST Request manage-newvisitors.php cross site scripting
- PHPGurukul Apartment Visitors Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 19 Jul 2025
CVE-2025-7803 CVE record

CVSS 5.1 Medium

descreekert wx-discuz wx.php validToken cross site scripting
- descreekert wx-discuz
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 18 Jul 2025
CVE-2025-7802 CVE record

CVSS 5.1 Medium

PHPGurukul Complaint Management System complaint-search.php cross site scripting
- PHPGurukul Complaint Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 18 Jul 2025
CVE-2025-7800 CVE record

CVSS 5.1 Medium

cgpandey hotelmis HTTP GET Request admin.php cross site scripting
- cgpandey hotelmis
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 18 Jul 2025
CVE-2025-7791 CVE record

CVSS 5.1 Medium

PHPGurukul Online Security Guards Hiring System search.php cross site scripting
- PHPGurukul Online Security Guards Hiring System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 18 Jul 2025
CVE-2025-7786 CVE record

CVSS 5.1 Medium

Gnuboard g6 Post Reply qa cross site scripting
- Gnuboard g6
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 18 Jul 2025
CVE-2025-7767 CVE record

CVSS 5.1 Medium

PHPGurukul Art Gallery Management System edit-art-medium-detail.php cross site scripting
- PHPGurukul Art Gallery Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 18 Jul 2025
CVE-2025-46000 CVE record

CVSS 6.5 Medium

An arbitrary file upload vulnerability in the component /rsc/filemanager.rsc.class.php of Filemanager commit c75b914 v.2.5.0 allows attackers to execute arbitrary code via uploading a crafted SVG fil…
- Code injection
Not analysed yet 18 Jul 2025
livewire/livewire Packagist

CVSS 9.2 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Livewire is vulnerable to remote command execution during component property update hydration
- Code injection
>=3.0.0-beta.1, <3.6.4 · fixed in 3.6.4

GHSA-29cq-5w36-x7w3 · CVE-2025-54068 Not analysed yet 17 Jul 2025
CVE-2025-3753 CVE record

CVSS 7.8 High

Unsafe use of eval() method in rosbag tool
- Open Source Robotics Foundation Robot Operating System (ROS)
- Code injection
Not analysed yet 17 Jul 2025