Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.1 Medium
Portabilis i-Educar Cadastrar Vínculo funcionario_vinculo_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Datacom DM955 5GT 1200 Wireless Basic Settings cross site scripting
- Datacom DM955 5GT 1200
- Cross-site scripting (XSS)
- Code injection
- CVSS 2.3 Low
Protected Total WebShield Extension Block Page cross site scripting
- Protected Total WebShield Extension
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
macrozheng mall Add Product Page upload cross site scripting
- macrozheng mall
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Scada-LTS Virtual Data Source Property data_source_edit.shtm cross site scripting
- Scada-LTS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
zhenfeng13 My-Blog Category save cross site scripting
- zhenfeng13 My-Blog
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.2 Medium
Craft CMS has a theoretical bypass for CVE-2025-23209
- Code injection
>=4.13.8, <4.16.3 || >=5.5.8, <5.8.4 · fixed in 4.16.3, 5.8.4
GHSA-2vcf-qxv3-2mgw · CVE-2025-54417 - CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Path Traversal leading to RCE
- Xerox FreeFlow Core
- Path traversal
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Privileged OpenBao Operator May Execute Code on the Underlying Host
- Code injection
<0.0.0-20250806194004-a14053c9679d || >=0.1.0, <2.3.2 · fixed in 0.0.0-20250806194004-a14053c9679d, 2.3.2
GHSA-xp75-r577-cvhp · CVE-2025-54997 - CVSS 4.6 Medium
Code injection in WPEngine, Inc. Advanced Custom Fields
- WPEngine, Inc. Advanced Custom Fields
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html.
- Code injection
- CVSS 8.1 High
Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution
- emarket-design Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress
- emarket-design Request a Quote Form Plugin – Price Quote Request Management Made Easy
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
react-native-bottom-tabs: Arbitrary code execution in GitHub Actions canary workflow leads to secret exfiltration
- callstackincubator react-native-bottom-tabs
- Code injection
- Privilege escalation
- CVSS 10.0 CriticalCritical · CVSS 9+
PHP-Charts v1.0 PHP Code Execution
- PHP-Charts
- Code injection
- CVSS 8.7 High
Maxthon3 about:history XCS Trusted Zone Code Execution
- Maxthon International Ltd. Maxthon3 Browser
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
ThinkPHP Path Traversal Vulnerability
- Path traversal
- Code injection
<=5.1.41 · no fixed version yet
GHSA-mrwc-mvr8-9xq5 · CVE-2025-50706 - CVSS 5.1 Medium
atjiu pybbs search cross site scripting
- atjiu pybbs
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
atjiu pybbs list cross site scripting
- atjiu pybbs
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
atjiu pybbs list cross site scripting
- atjiu pybbs
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
atjiu pybbs list cross site scripting
- atjiu pybbs
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
atjiu pybbs list cross site scripting
- atjiu pybbs
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
atjiu pybbs list cross site scripting
- atjiu pybbs
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Portabilis i-Educar educar_motivo_afastamento_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Portabilis i-Educar edit cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Portabilis i-Educar educar_raca_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Portabilis i-Educar empresas_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Portabilis i-Educar public_uf_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Portabilis i-Educar public_municipio_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Portabilis i-Educar public_distrito_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Portabilis i-Educar novo cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
cronoh NanoVault xrb URL main.js executeJavaScript cross site scripting
- cronoh NanoVault
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component
- Code injection
- CVSS 4.8 Medium
givanz Vvveb Add Type post-types cross site scripting
- givanz Vvveb
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
givanz Vvveb Code Editor code.php save code injection
- givanz Vvveb
- Other injection
- Code injection
- CVSS 8.0 HighCritical · KEV, CVSS 7+ and EPSSKEV
Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025
- Dassault Systèmes DELMIA Apriso
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses.
- Code injection
- CVSS 5.1 Medium
Portabilis i-Diario Observações diario-de-observacoes cross site scripting
- Portabilis i-Diario
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Educar educar_matricula_lst.php Gerar cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Educar educar_servidor_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Educar educar_avaliacao_desempenho_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Educar educar_funcao_lst.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
495300897 wx-shop editUI cross site scripting
- 495300897 wx-shop
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
code-projects Human Resource Integrated System action.php cross site scripting
- code-projects Human Resource Integrated System
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.5 High
Synactis PDF In-The-Box ConnectToSynactic Stack-Based Buffer Overflow
- Synactis PDF In-The-Box
- Code injection
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
InstantCMS <= 1.6 Remote PHP Code Execution
- InstantCMS
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration
- Code injection
>=0.8.0, <1.20.1 · fixed in 1.20.1
GHSA-mr4h-qf9j-f665 · CVE-2025-6000 - CVSS 7.2 High
FreshRSS is vulnerable to RCE attacks by authenticated admin
- FreshRSS
- Code injection
- CVSS 8.7 High
ProcessMaker Open Source < 2.5.2 neoclassic Skin PHP Code Execution
- ProcessMaker, Inc. ProcessMaker Open Source
- Code injection
- CVSS 5.1 Medium
Campcodes Online Hotel Reservation System add_query_account.php cross site scripting
- Campcodes Online Hotel Reservation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Portabilis i-Educar educar_escolaridade_lst.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Portabilis i-Educar educar_avaliacao_desempenho_lst.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Portabilis i-Educar pesquisa_pessoa_lst.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Portabilis i-Educar funcionario_vinculo_lst.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Portabilis i-Educar educar_servidor_lst.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Educar atendidos_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Portabilis i-Educar educar_aluno_lst.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Intern Membership Management System Error Message fill_details.php cross site scripting
- code-projects Intern Membership Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
code-projects Simple Car Rental System add_vehicles.php cross site scripting
- code-projects Simple Car Rental System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.3 Medium
Pyload log Injection via API /json/add_package in add_name parameter
- Code injection
<=0.5.0b3.dev89 · no fixed version yet
GHSA-3wwm-hjv7-23r3 - CVSS 8.5 High
Code Injection Vulnerability in NI LabVIEW when using CIN nodes
- NI LabVIEW
- Code injection