Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.7 CriticalCritical · CVSS 9+
DeepChat One-click Remote Code Execution through Custom URL Handling
- ThinkInAIXYZ deepchat
- Code injection
- CVSS 5.1 Medium
jasonclark getsemantic index.php cross site scripting
- jasonclark getsemantic
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Scada-LTS SVG File view_edit.shtm cross site scripting
- Scada-LTS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Scada-LTS publisher_edit.shtm cross site scripting
- Scada-LTS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Scada-LTS mailing_lists.shtm cross site scripting
- Scada-LTS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Scada-LTS new cross site scripting
- Scada-LTS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Scada-LTS scheduled_events.shtm cross site scripting
- Scada-LTS
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Cloudflare Image Resizing <= 1.5.6 - Missing Authentication to Unauthenticated Remote Code Execution via rest_pre_dispatch Hook
- mecanik Cloudflare Image Resizing – Optimize & Accelerate Your Images
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare() function, which uses preg_replace() with the deprecated /e (eval) modifier to interpolate SQL query parameters.
- SQL injection
- Code injection
- CVSS 4.8 Medium
Netis WF2419 Wireless Settings index.htm cross site scripting
- Netis WF2419
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Portabilis i-Diario search_autocomplete cross site scripting
- Portabilis i-Diario
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Diario Informações Adicionais /planos-de-ensino-por-disciplina cross site scripting
- Portabilis i-Diario
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Diario Informações Adicionais /planos-de-ensino-por-areas-de-conhecimento cross site scripting
- Portabilis i-Diario
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Diario Informações Adicionais /planos-de-aulas-por-disciplina cross site scripting
- Portabilis i-Diario
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
ZenCart CKEditor cross site scripting
- ZenCart
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
zhenfeng13 My-Blog Tag save cross site scripting
- zhenfeng13 My-Blog
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/apps.js
- Cross-site scripting (XSS)
- Code injection
<=1.16.10 · no fixed version yet
GHSA-xfp8-x3j6-h67v · CVE-2025-9096 - CVSS 5.1 Medium
ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/users.js
- Cross-site scripting (XSS)
- Code injection
<=1.16.10 · no fixed version yet
GHSA-q4rg-7cjj-5r86 · CVE-2025-9095 - CVSS 6.5 Medium
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an eval injection vulnerability via the eval() function.
- Code injection
- CVSS 5.3 Medium
ThingsBoard Add Gateway special elements used in a template engine
- ThingsBoard
- Code injection
- CWE-791
- CVSS 7.3 High
Soledad <= 8.6.7 - Unauthenticated Arbitrary Shortcode Execution
- pencidesign Soledad
- Code injection
- CVSS 6.5 Medium
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution
- properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Code injection
- CVSS 6.9 Medium
KAP 3.6.0 - TCC Bypass
- Wulkano KAP
- Code injection
- CVSS 6.3 Medium
Apache OFBiz: RCE Vulnerability in scrum plugin
- Apache Software Foundation Apache OFBiz
- Code injection
- CVSS 6.3 Medium
Inpersttion For Theme <= 1.0 - Authenticated (Contributor+) Arbitrary Function Call
- Inpersttion For Theme
- Code injection
- CVSS 5.3 Medium
PHPGurukul Zoo Management System add-foreigner-ticket.php cross site scripting
- PHPGurukul Zoo Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
D-Link DIR-818LW DHCP Reserved Address bsc_lan.php cross site scripting
- D-Link DIR-818LW
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
givanz Vvveb Endpoint post cross site scripting
- givanz Vvveb
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
givanz Vvveb edit.tpl cross site scripting
- givanz Vvveb
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.6 High
HomeAssistant-Tapo-Control Code Injection Vulnerability in issues.yml Workflow
- JurajNyiri HomeAssistant-Tapo-Control
- Code injection
- CVSS 9.8 Critical
Duplicate Advisory: Flowise vulnerable to RCE via Dynamic function constructor injection
- Code injection
<=3.0.5 · no fixed version yet
GHSA-q4xx-mc3q-23x8 - CVSS 6.5 Medium
WordPress Eventer plugin < 3.9.9.1 - Content Injection vulnerability
- imithemes Eventer
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress Product XML Feed Manager for WooCommerce Plugin <= 2.9.3 - Remote Code Execution (RCE) Vulnerability
- WPFactory Product XML Feed Manager for WooCommerce
- Code injection
- CVSS 5.3 Medium
1000 Projects Sales Management System sales.php cross site scripting
- 1000 Projects Sales Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
1000 Projects Sales Management System sales.php cross site scripting
- 1000 Projects Sales Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.2 CriticalCritical · CVSS 9+
Active Storage allowed transformation methods that were potentially unsafe
- Command injection
- Code injection
>=5.2.0, <7.1.5.2 || >=7.2, <7.2.2.2 || >=8.0, <8.0.2.1 · fixed in 7.1.5.2, 7.2.2.2, 8.0.2.1
GHSA-r4mg-4433-c7g3 · CVE-2025-24293 - CVSS 10.0 CriticalCritical · CVSS 9+
Spree has Remote Command Execution vulnerability in search functionality
- Code injection
- Prototype pollution
<0.60.2 · fixed in 0.60.2
GHSA-97vm-c39p-jr86 · CVE-2011-10019 - CVSS 10.0 CriticalCritical · CVSS 9+
WeBid 1.0.2 converter.php Remote PHP Code Injection
- WeBid
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Traq 2.0–2.3 admincp/common.php RCE
- Traq Project Issue Tracking System
- Code injection
- Authentication bypass
- CVSS 10.0 CriticalCritical · CVSS 9+
myBB 1.6.4 Backdoor Arbitrary Command Execution
- myBB Group Forum Software
- Code injection
- CWE-912
- CVSS 4.8 Medium
Portabilis i-Diario Dicionário de Termos BNCC dicionario-de-termos-bncc cross site scripting
- Portabilis i-Diario
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA Megatron-LM
- NVIDIA Megatron-LM
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA Megatron-LM
- NVIDIA Megatron-LM
- Code injection
- CVSS 4.8 Medium
Portabilis i-Diario History objetivos-de-aprendizagem-e-habilidades cross site scripting
- Portabilis i-Diario
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA Merlin Transformers4Rec
- NVIDIA Merlin Transformers4Rec
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA Isaac-GR00T N1
- NVIDIA Isaac-GR00T N1
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA Apex
- NVIDIA Apex
- Code injection
- CVSS 4.8 Medium
Portabilis i-Educar Editar educar_instituicao_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the child_process module
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
- SAP_SE SAP S/4HANA (Private Cloud or On-Premise)
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)
- SAP_SE SAP Landscape Transformation (Analysis Platform)
- Code injection
- CVSS 6.1 Medium
HTML Injection vulnerability in SAP NetWeaver Application Server ABAP
- SAP_SE SAP NetWeaver Application Server ABAP
- Code injection
- CVSS 8.0 High
Cherry Studio One-click Remote Code Execution Vulnerability through Custom URL Handling
- CherryHQ cherry-studio
- Code injection
- CVSS 5.1 Medium
yangzongzhuan RuoYi edit cross site scripting
- yangzongzhuan RuoYi
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
JCG Link-net LW-N915R Wireless Basic Settings basic.asp cross site scripting
- JCG Link-net LW-N915R
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
atjiu pybbs Admin Panel settings cross site scripting
- atjiu pybbs
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Diario Informações adicionais planos-de-aula-por-areas-de-conhecimento cross site scripting
- Portabilis i-Diario
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Diario Registro das atividades registros-de-conteudos-por-disciplina cross site scripting
- Portabilis i-Diario
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Diario Registro das atividades registros-de-conteudos-por-areas-de-conhecimento cross site scripting
- Portabilis i-Diario
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Educar educar_usuario_lst.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection