Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.1 Medium
O2OA calendarConfig cross site scripting
- O2OA
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Student Information Management System login.php cross site scripting
- code-projects Student Information Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
ZrLog Theme Configuration Form config cross site scripting
- ZrLog
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Weaver E-Mobile Mobile Management Platform cross site scripting
- Weaver E-Mobile Mobile Management Platform
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.9 Medium
lychee-action vulnerable to arbitrary code injection in composite action
- lycheeverse lychee-action
- Code injection
- CVSS 8.1 High
WordPress YouTube Showcase Plugin <= 3.5.1 - PHP Object Injection Vulnerability
- emarket-design YouTube Showcase
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Remote Code Execution (RCE) vulnerability
- extremeidea bidorbuy Store Integrator
- Code injection
- CVSS 5.0 Medium
Improper Control of Generation of Code ('Code Injection') in GitLab
- GitLab
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Coolify Docker Compose Directive Injection in Application Deployment Workflow
- coolLabs Technologies Coolify
- Code injection
- CWE-20
- CVSS 9.8 CriticalCritical · CVSS 9+
The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability
- Code injection
>=5.0.0, <5.10.16 · fixed in 5.10.16
GHSA-9hp3-f5g8-rccg · CVE-2025-52122 - CVSS 9.4 CriticalCritical · CVSS 9+
Authenticated RCE with uhcapache privileges in ConvertToPDF
- CGM CLININET
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Calling system commands via RunCommand
- CGM CLININET
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
Conditional RCE via the "system" function
- CGM CLININET
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
RCE via Print.pl in uhcPrintServerPrint
- CGM CLININET
- Code injection
- CVSS 8.8 High
O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function.
- Code injection
- CWE-20
- CVSS 4.8 Medium
Agiloft improper neutralization in EUI template engine
- Agiloft
- Code injection
- CVSS 7.6 High
Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip
- Code injection
<0.0.29 · fixed in 0.0.29
GHSA-8r4j-24qv-fmq9 · CVE-2025-71361 - CVSS 7.8 High
Code injection in NVIDIA NeMo Framework
- NVIDIA NeMo Framework
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA NeMo Framework
- NVIDIA NeMo Framework
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA NeMo Framework
- NVIDIA NeMo Framework
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA NeMo Framework
- NVIDIA NeMo Framework
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA NeMo Curator
- NVIDIA NeMo Curator
- Code injection
- CVSS 7.8 High
COMMGR Code Injection Vulnerability
- Delta Electronics COMMGR
- Code injection
- CVSS 5.3 Medium
1000projects Online Project Report Submission and Evaluation System add_title.php cross site scripting
- 1000projects Online Project Report Submission and Evaluation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
1000projects Online Project Report Submission and Evaluation System edit_faculty.php cross site scripting
- 1000projects Online Project Report Submission and Evaluation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
1000projects Online Project Report Submission and Evaluation System add_student.php cross site scripting
- 1000projects Online Project Report Submission and Evaluation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
1000projects Online Project Report Submission and Evaluation System edit_title.php cross site scripting
- 1000projects Online Project Report Submission and Evaluation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
mtons mblog Admin Panel list cross site scripting
- mtons mblog
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
mtons mblog Admin Panel list cross site scripting
- mtons mblog
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
mtons mblog search cross site scripting
- mtons mblog
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
mtons mblog update cross site scripting
- mtons mblog
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.5 High
SelectZero Data Observability Platform before 2025.5.2 is vulnerable to Content Spoofing / Text Injection.
- Code injection
- CVSS 5.1 Medium
mtons mblog Post submit cross site scripting
- mtons mblog
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
oitcode samarium Team Image team cross site scripting
- oitcode samarium
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.1 Medium
Craft CMS Potential Remote Code Execution via Twig SSTI
- Path traversal
- Code injection
>=4.0.0-RC1, <4.16.6 || >=5.0.0-RC1, <5.8.7 · fixed in 4.16.6, 5.8.7
GHSA-crcq-738g-pqvc · CVE-2025-57811 - CVSS 4.8 Medium
oitcode samarium Pages Image webpage cross site scripting
- oitcode samarium
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.2 HighCritical · CVSS 7+ and EPSS
Dataease H2 JDBC RCE Bypass
- dataease
- Code injection
- CVSS 8.2 HighCritical · CVSS 7+ and EPSS
Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability
- dataease
- Code injection
- Insecure deserialization
- CVSS 5.1 Medium
mtons mblog profile cross site scripting
- mtons mblog
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Scada-LTS Folder pointHierarchySLTS cross site scripting
- Scada-LTS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Scada-LTS watch_list.shtm cross site scripting
- Scada-LTS
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL.
- Code injection
- Authentication bypass
- CVSS 10.0 CriticalCritical · CVSS 9+
Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to run arbitrary code via an unspecified web interfa…
- Code injection
- CWE-749
- CVSS 8.4 High
Maple <= v13 Maplet File Creation and Command Execution
- Maple
- Code injection
- CVSS 5.1 Medium
SourceCodester Advanced School Management System addNotice cross site scripting
- SourceCodester Advanced School Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Spree Commerce is vulnerable to RCE through Search API
- Command injection
- Code injection
<=3.0.1 · no fixed version yet
GHSA-x485-rhg3-cqr4 · CVE-2011-10026 - CVSS 5.1 Medium
CodeAstro Ecommerce Website Edit Your Account my_account.php cross site scripting
- CodeAstro Ecommerce Website
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Scada-LTS compound_events.shtm cross site scripting
- Scada-LTS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Scada-LTS maintenance_events.shtm cross site scripting
- Scada-LTS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Scada-LTS view_edit.shtm cross site scripting
- Scada-LTS
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.5 High
WordPress Add Custom Codes <= 4.80 - Arbitrary Code Execution vulnerability
- SaifuMak Add Custom Codes
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress Code Engine Plugin <= 0.3.3 - Remote Code Execution (RCE) Vulnerability
- Jordy Meow Code Engine
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
WordPress Global DNS Plugin <= 3.1.0 - Remote Code Execution (RCE) Vulnerability
- thehp Global DNS
- Code injection
- CVSS 6.5 Medium
WordPress Alone < 7.8.5 - Arbitrary Code Execution Vulnerability
- Beplusthemes Alone
- Code injection
- CVSS 8.8 High
XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentatio…
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SolidInvoice Clients clients cross site scripting
- SolidInvoice
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SolidInvoice Tax Rates rates cross site scripting
- SolidInvoice
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SolidInvoice Quote quotes cross site scripting
- SolidInvoice
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SolidInvoice Invoice Creation invoice cross site scripting
- SolidInvoice
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SolidInvoice Recurring Invoice recurring cross site scripting
- SolidInvoice
- Cross-site scripting (XSS)
- Code injection