Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
Portabilis i-Educar agenda_preferencias.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Educar Editar Função educar_funcao_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Portabilis i-Educar educar_usuario_det.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection
- smackcoders WP Import – Ultimate CSV XML Importer for WordPress
- Code injection
- CVSS 5.1 Medium
Portabilis i-Educar educar_calendario_anotacao_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Campcodes Grocery Sales and Inventory System index.php cross site scripting
- Campcodes Grocery Sales and Inventory System
- Cross-site scripting (XSS)
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Spring Expression language property modification using Spring Cloud Gateway Server WebFlux
- Code injection
>=3.1.0, <=3.1.10 || >=4.0.0, <=4.1.10 || >=4.2.0, <4.2.5 || >=4.3.0, <4.3.1 · fixed in 4.2.5, 4.3.1
GHSA-q2cj-h8fw-q4cc · CVE-2025-41243 - CVSS 5.3 Medium
pojoin h3blog HTTP Header login ppt_log cross site scripting
- pojoin h3blog
- Cross-site scripting (XSS)
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Flowise has Remote Code Execution vulnerability
- Code injection
>=3.0.5, <3.0.6 · fixed in 3.0.6
GHSA-3gcm-f6qx-ff7p · CVE-2025-59528 - CVSS 9.1 CriticalCritical · CVSS 9+
FlowiseAI Pre-Auth Arbitrary Code Execution
- Command injection
- Code injection
>=3.0.5, <3.0.6 · fixed in 3.0.6
GHSA-7944-7c6r-55vv · CVE-2025-57164 - CVSS 4.8 Medium
IbuyuCMS Add Article article.php cross site scripting
- IbuyuCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
itsourcecode E-Logbook with Health Monitoring System for COVID-19 POST Request check_profile.php cross site scripting
- itsourcecode E-Logbook with Health Monitoring System for COVID-19
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
fcba_zzm ics-park Smart Park Management System Scheduled Task JobController.java code injection
- fcba_zzm ics-park Smart Park Management System
- Other injection
- Code injection
- CVSS 5.1 Medium
Selleo Mentingo Create New Course Basic Settings enroll-course cross site scripting
- Selleo Mentingo
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Yida ECMS Consulting Enterprise Management System POST Request login.do cross site scripting
- Yida ECMS Consulting Enterprise Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Educar educar_turma_tipo_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Educar educar_modulo_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
MiczFlor RPi-Jukebox-RFID userScripts.php cross site scripting
- MiczFlor RPi-Jukebox-RFID
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
MiczFlor RPi-Jukebox-RFID cardRegisterNew.php cross site scripting
- MiczFlor RPi-Jukebox-RFID
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
MiczFlor RPi-Jukebox-RFID manageFilesFolders.php cross site scripting
- MiczFlor RPi-Jukebox-RFID
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
MiczFlor RPi-Jukebox-RFID cardEdit.php cross site scripting
- MiczFlor RPi-Jukebox-RFID
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
MiczFlor RPi-Jukebox-RFID inc.setWlanIpMail.php cross site scripting
- MiczFlor RPi-Jukebox-RFID
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
WhatCD Gazelle Commit Message change_log.php cross site scripting
- WhatCD Gazelle
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
cdevroe unmark info.php cross site scripting
- cdevroe unmark
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
cdevroe unmark Marks.php cross site scripting
- cdevroe unmark
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
cdevroe unmark searchform.php cross site scripting
- cdevroe unmark
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
erjinzhi 10OA item cross site scripting
- erjinzhi 10OA
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
erjinzhi 10OA catalogue cross site scripting
- erjinzhi 10OA
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
erjinzhi 10OA finder cross site scripting
- erjinzhi 10OA
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.7 CriticalCritical · CVSS 9+
AIRI's character card/chat UI is vulnerable to XSS and can lead to RCE
- moeru-ai airi
- Code injection
- CVSS 5.1 Medium
Ascensio System SIA OnlyOffice Comment Messages.aspx cross site scripting
- Ascensio System SIA OnlyOffice
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Ascensio System SIA OnlyOffice SVG Image Messages.aspx cross site scripting
- Ascensio System SIA OnlyOffice
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
openDCIM SVG File uploadifive.php cross site scripting
- openDCIM
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.1 High
Catalog Importer, Scraper & Crawler <= 5.1.4 - Unauthenticated PHP Code Injection
- idiatech Catalog Importer, Scraper & Crawler
- Code injection
- CVSS 5.1 Medium
lokibhardwaj PHP-Code-For-Unlimited-File-Upload f.php cross site scripting
- lokibhardwaj PHP-Code-For-Unlimited-File-Upload
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Scada-LTS Reports reports.shtm cross site scripting
- Scada-LTS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Scada-LTS Data Point Edit data_point_edit.shtm cross site scripting
- Scada-LTS
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.0 High
PyInstaller has local privilege escalation vulnerability
- Code injection
<6.0.0 · fixed in 6.0.0
GHSA-p2xp-xx3r-mffc · CVE-2025-59042 - CVSS 8.7 High
Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email
- Command injection
- Code injection
<1.0.105 · fixed in 1.0.105
GHSA-j4h9-wv2m-wrf7 · CVE-2025-59041 - CVSS 8.7 High
Claude Code rg vulnerability does not protect against approval prompt bypass
- Code injection
<1.0.105 · fixed in 1.0.105
GHSA-qxfv-fcpc-w36x · CVE-2025-58764 - CVSS 9.7 CriticalCritical · CVSS 9+
DeepChat's Mermaid rendering has XSS leading to RCE
- ThinkInAIXYZ deepchat
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
XWiki Remote Macros vulnerable to remote code execution using the panel macro
- xwikisas xwiki-pro-macros
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macro
- xwikisas xwiki-pro-macros
- Code injection
- CVSS 8.0 High
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automatio…
- rubengc AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress
- Code injection
- CVSS 5.0 Medium
WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names
- cbutlerjr WP-Members Membership Plugin
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)
- SAP_SE SAP NetWeaver AS Java (Deploy Web Service)
- Code injection
- CVSS 5.1 Medium
SourceCodester Simple To-Do List System Add New Task fetch_tasks.php cross site scripting
- SourceCodester Simple To-Do List System
- Cross-site scripting (XSS)
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
WeGIA has a bypass for the fix for CVE-2025-22133 - Arbitrary File Upload leads to Remote Code Execution (RCE)
- LabRedesCefetRJ WeGIA
- Code injection
- Unrestricted file upload
- CVSS 8.6 High
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
- Cross-site scripting (XSS)
- Code injection
<0.16.6 · fixed in 0.16.6
GHSA-g9hg-qhmf-q45m · CVE-2025-58444 - CVSS 8.7 High
XWiki Blog Application: Privilege Escalation (PR) from account through blog content
- Code injection
- Privilege escalation
<9.14 · fixed in 9.14
GHSA-gwj6-xpfg-pxwr · CVE-2025-58365 - CVSS 5.3 Medium
SimStudioAI: A function in route.ts is vulnerable to Code Injection
- Other injection
- Code injection
<=0.1.19 · no fixed version yet
GHSA-g4c9-f287-64xg · CVE-2025-10097 - CVSS 4.8 Medium
Portabilis i-Educar Editar usuário educar_usuario_cad.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Time Tracker index.html cross site scripting
- SourceCodester Time Tracker
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Online Polling System manage-profile.php cross site scripting
- SourceCodester Online Polling System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Educar tipos cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
rsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc.
- Code injection
- CVSS 5.3 Medium
itsourcecode POS Point of Sale System empty_table.php cross site scripting
- itsourcecode POS Point of Sale System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
itsourcecode POS Point of Sale System dymanic_table.php cross site scripting
- itsourcecode POS Point of Sale System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
itsourcecode POS Point of Sale System dom_data_th.php cross site scripting
- itsourcecode POS Point of Sale System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
itsourcecode POS Point of Sale System dom_data_two_headers.php cross site scripting
- itsourcecode POS Point of Sale System
- Cross-site scripting (XSS)
- Code injection