Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.1 Medium
Rebuild Comment/Guestbook cross site scripting
- Rebuild
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
Eidos: One-click Remote Code Execution through Custom URL Handling
- mayneyao eidos
- Code injection
- CVSS 6.0 Medium
Redis: Authenticated users can execute LUA scripts as a different user
- redis
- Code injection
- CVSS 7.1 High
Cursor CLI Agent: Sensitive File Overwrite Bypass
- cursor
- Code injection
- CWE-178
- CVSS 7.5 High
Cursor is vulnerable to RCE via .code-workspace files using Prompt Injection
- cursor
- Code injection
- CVSS 8.7 HighCritical · CVSS 7+ and EPSS
Claude Code can execute commands prior to the startup trust dialog
- Code injection
<1.0.111 · fixed in 1.0.111
GHSA-4fgq-fpq9-mr3g · CVE-2025-59536 - CVSS 6.3 Medium
Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation
- wpt00ls Schema Plugin For Divi, Gutenberg & Shortcodes
- Code injection
- CVSS 7.1 High
Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns
- Code injection
>=0.0.0-20200331193331-03aab09f5b5c, <0.0.0-20250827065555-0494f5d47e41 || >=4.0.0, <5.21.4 || >=6.0.0, <6.5.0 · fixed in 0.0.0-20250827065555-0494f5d47e41, 5.21.4, 6.5.0
GHSA-w2hg-2v4p-vmh6 · CVE-2025-54287 - CVSS 8.8 High
Dolibarr vulnerable to RCE via the computed field parameter
- Code injection
<21.0.3 · fixed in 21.0.3
GHSA-27hj-48r9-x2vx · CVE-2025-56588 - CVSS 9.3 CriticalCritical · CVSS 9+
risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`
- Code injection
<0.9 · fixed in 0.9
GHSA-jqq4-c7wq-36h7 · CVE-2025-61588 - CVSS 7.5 High
JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Knowage Contains a Remote Code Execution Vulnerability
- KnowageLabs Knowage-Server
- Code injection
- CVSS 8.7 High
MinIO Java Client XML Tag Value Substitution Vulnerability
- Other injection
- Code injection
<8.6.0 · fixed in 8.6.0
GHSA-h7rh-xfpj-hpcm · CVE-2025-59952 - CVSS 5.1 Medium
Gstarsoft GstarCAD File Renaming cross site scripting
- Gstarsoft GstarCAD
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Cudy TR1200 Wireless Settings config cross site scripting
- Cudy TR1200
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
langleyfcu Online Banking System Error Message connection_error.php cross site scripting
- langleyfcu Online Banking System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
code-projects Project Monitoring System postjob.php cross site scripting
- code-projects Project Monitoring System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
itsourcecode Hostel Management System POST Request index.php cross site scripting
- itsourcecode Hostel Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
PHPGurukul Employee Record Management System myprofile.php cross site scripting
- PHPGurukul Employee Record Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
westboy CicadasCMS Add Department save cross site scripting
- westboy CicadasCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
westboy CicadasCMS save cross site scripting
- westboy CicadasCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Projectworlds Visitor Management System Add Visitor myform.php cross site scripting
- Projectworlds Visitor Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
givanz Vvveb SVG File cross site scripting
- givanz Vvveb
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Total.js CMS Files Menu cross site scripting
- Total.js CMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.6 Medium
WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerability
- YayCommerce YayCurrency
- Code injection
- CVSS 5.1 Medium
MuYuCMS Template Management admin.php code injection
- MuYuCMS
- Other injection
- Code injection
- CVSS 6.5 Medium
Hutool allows remote code execution (RCE) via the QLExpressEngine class
- Command injection
- Code injection
<5.8.40 · fixed in 5.8.40
GHSA-gcfh-36x4-mgj6 · CVE-2025-56769 - CVSS 4.8 Medium
Changsha Developer Technology iView Editor Markdown cross site scripting
- Changsha Developer Technology iView Editor
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
nuz007 smsboom dy.php cross site scripting
- nuz007 smsboom
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
nuz007 smsboom d.php cross site scripting
- nuz007 smsboom
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
yi-ge get-header-ip ip.php cross site scripting
- yi-ge get-header-ip
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
MikeCen WeChat-Face-Recognition wx.php valid cross site scripting
- MikeCen WeChat-Face-Recognition
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Total.js CMS Layout admin layouts_save cross site scripting
- Total.js CMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.6 High
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Microsoft Edge (Chromium-based)
- Code injection
- Memory corruption
- CVSS 4.8 Medium
Mangati NovoSGA XSS vulnerability in /admin
- Cross-site scripting (XSS)
- Code injection
<=2.2.9 · no fixed version yet
GHSA-4c44-r8rm-3p39 · CVE-2025-10909 - CVSS 7.2 High
Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive
- horilla
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA Megatron-LM
- NVIDIA Megatron-LM
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA Megatron-LM
- NVIDIA Megatron-LM
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA Megatron-LM
- NVIDIA Megatron-LM
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA Megatron-LM
- NVIDIA Megatron-LM
- Code injection
- CVSS 6.8 Medium
Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service
- WSO2 API Manager
- WSO2 Open Banking AM
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WPCasa <= 1.4.1 - Unauthenticated Code Injection
- wpsight WPCasa
- Code injection
- CVSS 5.1 Medium
code-projects Simple Food Ordering System order.php cross site scripting
- code-projects Simple Food Ordering System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
Advanced Views – Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI
- wplakeorg Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver…
- Code injection
- CVSS 5.3 Medium
PHPJabbers Restaurant Menu Maker preview.php cross site scripting
- PHPJabbers Restaurant Menu Maker
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.4 Medium
WordPress WP User Frontend Plugin <= 4.1.12 - Content Injection Vulnerability
- weDevs WP User Frontend
- Code injection
- CVSS 5.3 Medium
PHPGurukul Car Rental Project search.php cross site scripting
- PHPGurukul Car Rental Project
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint.
- Code injection
- CVSS 4.8 Medium
htmly Custom Field post cross site scripting
- htmly
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
07FLYCMS/07FLY-CMS/07FlyCRM Login cross site scripting
- 07FLYCMS
- 07FLY-CMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
07FLYCMS/07FLY-CMS/07FlyCRM index.php cross site scripting
- 07FLYCMS
- 07FLY-CMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature.
- Path traversal
- Code injection
- CVSS 8.8 High
Server-side template injection (SSTI) vulnerability in PPress 0.0.9 allows attackers to execute arbitrary code via crafted themes.
- Code injection
- CVSS 5.1 Medium
wangchenyi1996 chat_forum q.php cross site scripting
- wangchenyi1996 chat_forum
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
itsourcecode Online Petshop Management System Admin Dashboard availableframe.php cross site scripting
- itsourcecode Online Petshop Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
itsourcecode Online Petshop Management System Available Products addcnp.php cross site scripting
- itsourcecode Online Petshop Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
jinjava has Sandbox Bypass via JavaType-Based Deserialization
- Code injection
>=2.8.0, <2.8.1 || >=2.7.0, <2.7.5 · fixed in 2.8.1, 2.7.5
GHSA-m49c-g9wr-hv6v · CVE-2025-59340 - CVSS 5.3 Medium
itsourcecode E-Logbook with Health Monitoring System for COVID-19 print_reports_prev.php cross site scripting
- itsourcecode E-Logbook with Health Monitoring System for COVID-19
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Portabilis i-Educar ConfiguracaoMovimentoGeral cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Dyad Vulnerable to Remote Code Execution via Top-level Navigation in Preview Window
- dyad
- Code injection