Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 4.8 Medium
projectworlds Expense Management System Expense Categories create cross site scripting
- projectworlds Expense Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
projectworlds Expense Management System Currency create cross site scripting
- projectworlds Expense Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
projectworlds Expense Management System Roles Page create cross site scripting
- projectworlds Expense Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
projectworlds Expense Management System Users Page create cross site scripting
- projectworlds Expense Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
projectworlds Gate Pass Management System add-pass.php cross site scripting
- projectworlds Gate Pass Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Iqbolshoh php-business-website contact.php cross site scripting
- Iqbolshoh php-business-website
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Remote Code Execution (RCE) vulnerability
- videowhisper Paid Videochat Turnkey Site
- Code injection
- CVSS 6.3 Medium
Discussion Board – WordPress Forum Plugin <= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
- marketingfire Discussion Board – WordPress Forum Plugin
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning in github.com/gardener/gardener-extension-provider-aws
- Code injection
<1.64.0 · fixed in 1.64.0
GHSA-227x-7mh8-3cf6 · CVE-2025-59823 - CVSS 7.1 High
A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeover via manipulation o…
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
WordPress s2Member plugin <= 250905 - Remote Code Execution (RCE) vulnerability
- Cristián Lávaque s2Member
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
WordPress Alone theme <= 7.8.3 - Remote Code Execution (RCE) vulnerability
- Beplusthemes Alone
- Code injection
- CVSS 7.4 High
WordPress WP Last Modified Info plugin <= 1.9.4 - Remote Code Execution (RCE) vulnerability
- Sayan Datta WP Last Modified Info
- Code injection
- CVSS 7.2 High
WordPress Kalium theme <= 3.25 - Arbitrary Code Execution vulnerability
- Laborator Kalium
- Code injection
- CVSS 4.8 Medium
HTML Injection in Accept-Language Header in danny-avila/librechat
- danny-avila/librechat
- Code injection
- CVSS 6.5 Medium
Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
- Path traversal
- Code injection
=2.0.0-dev.0 · no fixed version yet
GHSA-vffh-c9pq-4crh - CVSS 7.2 High
ClipBucket v5 executes arbitrary PHP code
- MacWarrior clipbucket-v5
- Code injection
- CVSS 7.6 High
An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary code via the scrap_image.php component and the imageURL parameter
- Code injection
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting
- LogicalDOC Community Edition
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
toeverything AFFiNE Avatar Upload Image Endpoint cross site scripting
- toeverything AFFiNE
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.1 Critical
Duplicate Advisory: FlowiseAI Pre-Auth Arbitrary Code Execution
- Code injection
>=3.0.5, <3.0.6 · fixed in 3.0.6
GHSA-3g4j-r53p-22wx - CVSS 5.3 Medium
yanyutao0402 ChanCMS gather.js getArticle code injection
- yanyutao0402 ChanCMS
- Other injection
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory (/themes/defaut/css/minify.php).
- Code injection
- Broken access control
- CVSS 5.1 Medium
bagisto has Server Side Template Injection (SSTI) in Product Description
- Code injection
<2.3.8 · fixed in 2.3.8
GHSA-527q-4wqv-g9wj · CVE-2025-62416 - CVSS 5.1 Medium
Apeman ID71 set_alias.cgi cross site scripting
- Apeman ID71
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.5 High
Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection
- Code injection
>=4.3.0, <4.3.2 || >=4.2.0, <4.2.6 || >=4.0.0, <=4.1.9 || <=3.1.10 · fixed in 4.3.2, 4.2.6
GHSA-fwxx-wv44-7qfg · CVE-2025-41253 - CVSS 8.5 High
F5OS vulnerability
- F5OS - Appliance
- F5OS - Chassis
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Plugin is-human <= v1.4.2 Eval Injection RCE
- is-human WordPress Plugin
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
ibi WebFOCUS - Unauthenticated RCE Vulnerability
- ibi WebFOCUS
- Code injection
- CVSS 5.5 Medium
Code injection in Fortinet FortiClientMac
- Fortinet FortiClientMac
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
ZTE ZXCDN product has a Struts RCE Vulnerability
- ZTE ZXCDN
- Code injection
- CVSS 8.8 High
Phoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllers
- Phoenix Contact CHARX SEC-3150
- Phoenix Contact CHARX SEC-3100
- Code injection
- CVSS 5.4 Medium
Code Injection vulnerability in SAP Application Server for ABAP (BAPI Browser)
- SAP_SE SAP Application Server for ABAP (BAPI Browser)
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine
- Elastic Cloud Enterprise (ECE)
- Code injection
- CVSS 7.2 High
Happy DOM: VM Context Escape can lead to Remote Code Execution
- Code injection
<20.0.0 · fixed in 20.0.0
GHSA-37j7-fg3j-429f · CVE-2025-61927 - CVSS 6.5 Medium
Astro's `X-Forwarded-Host` is reflected without validation
- Code injection
- CWE-20
<5.14.3 · fixed in 5.14.3
GHSA-5ff5-9fcw-vg88 · CVE-2025-61925 - CVSS 9.7 CriticalCritical · CVSS 9+
Cherry Studio allows one-click on a specific URL to cause a command to execute
- CherryHQ cherry-studio
- Code injection
- CVSS 8.1 High
pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters
- Other injection
- Cross-site scripting (XSS)
<0.5.0b3.dev91 · fixed in 0.5.0b3.dev91
GHSA-cjjf-27cc-pvmv · CVE-2025-61773 - CVSS 9.9 CriticalCritical · CVSS 9+
Arbitrary Code Execution in Grafana Image Renderer Plugin
- grafana-image-renderer
- Code injection
- CVSS 5.3 Medium
code-projects Voting System voters_add.php cross site scripting
- code-projects Voting System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
SourceCodester Student Grades Management System Manage Users admin.php add_user cross site scripting
- SourceCodester Student Grades Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
JhumanJ OpnForm Form Editor forms cross site scripting
- JhumanJ OpnForm
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
JhumanJ OpnForm submissions cross site scripting
- JhumanJ OpnForm
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
itsourcecode Leave Management System Query Parameter controller.php redirect cross site scripting
- itsourcecode Leave Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
projectworlds Advanced Library Management System edit_admin.php cross site scripting
- projectworlds Advanced Library Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
code-projects Voting System candidates_edit.php cross site scripting
- code-projects Voting System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
PHPGurukul Cyber Cafe Management System POST Parameter search.php cross site scripting
- PHPGurukul Cyber Cafe Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
jakowenko double-take API app.js app.use cross site scripting
- jakowenko double-take
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
PyVista has Dependency Confusion Vulnerability in that leads to RCE
- pyvista
- Code injection
- CVSS 5.3 Medium
ILIAS Certificate Import code injection
- ILIAS
- Other injection
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Flowise vulnerable to RCE via Dynamic function constructor injection
- Code injection
- CWE-627
<=2.2.7-patch.1 · no fixed version yet
GHSA-hmgh-466j-fx4c · CVE-2025-55346 - CVSS 4.8 Medium
langleyfcu Online Banking System Add Customer customer_add_action.php cross site scripting
- langleyfcu Online Banking System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
CmsEasy URL view.php cross site scripting
- CmsEasy
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Vanderlande Baggage 360 messages cross site scripting
- Vanderlande Baggage 360
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
qianfox FoxCMS Search cross site scripting
- qianfox FoxCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
ixmaps website2017 HTTP GET Request map.php cross site scripting
- ixmaps website2017
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
westboy CicadasCMS Template Management TemplateFileServiceImpl.java save cross site scripting
- westboy CicadasCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Frappe LMS Course cross site scripting
- Frappe LMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting
- Frappe LMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
AllStarLink Supermon AllMon2 cross site scripting
- AllStarLink Supermon
- Cross-site scripting (XSS)
- Code injection