Advisories · Weakness

Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

software.amazon.jdbc:aws-advanced-jdbc-wrapper Maven

CVSS 8.0 High

Amazon Web Services Advanced JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance
- Code injection
<2.6.5 · fixed in 2.6.5

GHSA-7xw4-g7mm-r4hh Not analysed yet 13 Nov 2025
aws-advanced-python-wrapper PyPI

CVSS 8.6 High

AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance
- Code injection
<1.4.0 · fixed in 1.4.0

GHSA-4jvf-wx3f-2x8q · CVE-2025-12967 Not analysed yet 13 Nov 2025
CVE-2025-12733 CVE record

CVSS 8.8 High

Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic
- wpallimport WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
- Code injection
Not analysed yet 13 Nov 2025
org.openidentityplatform.openam:openam-oauth2 Maven

CVSS 8.1 High

OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed
- Other injection
- Code injection
<16.0.3 · fixed in 16.0.3

GHSA-39hr-239p-fhqc · CVE-2025-64099 Not analysed yet 12 Nov 2025
CVE-2024-48829 CVE record

CVSS 6.7 Medium

Code injection in Dell SmartFabric OS10 Software
- Dell SmartFabric OS10 Software
- Code injection
Not analysed yet 12 Nov 2025
CVE-2025-13058 CVE record

CVSS 5.1 Medium

soerennb eXtplorer Filename cross site scripting
- soerennb eXtplorer
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 12 Nov 2025
CVE-2025-33178 CVE record

CVSS 7.8 High

Code injection in NVIDIA NeMo Framework
- NVIDIA NeMo Framework
- Code injection
Not analysed yet 11 Nov 2025
CVE-2025-23361 CVE record

CVSS 7.8 High

Code injection in NVIDIA NeMo Framework
- NVIDIA NeMo Framework
- Code injection
Not analysed yet 11 Nov 2025
CVE-2025-23357 CVE record

CVSS 7.8 High

Code injection in NVIDIA Megatron-LM
- NVIDIA Megatron-LM
- Code injection
Not analysed yet 11 Nov 2025
CVE-2025-12637 CVE record

CVSS 8.8 High

Elastic Theme Editor <= 0.0.3 - Authenticated (Subscriber+) Arbitrary File Upload
- koopersmith Elastic Theme Editor
- Code injection
Not analysed yet 11 Nov 2025
CVE-2025-12813 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Holiday class post calendar <= 7.1 - Unauthenticated Remote Code Execution via 'contents'
- strix-bubol5 Holiday class post calendar
- Code injection
Not analysed yet 11 Nov 2025
CVE-2025-42895 CVE record

CVSS 6.9 Medium

Code Injection vulnerability in SAP HANA JDBC Client
- SAP_SE SAP HANA JDBC Client
- Code injection
Not analysed yet 11 Nov 2025
CVE-2025-42887 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Code Injection vulnerability in SAP Solution Manager
- SAP_SE SAP Solution Manager
- Code injection
Not analysed yet 11 Nov 2025
CVE-2025-12920 CVE record

CVSS 4.8 Medium

qianfox FoxCMS Product.php edit cross site scripting
- qianfox FoxCMS
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 9 Nov 2025
CVE-2025-9334 CVE record

CVSS 8.8 High

Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection
- codesolz Better Find and Replace – AI-Powered Suggestions
- Code injection
Not analysed yet 8 Nov 2025
CVE-2020-36870 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Ruijie Gateway EG & NBR Models v11.1(6)B9P1 - 11.9(4)B12P1 RCE
- Beijing Star-Net Ruijie Network Technology Co., Ltd. RG-EG1000C
- Beijing Star-Net Ruijie Network Technology Co., Ltd. RG-EG2000F
- Code injection
Not analysed yet 7 Nov 2025
open-webui +1 npm

CVSS 7.3 High

Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
- Code injection
- CWE-501
<0.6.35 · fixed in 0.6.35

GHSA-cm35-v4vp-5xvx · CVE-2025-64496 Not analysed yet 7 Nov 2025
CVE-2025-63690 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a paramet…
- Code injection
Not analysed yet 7 Nov 2025
CVE-2025-49372 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

WordPress HAPPY plugin <= 1.0.7 - Remote Code Execution (RCE) vulnerability
- VillaTheme HAPPY
- Code injection
Not analysed yet 6 Nov 2025
CVE-2025-47588 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.9 - Arbitrary Code Execution vulnerability
- acowebs Dynamic Pricing With Discount Rules for WooCommerce
- Code injection
Not analysed yet 6 Nov 2025
CVE-2025-32222 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

WordPress Widget Logic <= 6.0.5 - Remote Code Execution (RCE) Vulnerability
- Widgetlogic.org Widget Logic
- Code injection
Not analysed yet 6 Nov 2025
CVE-2025-11093 CVE record

CVSS 8.4 High

Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
- WSO2 Micro Integrator
- WSO2 API Manager
- Code injection
Not analysed yet 5 Nov 2025
expr-eval +1 npm

CVSS 9.8 CriticalCritical · CVSS 9+

expr-eval does not restrict functions passed to the evaluate function
- Code injection
<=2.0.2 · no fixed version yet

GHSA-jc85-fpwf-qm7x · CVE-2025-12735 Not analysed yet 5 Nov 2025
CVE-2025-64108 CVE record

CVSS 8.8 High

Cursor's Sensitive File Modification can Lead to NTFS Path Quirks
- cursor
- Path traversal
- Code injection
Not analysed yet 4 Nov 2025
CVE-2025-62369 CVE record

CVSS 7.2 High

Xibo CMS: Remote Code Execution through module templates
- xibosignage xibo-cms
- Code injection
Not analysed yet 4 Nov 2025
CVE-2025-60785 CVE record

CVSS 8.8 High

A remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via a crafted HTML page.
- Code injection
Not analysed yet 3 Nov 2025
CVE-2025-6990 CVE record

CVSS 8.8 High

Kallyas <= 4.24.0 - Authenticated (Contributor+) Remote Code Execution
- hogash KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme
- Code injection
Not analysed yet 1 Nov 2025
CVE-2025-10487 CVE record

CVSS 7.3 High

Advanced Ads <= 2.0.12 - Unauthenticated Limited Code Execution
- monetizemore Advanced Ads – Ad Manager & AdSense
- Code injection
Not analysed yet 1 Nov 2025
CVE-2025-12546 CVE record

CVSS 5.1 Medium

LogicalDOC Community Edition API Key creation UI cross site scripting
- LogicalDOC Community Edition
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 31 Oct 2025
CVE-2025-48984 CVE record

CVSS 8.8 High

Code injection in Veeam Backup and Replication
- Veeam Backup and Replication
- Code injection
Not analysed yet 30 Oct 2025
CVE-2025-34277 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard ID
- Nagios Log Server
- Code injection
Not analysed yet 30 Oct 2025
CVE-2025-61196 CVE record

CVSS 8.8 High

An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter.
- Code injection
Not analysed yet 30 Oct 2025
CVE-2025-50739 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization.
- Code injection
Not analysed yet 30 Oct 2025
CVE-2025-60355 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
- Code injection
Not analysed yet 28 Oct 2025
CVE-2025-56399 CVE record

CVSS 8.8 High

alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution (RCE) through a crafted file upload.
- Code injection
Not analysed yet 28 Oct 2025
CVE-2025-12335 CVE record

CVSS 5.3 Medium

code-projects E-Commerce Website supplier_update.php cross site scripting
- code-projects E-Commerce Website
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12332 CVE record

CVSS 4.8 Medium

SourceCodester Student Grades Management System admin.php delete_user cross site scripting
- SourceCodester Student Grades Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12334 CVE record

CVSS 5.3 Medium

code-projects E-Commerce Website product_add.php cross site scripting
- code-projects E-Commerce Website
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12333 CVE record

CVSS 5.3 Medium

code-projects E-Commerce Website supplier_add.php cross site scripting
- code-projects E-Commerce Website
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12330 CVE record

CVSS 4.8 Medium

Willow CMS Add Post add cross site scripting
- Willow CMS
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12312 CVE record

CVSS 4.8 Medium

PHPGurukul Curfew e-Pass Management System view-pass-detail.php cross site scripting
- PHPGurukul Curfew e-Pass Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12311 CVE record

CVSS 4.8 Medium

PHPGurukul Curfew e-Pass Management System edit-category-detail.php cross site scripting
- PHPGurukul Curfew e-Pass Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12303 CVE record

CVSS 4.8 Medium

PHPGurukul Curfew e-Pass Management System admin-profile.php cross site scripting
- PHPGurukul Curfew e-Pass Management System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12302 CVE record

CVSS 5.3 Medium

code-projects Simple Food Ordering System editproduct.php cross site scripting
- code-projects Simple Food Ordering System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12300 CVE record

CVSS 5.3 Medium

code-projects Simple Food Ordering System addcategory.php cross site scripting
- code-projects Simple Food Ordering System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12299 CVE record

CVSS 5.3 Medium

code-projects Simple Food Ordering System addproduct.php cross site scripting
- code-projects Simple Food Ordering System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12298 CVE record

CVSS 5.3 Medium

code-projects Simple Food Ordering System editcategory.php cross site scripting
- code-projects Simple Food Ordering System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12290 CVE record

CVSS 5.3 Medium

Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 359 cross site scripting
- Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12289 CVE record

CVSS 5.3 Medium

Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1001 cross site scripting
- Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12282 CVE record

CVSS 4.8 Medium

code-projects Client Details System manage-users.php cross site scripting
- code-projects Client Details System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12281 CVE record

CVSS 4.8 Medium

code-projects Client Details System clientview.php cross site scripting
- code-projects Client Details System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12280 CVE record

CVSS 4.8 Medium

code-projects Client Details System update-clients.php cross site scripting
- code-projects Client Details System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12279 CVE record

CVSS 4.8 Medium

code-projects Client Details System welcome.php cross site scripting
- code-projects Client Details System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12269 CVE record

CVSS 5.1 Medium

LearnHouse Account Setting previews cross site scripting
- LearnHouse
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12267 CVE record

CVSS 5.3 Medium

abhicodebox ModernShop search cross site scripting
- abhicodebox ModernShop
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12266 CVE record

CVSS 5.3 Medium

Zytec Dalian Zhuoyun Technology Central Authentication Service widget _empty code injection
- Zytec Dalian Zhuoyun Technology Central Authentication Service
- Other injection
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12264 CVE record

CVSS 5.1 Medium

Wisencode Create Support Ticket create cross site scripting
- Wisencode
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12251 CVE record

CVSS 5.1 Medium

OpenWGA Admin UI cross site scripting
- OpenWGA
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12246 CVE record

CVSS 5.3 Medium

chatwoot Admin IframeLoader.vue cross site scripting
- chatwoot
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025
CVE-2025-12244 CVE record

CVSS 5.3 Medium

code-projects Simple E-Banking System register.php cross site scripting
- code-projects Simple E-Banking System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 27 Oct 2025