Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.1 Medium
alokjaiswal Hotel-Management-services-using-MYSQL-and-php Request Pending usersub.php cross site scripting
- alokjaiswal Hotel-Management-services-using-MYSQL-and-php
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
code-projects Employee Profile Management System view_personnel.php cross site scripting
- code-projects Employee Profile Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.9 High
TUUI vulnerable to Remote Code Execution (RCE) via XSS in Markdown ECharts Rendering
- AI-QL tuui
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
JIZHICMS Comment addcomment.html cross site scripting
- JIZHICMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 2.0 Low
dayrui XunRuiCMS Domain Name Binding admin79f2ec220c7e.php cross site scripting
- dayrui XunRuiCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
dayrui XunRuiCMS Add Data Validation admind45f74adbd95.php cross site scripting
- dayrui XunRuiCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
dayrui XunRuiCMS Add Display Name Field admind45f74adbd95.php cross site scripting
- dayrui XunRuiCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.7 CriticalCritical · CVSS 9+
DeepChat Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)
- ThinkInAIXYZ deepchat
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Masa CMS Vulnerable to Pre-Auth RCE via JSON API
- MasaCMS
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
- hwk-fr Advanced Custom Fields: Extended
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Industrial Video & Control Longwatch has a Code Injection vulnerability
- Industrial Video & Control Longwatch
- Code injection
- CVSS 7.1 High
vLLM vulnerable to remote code execution via transformers_utils/get_config
- Code injection
<0.11.1 · fixed in 0.11.1
GHSA-8fr4-5q9j-m8gm · CVE-2025-66448 - CVSS 7.7 High
Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
- Code injection
<1.8.0-beta.27 · fixed in 1.8.0-beta.27
GHSA-8535-hvm8-2hmv · CVE-2025-66298 - CVSS 8.7 High
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
- Code injection
<1.8.0-beta.27 · fixed in 1.8.0-beta.27
GHSA-662m-56v4-3r8f · CVE-2025-66294 - CVSS 7.4 High
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
- Code injection
<1.8.0-beta.27 · fixed in 1.8.0-beta.27
GHSA-858q-77wx-hhx6 · CVE-2025-66297 - CVSS 8.8 High
Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)
- Code injection
<1.8.0-beta.27 · fixed in 1.8.0-beta.27
GHSA-gjc5-8cfh-653x · CVE-2025-66299 - CVSS 5.3 Medium
jairiidriss RestaurantWebsite Make a Reservation cross site scripting
- jairiidriss RestaurantWebsite
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.1 High
The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is re…
- Code injection
- CVSS 4.8 Medium
codingWithElias School Management System Edit Student Info student-view.php cross site scripting
- codingWithElias School Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
winston-dsouza Ecommerce-Website GET Parameter header_menu.php cross site scripting
- winston-dsouza Ecommerce-Website
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.9 Medium
Qualitor getResumo.php eval code injection
- Qualitor
- Other injection
- Code injection
- CVSS 4.8 Medium
yungifez Skuul School Management System vulnerable to XSS via SVG
- Cross-site scripting (XSS)
- Code injection
<=2.6.5 · no fixed version yet
GHSA-92x3-mfjp-j3h3 · CVE-2025-13784 - CVSS 6.9 Medium
taosir WTCMS index.php fetch code injection
- taosir WTCMS
- Other injection
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
OrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter Injection
- orangehrm
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
RCE in Wirtualna Uczelnia
- Simple SA Wirtualna Uczelnia
- Code injection
- CVSS 4.7 Medium
Apache CloudStack: Potential remote code execution on Javascript engine defined rules
- Apache Software Foundation Apache CloudStack
- Code injection
- CVSS 6.9 Medium
Template injection in Logpoint SIEM
- Logpoint SIEM
- Code injection
- CVSS 9.4 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack
- Code injection
- Cross-site request forgery (CSRF)
<2.52.0 · fixed in 2.52.0
GHSA-q279-jhrf-cc6v · CVE-2025-62593 - CVSS 7.2 High
REDAXO CMS is vulnerable to RCE attack through its template management component
- Code injection
<5.20.1 · fixed in 5.20.1
GHSA-xj9j-gjxg-7jvq · CVE-2025-64050 - CVSS 6.1 Medium
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in github.com/esm-dev/esm.sh
- Code injection
<0.0.0-20251118065157-87d2f6497574 · fixed in 0.0.0-20251118065157-87d2f6497574
GHSA-hcpf-qv9m-vfgp · CVE-2025-65026 - CVSS 7.8 High
Code injection in NVIDIA NeMo Framework
- NVIDIA NeMo Framework
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback
- Sneeit Framework
- Code injection
- CVSS 5.1 Medium
Eigenfocus Description cross site scripting
- Eigenfocus
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
PHPGurukul Hostel Management System register-complaint.php cross site scripting
- PHPGurukul Hostel Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Campcodes Complete Online Beauty Parlor Management System customer-list.php cross site scripting
- Campcodes Complete Online Beauty Parlor Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter
- Code injection
<5.2.5 · fixed in 5.2.5
GHSA-547r-qmjm-8hvw · CVE-2025-65108 - CVSS 8.3 High
LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
- Code injection
<0.3.80 || >=1.0.0, <1.0.7 · fixed in 0.3.80, 1.0.7
GHSA-6qv9-48xg-fc7f · CVE-2025-65106 - CVSS 4.8 Medium
Public Knowledge Project omp/ojs Payment Instructions Setting paymentForm.tpl cross site scripting
- Public Knowledge Project omp
- Public Knowledge Project ojs
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Online Shop Project register.php cross site scripting
- SourceCodester Online Shop Project
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
icret EasyImages SVG Image upload.php cross site scripting
- icret EasyImages
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Campcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting
- Campcodes Retro Basketball Shoes Online Store
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.7 High
Claude Code vulnerable to command execution prior to startup trust dialog
- Code injection
<1.0.39 · fixed in 1.0.39
GHSA-5hhx-v7f6-x7gv · CVE-2025-65099 - CVSS 8.6 High
Code injection in Progress DataDirect Connect for JDBC for Amazon Redshift and others
- Progress DataDirect Connect for JDBC for Amazon Redshift
- Progress DataDirect Connect for JDBC for Apache Cassandra
- Code injection
- CVSS 8.6 High
Code injection in Progress DataDirect Connect for JDBC for Amazon Redshift and others
- Progress DataDirect Connect for JDBC for Amazon Redshift
- Progress DataDirect Connect for JDBC for Apache Cassandra
- Code injection
- CVSS 8.0 High
Code Snippets <= 3.9.1 - Authenticated (Contributor+) PHP Code Injection via extract() and PHP Filter Chains
- codesnippetspro Code Snippets
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA Isaac-GR00T N1.5
- NVIDIA Isaac-GR00T N1.5
- Code injection
- CVSS 7.8 High
Code injection in NVIDIA Isaac-GR00T N1.5
- NVIDIA Isaac-GR00T N1.5
- Code injection
- CVSS 5.1 Medium
SourceCodester Student Grades Management System Add New Grade grades.php cross site scripting
- SourceCodester Student Grades Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Interview Management System editQuestion.php cross site scripting
- SourceCodester Interview Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.4 Medium
The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript st…
- Code injection
- CVSS 5.4 Medium
Classified Listing – Classified ads & Business Directory Plugin <= 5.0.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Listing Description
- techlabpro1 Classified Listing – AI-Powered Classified ads & Business Directory Plugin
- Code injection
- CVSS 5.1 Medium
code-projects Student Information System editprofile.php cross site scripting
- code-projects Student Information System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Student Information System register.php cross site scripting
- code-projects Student Information System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
projectsend File Editor/Custom Download Aliases cross site scripting
- projectsend
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
code-projects Simple Cafe Ordering System add_to_cart cross site scripting
- code-projects Simple Cafe Ordering System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage_customer cross site scripting
- Bdtask Isshue Multi Store eCommerce Shopping Cart Solution
- CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
pojoin h3blog addtitle cross site scripting
- pojoin h3blog
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
pojoin h3blog add cross site scripting
- pojoin h3blog
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.0 High
AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance
- Code injection
<2.0.1 · fixed in 2.0.1
GHSA-8wj8-cfxr-9374 - CVSS 8.0 High
AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance
- Code injection
<1.0.2 · fixed in 1.0.2
GHSA-7wq2-32h4-9hc9