Code injection.

ZZCMS Backend Website Settings siteconfig.php stripfxg code injection

• ZZCMS
• Other injection
• Code injection

ChurchCRM has unauthenticated RCE in its Install Wizard

• CRM
• Code injection

Pagekit CMS is vulnerable to OS Command Injection via Storage component

• Command injection
• Code injection

<=1.0.18 · no fixed version yet

xiweicheng TMS create createComment cross site scripting

• xiweicheng TMS
• Cross-site scripting (XSS)
• Code injection

Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller

• Arcadia Technology, LLC Crafty Controller
• Code injection

RiteCMS v3.1.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the parse_special_tags() function.

• Command injection
• Code injection

Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI).

• Code injection

Code injection in Claris FileMaker Server

• Claris FileMaker Server
• Code injection

Code injection in Hewlett Packard Enterprise (HPE) HPE OneView

• Hewlett Packard Enterprise (HPE) HPE OneView
• Code injection

Mermaid XSS vulnerability leads to Remote Code Execution

• ThinkInAIXYZ deepchat
• Code injection

Fickling has Code Injection vulnerability via pty.spawn()

• Code injection
• Insecure deserialization

<0.1.6 · fixed in 0.1.6

CTCMS Content Management System Frontend/Template Management CT_Parser.php special elements used in a template engine

• CTCMS Content Management System
• Code injection
• CWE-791

CTCMS Content Management System Backend System Configuration Ct_Config.php code injection

• CTCMS Content Management System
• Other injection
• Code injection

CTCMS Content Management System Backend App Configuration Ct_App.php save code injection

• CTCMS Content Management System
• Other injection
• Code injection

vion707 DMadmin Backend AddonsController.class.php add cross site scripting

• vion707 DMadmin
• Cross-site scripting (XSS)
• Code injection

Zomplog 3.9 Remote Code Execution via Authenticated File Manipulation

• Zomplog
• Code injection

Webedition CMS v2.9.8.8 Remote Code Execution via PHP Page Creation

• Webedition CMS
• Code injection

A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism.

• Code injection

An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0.

• Code injection

An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0.

• Code injection

An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0.

• Code injection

An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0.

• Code injection

A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may b...

• Cross-site scripting (XSS)
• Code injection

<4.10.2 · fixed in 4.10.2

code-projects Student File Management System update_student.php cross site scripting

• code-projects Student File Management System
• Cross-site scripting (XSS)
• Code injection

code-projects Student File Management System Update User update_user.php cross site scripting

• code-projects Student File Management System
• Cross-site scripting (XSS)
• Code injection

Shortcode Loader <= 1.0 - Unauthenticated Arbitrary Shortcode Execution via 'code' Parameter

• rang501 Shortcode Ajax
• Code injection

Eval injection in Apple macOS

• Apple macOS
• Code injection

Eval injection in Apple macOS

• Apple macOS
• Code injection

Qualitor viewDocumento.php cross site scripting

• Qualitor
• Cross-site scripting (XSS)
• Code injection

Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule

• Code injection

<6.10.6 · fixed in 6.10.6

MineAdmin has an insecure default password

• Code injection

<=3.0.9 · no fixed version yet

Code Injection in Wave Term v0.12.2 allowing TCC Bypass

• waveterm
• Code injection

Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management

• parse-community parse-server
• Code injection
• Privilege escalation

WPMasterToolKit (WPMTK) <= 2.13.0 - Authenticated (Contributor+) Code Injection

• ludwigyou WPMasterToolKit (WPMTK) – All in one plugin
• Code injection

FoF Pretty Mail has a server-side template injection vulnerability

• Code injection

<=1.1.2 · no fixed version yet

An eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows attackers to overwrite arbitrary files as root via scanning a crafted file.

• Code injection

Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields

• Akaunting
• Code injection

yangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scripting

• yangshare warehouseManager 仓库管理系统
• Cross-site scripting (XSS)
• Code injection

baowzh hfly advtext add cross site scripting

• baowzh hfly
• Cross-site scripting (XSS)
• Code injection

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.

• Code injection

PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings

• PopojiCMS
• Code injection

XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

• Code injection

<16.10.10 || >=17.0.0-rc-1, <17.4.3 || >=17.5.0-rc-1, <17.6.0-rc-1 · fixed in 16.10.10, 17.4.3, 17.6.0-rc-1

Barracuda RMM < 2025.1.1 Service Center Insecure Reflection RCE

• Barracuda Networks RMM
• Code injection

The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot.

• Code injection

A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request.

• Code injection

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution.

• Code injection

Neuron MySQLSelectTool “read-only” bypass via `SELECT ... INTO OUTFILE` (file write → potential RCE)

• Code injection

<2.8.12 · fixed in 2.8.12

Elysia affected by arbitrary code injection through cookie config

• Code injection

<1.4.18 · fixed in 1.4.18

ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

• properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
• Code injection

WordPress GiveWP plugin <= 4.13.1 - Arbitrary Shortocde Execution vulnerability

• Liquid Web / StellarWP GiveWP
• Code injection

JIT miscompilation in the JavaScript Engine: JIT component

• Mozilla Firefox
• Mozilla Thunderbird
• Code injection

Code Injection vulnerability in SAP Solution Manager

• SAP_SE SAP Solution Manager
• Code injection

DeepChat's Incomplete XSS Fix Allows RCE through Mermaid Content

• ThinkInAIXYZ deepchat
• Cross-site scripting (XSS)
• Code injection

@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server

• Code injection

<0.5.6 · fixed in 0.5.6

GreenCMS Menu Management CustomController.class.php cross site scripting

• GreenCMS
• Cross-site scripting (XSS)
• Code injection

Yealink SIP-T21P E2 Local Directory cross site scripting

• Yealink SIP-T21P E2
• Cross-site scripting (XSS)
• Code injection

SourceCodester Online Banking System page cross site scripting

• SourceCodester Online Banking System
• Cross-site scripting (XSS)
• Code injection

Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session.

• Code injection

code-projects Chamber of Commerce Membership Management System Your Info membership_profile.php cross site scripting

• code-projects Chamber of Commerce Membership Management System
• Cross-site scripting (XSS)
• Code injection

alokjaiswal Hotel-Management-services-using-MYSQL-and-php dishsub.php cross site scripting

• alokjaiswal Hotel-Management-services-using-MYSQL-and-php
• Cross-site scripting (XSS)
• Code injection