Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.2 High
Lucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags
- villatheme Lucky Wheel for WooCommerce – Spin a Sale
- Code injection
- CVSS 5.1 Medium
SohuTV CacheCloud AppDataMigrateController.java index cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SohuTV CacheCloud LoginController.java init cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SohuTV CacheCloud MachineManageController.java doPodList cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Campcodes Park Ticketing System admin_class.php save_pricing cross site scripting
- Campcodes Park Ticketing System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.4 Medium
Visual Studio Code Go extension has unexpected untrusted code execution
- Code injection
<0.52.1 · fixed in 0.52.1
GHSA-fjmr-7667-8v4p · CVE-2025-68120 - CVSS 9.8 CriticalCritical · CVSS 9+
JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER1 (4.5.1.r4518 and earlier), and ER2 (4.…
- Code injection
- CVSS 7.6 High
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.param_eval
- Code injection
- Insecure deserialization
<0.0.33 · fixed in 0.0.33
GHSA-cffc-mxrf-mhh4 · CVE-2025-71347 - CVSS 4.8 Medium
SohuTV CacheCloud QuartzManageController.java doQuartzList cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.6 High
Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran.myeval
- Code injection
- Insecure deserialization
<0.0.33 · fixed in 0.0.33
GHSA-3329-ghmp-jmv5 · CVE-2025-71365 - CVSS 7.6 High
Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller
- Code injection
- Insecure deserialization
<0.0.33 · fixed in 0.0.33
GHSA-x843-g5mx-g377 · CVE-2025-71373 - CVSS 4.8 Medium
SohuTV CacheCloud ResourceController.java index cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
SohuTV CacheCloud TaskController.java taskQueueList cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SohuTV CacheCloud WebResourceController.java redirectNoPower cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
SohuTV CacheCloud AppClientDataShowController.java doIndex cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.2 High
Advanced Ads <= 2.0.14 - Authenticated (Editor+) Remote Code Execution via Shortcode
- monetizemore Advanced Ads – Ad Manager & AdSense
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress IF AS Shortcode plugin <= 1.2 - Remote Code Execution (RCE) vulnerability
- Mohammad I. Okfie IF AS Shortcode
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Frappe may be vulnerable remote code execution due to server-side template injection
- frappe
- Code injection
- CVSS 4.8 Medium
Campcodes Complete Online Beauty Parlor Management System search-invoices.php cross site scripting
- Campcodes Complete Online Beauty Parlor Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SohuTV CacheCloud AppController.java appCommandAnalysis cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SohuTV CacheCloud AppManageController.java doAppAuditList cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SohuTV CacheCloud InstanceController.java advancedAnalysis cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SohuTV CacheCloud RedisConfigTemplateController.java preview cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SohuTV CacheCloud ServerController.java index cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Advaya Softech GEMS ERP Portal Error Message home.jsp cross site scripting
- Advaya Softech GEMS ERP Portal
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
rawchen ecms Add New Product updateProductServlet.java updateProductServlet cross site scripting
- rawchen ecms
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
CmsEasy Backend Template Management template_admin.php savetemp_action code injection
- CmsEasy
- Other injection
- Code injection
- CVSS 4.8 Medium
SohuTV CacheCloud UserManageController.java doUserList cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
SohuTV CacheCloud TotalManageController.java doTotalList cross site scripting
- SohuTV CacheCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
dayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross site scripting
- dayrui XunRuiCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
yourmaileyes MOOC Submission MainController.java subreview cross site scripting
- yourmaileyes MOOC
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
shanyu SyCms Administrative Panel FileManageController.class.php addPost code injection
- shanyu SyCms
- Other injection
- Code injection
- CVSS 5.3 Medium
ChenJinchuang Lin-CMS-TP5 File Upload LocalUploader.php upload code injection
- ChenJinchuang Lin-CMS-TP5
- Other injection
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
1-click Remote Code Execution (RCE) vulnerability in Eigent
- eigent
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Eval injection in Xspeeder SXZOS
- Xspeeder SXZOS
- Code injection
- CVSS 5.1 Medium
postmanlabs httpbin core.py cross site scripting
- postmanlabs httpbin
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
sunkaifei FlyCMS User Login UserController.java userLogin cross site scripting
- sunkaifei FlyCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
sunkaifei FlyCMS Admin Login IndexAdminController.java cross site scripting
- sunkaifei FlyCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution
- tychesoftwares Print Invoice & Delivery Notes for WooCommerce
- Code injection
- CVSS 5.1 Medium
code-projects Student Information System profile.php cross site scripting
- code-projects Student Information System
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.8 High
Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of...
- Code injection
<=4.57.0 · no fixed version yet
PYSEC-2025-216 · CVE-2025-14928 - CVSS 7.8 High
Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ...
- Code injection
<=4.57.0 · no fixed version yet
PYSEC-2025-215 · CVE-2025-14927 - CVSS 7.8 High
Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hu...
- Code injection
<=4.57.0 · no fixed version yet
PYSEC-2025-214 · CVE-2025-14926 - CVSS 8.6 High
CMSimple_XH 1.7.4 Authenticated Remote Code Execution via Content Editing
- Cmsimple-Xh CMSimple_XH
- Code injection
- CVSS 8.6 High
CMSimple 5.4 Authenticated Remote Code Execution via Template Editing
- Cmsimple
- Code injection
- CVSS 8.8 High
LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh.
- Code injection
- CVSS 4.8 Medium
Campcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scripting
- Campcodes Complete Online Beauty Parlor Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Simple Stock System chatuser.php cross site scripting
- code-projects Simple Stock System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.7 CriticalCritical · CVSS 9+
Dive has Cross-Site Scripting vulnerability that can escalate to Remote Code Execution
- OpenAgentPlatform Dive
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt
- World Wide Broadcast Network AVideo
- Code injection
- CVSS 8.3 High
Template injection in Mintlify Platform
- Mintlify Platform
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in GT Edge AI Community Edition Versions before v2.0.12 allows attackers to execute arbitrary code via injecting a crafted JSON payload into the Prompt window.
- Code injection
- CVSS 7.2 High
Microsoft Purview eDiscovery Remote Code Execution Vulnerability
- Microsoft Purview
- Path traversal
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Azure Container Apps Remote Code Execution Vulnerability
- Microsoft Azure Container Apps
- Code injection
- CVSS 8.4 High
Codigo Markdown Editor 1.0.1 Electron Arbitrary Code Execution via Markdown File
- Alfonzm Codigo Markdown Editor
- Code injection
- CVSS 7.3 High
tinacms is vulnerable to arbitrary code execution
- Code injection
<3.1.1 · fixed in 3.1.1
GHSA-529f-9qwm-9628 · CVE-2025-68278 - CVSS 9.1 CriticalCritical · CVSS 9+
WordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerability
- jetmonsters Hotel Booking Lite
- Code injection
- CVSS 6.5 Medium
WordPress Molla - Multipurpose Responsive Shopify theme <= 1.5.13 - Arbitrary Code Execution vulnerability
- The4 Molla
- Code injection
- CVSS 6.5 Medium
WordPress Javo Core plugin <= 3.0.0.266 - Arbitrary Code Execution vulnerability
- javothemes Javo Core
- Code injection
- CVSS 5.3 Medium
y_project RuoYi getnames code injection
- y_project RuoYi
- Other injection
- Code injection