Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
LangChain has incomplete f-string validation in prompt templates
- Code injection
- CWE-20
<0.3.84 || >=1.0.0a1, <1.2.28 · fixed in 0.3.84, 1.2.28
GHSA-926x-3r5x-gfhw · CVE-2026-40087 - CVSS 5.3 Medium
openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting
- openstatus
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
code-projects Easy Blog Site update.php cross site scripting
- code-projects Easy Blog Site
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.0 Medium
Vim Ex command injection in Vims NetBeans integration
- vim
- Code injection
- CVSS 8.8 High
PraisonAI has Template Injection in Agent Tool Definitions
- Code injection
<4.5.115 · fixed in 4.5.115
GHSA-hwg5-x759-7wjg · CVE-2026-39891 - CVSS 5.5 Medium
InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape
- InvenTree
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution
- Code injection
- CWE-20
<1.13.0 · fixed in 1.13.0
GHSA-jpcj-7wfg-mqxv · CVE-2026-31040 - CVSS 8.7 High
Zammad has a server-side template injection leading to RCE via AI Agent
- zammad
- Code injection
- CVSS 6.6 Medium
Eval Injection in Rapid7 Insight Agent
- Rapid7 Insight Agent
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions
- Cross-site scripting (XSS)
- Code injection
<0.0.0-20260407035653-2f416e5253f1 · fixed in 0.0.0-20260407035653-2f416e5253f1
GHSA-phhp-9rm9-6gr2 · CVE-2026-39846 - CVSS 9.3 CriticalCritical · CVSS 9+
Code injection in Six Apart Ltd. Movable Type and others
- Six Apart Ltd. Movable Type
- Six Apart Ltd. Movable Type Advanced
- Code injection
- CVSS 6.9 Medium
PowerJob's GroovyEvaluator.evaluate endpoint vulnerable to code injection
- Other injection
- Code injection
>=5.1.0, <=5.1.2 · no fixed version yet
GHSA-wpwf-v25w-54g3 · CVE-2026-5739 - CVSS 6.1 Medium
yaffa vulnerable to Cross Site Scripting
- Cross-site scripting (XSS)
- Code injection
<=2.0.0 · no fixed version yet
GHSA-pq95-94c9-j987 · CVE-2025-70844 - CVSS 10.0 CriticalCritical · CVSS 9+
ChurchCRM Affected by Unauthenticated RCE in Install Wizard
- CRM
- Code injection
- CVSS 8.6 HighCritical · CVSS 7+ and EPSS
Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()
- Dolibarr ERP/CRM
- Code injection
- CVSS 8.8 HighCritical · KEV, CVSS 7+ and EPSSKEV
Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans
- Command injection
- Code injection
<5.19.5 || >=6.0.0, <6.2.3 · fixed in 5.19.5, 6.2.3
GHSA-rxpj-7qvf-xv32 · CVE-2026-34197 - CVSS 8.8 High
Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Dual DHCP DNS Server 8.01 improperly accepts and caches UDP DNS responses without validating that the response originates from a legitimate configured upstream DNS server.
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution.
- Code injection
- CVSS 5.3 Medium
code-projects Online Hotel Booking Booking Endpoint booknow.php cross site scripting
- code-projects Online Hotel Booking
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.6 Medium
Code injection in dye template expressions
- mattieb dye
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Workbench Affected by Remote Code Execution (RCE) via Malicious Cookie in Timezone Conversion
- forceworkbench
- Code injection
- CVSS 5.3 Medium
Cyber-III Student-Management-System Class Schedule Deletion Endpoint delete_batch.php cross site scripting
- Cyber-III Student-Management-System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Cyber-III Student-Management-System add%20notice.php cross site scripting
- Cyber-III Student-Management-System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
GLPI has a Server-Side Template Injection via Double-Compilation
- glpi
- Code injection
- CVSS 4.8 Medium
code-projects Online Shoe Store Add Product admin_feature.php cross site scripting
- code-projects Online Shoe Store
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Cyber-III Student-Management-System batch-notice.php cross site scripting
- Cyber-III Student-Management-System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Cyber-III Student-Management-System Admin Add Endpoint notice.php cross site scripting
- Cyber-III Student-Management-System
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.9 Medium
assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injection
- assafelovic gpt-researcher
- Other injection
- Code injection
- CVSS 5.3 Medium
assafelovic gpt-researcher Report API app.py cross site scripting
- assafelovic gpt-researcher
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
assafelovic gpt-researcher WebSocket researcher.py cross site scripting
- assafelovic gpt-researcher
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
givanz Vvvebjs File Upload Endpoint upload.php cross site scripting
- givanz Vvvebjs
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
premAI-io premsql followup.py eval code injection
- premAI-io premsql
- Other injection
- Code injection
- CVSS 6.9 Medium
Fosowl agenticSeek query Endpoint PyInterpreter.py PyInterpreter.execute code injection
- Fosowl agenticSeek
- Other injection
- Code injection
- CVSS 5.1 Medium
Akaunting Invoice/Billing cross site scripting
- Akaunting
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
PyBlade: SSTI/RCE via Bypassed AST Validation in sandbox.py
- Code injection
- CWE-791
>=0.1.8-alpha, <=0.2.0-alpha · no fixed version yet
GHSA-23jg-5f8m-gw8c · CVE-2026-5559 - CVSS 6.9 Medium
provectus kafka-ui Endpoint testexecutions validateAccess code injection
- provectus kafka-ui
- Other injection
- Code injection
- CVSS 5.3 Medium
badlogic pi-mono loader.ts discoverAndLoadExtensions code injection
- badlogic pi-mono
- Other injection
- Code injection
- CVSS 5.3 Medium
code-projects Simple Laundry System Parameter modstaffinfo.php cross site scripting
- code-projects Simple Laundry System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Simple Laundry System Parameter modmemberinfo.php cross site scripting
- code-projects Simple Laundry System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Simple Laundry System Parameter modifymember.php cross site scripting
- code-projects Simple Laundry System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
badlogic pi-mono SVG Artifact SvgArtifact.ts cross site scripting
- badlogic pi-mono
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.9 Medium
Smart VPN 1.1.3.0 Denial of Service via Search
- SmartVPN Smart VPN
- Code injection
- CVSS 6.5 Medium
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing F…
- properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Code injection
- CVSS 8.8 High
BentoML: SSTI via Unsandboxed Jinja2 in Dockerfile Generation
- Code injection
<1.4.38 · fixed in 1.4.38
GHSA-v959-cwq9-7hr6 · CVE-2026-35044 - CVSS 8.7 High
RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component
- infiniflow ragflow
- Command injection
- Code injection
- CVSS 5.1 Medium
Casdoor vulnerable to Stored XSS via Application formCss / formSideHtml
- Cross-site scripting (XSS)
- Code injection
<=1.1000.0 · no fixed version yet
GHSA-w799-7525-rpr6 · CVE-2026-5468 - CVSS 9.8 CriticalCritical · CVSS 9+
Kedro has Arbitrary Code Execution via Malicious Logging Configuration
- Code injection
- Insecure deserialization
<1.3.0 · fixed in 1.3.0
GHSA-9cqf-439c-j96r · CVE-2026-35171 - CVSS 5.1 Medium
Krayin CRM is vulnerable to Cross-site Scripting (XSS)
- Cross-site scripting (XSS)
- Code injection
<=2.2.0 · no fixed version yet
GHSA-9m2v-hc5g-5jpv · CVE-2026-5370 - CVSS 9.3 Critical
Duplicate Advisory: Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`
- Code injection
<2.3.24 · fixed in 2.3.24
GHSA-77rh-m34w-rv36 · CVE-2026-35002 - CVSS 5.1 Medium
Xiaopi Panel WAF Firewall demo.php cross site scripting
- Xiaopi Panel
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)
- Progress ShareFile Storage Zones Controller
- Command injection
- Code injection
- CVSS 5.1 Medium
SourceCodester Simple Customer Relationship Management System Create Ticket create-ticket.php cross site scripting
- SourceCodester Simple Customer Relationship Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.2 High
Spam Protect for Contact Form 7 < 1.2.10 - Editor+ Remote Code Execution
- Spam Protect for Contact Form 7
- Code injection
- CVSS 5.3 Medium
itsourcecode Payroll Management System navbar.php cross site scripting
- itsourcecode Payroll Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.1 High
lodash vulnerable to Code Injection via `_.template` imports key names
- Code injection
>=4.0.0, <4.18.0 · fixed in 4.18.0
GHSA-r5fr-rjxr-66jc · CVE-2026-4800 - CVSS 8.3 High
dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration
- Cross-site scripting (XSS)
- Code injection
>=7.0.0, <7.1.5 · fixed in 7.1.5
GHSA-35xm-qvjg-8m42 · CVE-2026-34725 - CVSS 8.8 High
Libinput: libinput: unauthorized code execution and information disclosure through lua bytecode plugins
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
MetInfo CMS Unauthenticated PHP Code Injection RCE
- MetInfo CMS
- Code injection
- CVSS 5.3 Medium
code-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting
- code-projects Simple Laundry System
- Cross-site scripting (XSS)
- Code injection