Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.1 High
Weblate: Remote code execution during backup restoration
- Path traversal
- Code injection
<5.17 · fixed in 5.17
GHSA-558g-h753-6m33 · CVE-2026-33435 - CVSS 8.1 High
Withdrawn Advisory: Apache Airflow: RCE by race condition in example_xcom dag
- Code injection
<3.2.0 · fixed in 3.2.0
GHSA-q2hg-643c-gw8h · CVE-2025-54550 - CVSS 6.8 Medium
Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance
- Command injection
- Code injection
>=43.65.0, <43.102.11 · fixed in 43.102.11
GHSA-5vjq-5jmg-39xq · CVE-2026-76226 - CVSS 9.1 CriticalCritical · CVSS 9+
Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)
- Code injection
<2.3.6 · fixed in 2.3.6
GHSA-gc9w-cc93-rjv8 · CVE-2026-41229 - CVSS 8.8 High
OWASP BLT has RCE in Github Actions via untrusted Django model execution in workflow
- BLT
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
- Code injection
<3.1.4.RELEASE · fixed in 3.1.4.RELEASE
GHSA-xjw8-8c5c-9r79 · CVE-2026-40478 - CVSS 9.1 CriticalCritical · CVSS 9+
Improper restriction of the scope of accessible objects in Thymeleaf expressions
- Code injection
<3.1.4.RELEASE · fixed in 3.1.4.RELEASE
GHSA-r4v4-5mwr-2fwr · CVE-2026-40477 - CVSS 5.4 Medium
Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution
- themefusion Avada (Fusion) Builder
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the session() function at config.php.
- Code injection
- CVSS 7.3 High
Kiota: Code Generation Literal Injection
- Code injection
<1.29.1 || >=1.30.0, <1.31.1 · fixed in 1.29.1, 1.31.1
GHSA-2hx3-vp6r-mg3f · CVE-2026-41134 - CVSS 5.4 Medium
Giskard has Unsandboxed Jinja2 Template Rendering in ConformityCheck
- Code injection
<1.0.2b1 · fixed in 1.0.2b1
GHSA-7xjm-g8f4-rp26 · CVE-2026-40320 - CVSS 10.0 CriticalCritical · CVSS 9+
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
- Code injection
<=29.0 · no fixed version yet
GHSA-gph2-j4c9-vhhr · CVE-2026-40911 - CVSS 10.0 CriticalCritical · CVSS 9+
Expression Injection in OpenRemote
- Code injection
<1.22.0 · fixed in 1.22.0
GHSA-7mqr-33rv-p3mp · CVE-2026-39842 - CVSS 4.0 Medium
PowerShell Command Injection in Podman HyperV Machine
- Command injection
- Code injection
>=4.8.0, <=4.9.5 · no fixed version yet
GHSA-hc8w-h2mf-hp59 · CVE-2026-33414 - CVSS 4.9 Medium
October Rain has Environment Variable Exfiltration via INI Parser Interpolation
- Code injection
- Information disclosure
<3.7.14 || >=4.0.0, <4.1.10 · fixed in 3.7.14, 4.1.10
GHSA-g6v3-wv4j-x9hg · CVE-2026-25125 - CVSS 9.8 CriticalCritical · CVSS 9+
OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files
- Code injection
<=0.23.0 · no fixed version yet
GHSA-xrxf-jgv3-qmrm · CVE-2025-61260 - CVSS 6.5 Medium
Germanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution
- vendidero Germanized for WooCommerce
- Code injection
- CVSS 2.0 Low
Kimai leaks API Token Hash via Invoice Twig Template
- Code injection
- CWE-184
<2.53.0 · fixed in 2.53.0
GHSA-rh42-6rj2-xwmc · CVE-2026-80201 - CVSS 6.9 Medium
Stored XSS via Eval Injection in EchartsRander Component
- 1Panel-dev MaxKB
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.3 Medium
MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect
- 1Panel-dev MaxKB
- Code injection
- CWE-693
- CVSS 2.0 Low
Code Injection vulnerability in SAP Landscape Transformation
- SAP_SE SAP Landscape Transformation
- Code injection
- CVSS 6.1 Medium
Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)
- SAP_SE SAP NetWeaver Application Server Java (Web Dynpro Java)
- Code injection
- CVSS 5.1 Medium
DbGate has cross site scripting via the SVG Icon String Handler component
- Cross-site scripting (XSS)
- Code injection
<7.1.5 · fixed in 7.1.5
GHSA-j8j5-7r4h-vj2g · CVE-2026-6216 - CVSS 5.3 Medium
aandrew-me ytDownloader Error Details Panel createTextNode cross site scripting
- aandrew-me ytDownloader
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
code-projects Simple Content Management System welcome.php cross site scripting
- code-projects Simple Content Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
1Panel-dev MaxKB MdPreview chat.ts cross site scripting
- 1Panel-dev MaxKB
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
PHPGurukul Company Visitor Management System bwdates-reports-details.php cross site scripting
- PHPGurukul Company Visitor Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Simple ChatBox Endpoint insert.php cross site scripting
- code-projects Simple ChatBox
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Simple Laundry System checkupdatestatus.php cross site scripting
- code-projects Simple Laundry System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in the <code>pickle</code> protocol of Pyro v3.x allows attackers to execute arbitrary code via supplying a crafted pickled string message.
- Code injection
- CVSS 8.8 High
The `/registercrd` endpoint in KubePlus 4.14 in the kubeconfiggenerator component is vulnerable to command injection.
- Code injection
- CVSS 8.8 High
In Phpgurukul Online Course Registration v3.1, an arbitrary file upload vulnerability was discovered within the profile picture upload functionality on the /my-profile.php page.
- Code injection
- CVSS 5.3 Medium
Warm-Flow has a SpEL Expression Injection in SpelHelper.parseExpression
- Other injection
- Code injection
<1.8.5 · fixed in 1.8.5
GHSA-822v-8w6h-5jxp · CVE-2026-6125 - CVSS 6.9 Medium
MetaGPT has an eval injection in metagpt/strategy/tot.py
- Other injection
- Code injection
<=0.8.2 · no fixed version yet
GHSA-xr7v-m9px-q4qj · CVE-2026-6110 - CVSS 5.1 Medium
1Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scripting
- 1Panel-dev MaxKB
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
1Panel-dev MaxKB Public Chat static_headers_middleware.py StaticHeadersMiddleware cross site scripting
- 1Panel-dev MaxKB
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes
- Code injection
- Broken access control
>=13.1.0, <15.2.0 · fixed in 15.2.0
GHSA-jvff-x2qm-6286 · CVE-2026-41139 - CVSS 8.4 High
PraisonAI Vulnerable to RCE via Automatic tools.py Import
- Code injection
- CWE-426
<4.5.139 · fixed in 4.5.139
GHSA-g985-wjh9-qxxc · CVE-2026-40287 - CVSS 7.8 High
PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic `tools.py` Loading
- Code injection
- CWE-426
<4.5.128 · fixed in 4.5.128
GHSA-2g3w-cpc4-chr4 · CVE-2026-40156 - CVSS 8.6 High
PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure
- Code injection
- CWE-693
<4.5.128 · fixed in 4.5.128
GHSA-3c4r-6p77-xwr7 · CVE-2026-40158 - CVSS 8.8 High
Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings
- chamilo-lms
- Code injection
- CVSS 5.3 Medium
code-projects Vehicle Showroom Management System ServiceAndSalesReport.php cross site scripting
- code-projects Vehicle Showroom Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Vehicle Showroom Management System ProfitAndLossReport.php cross site scripting
- code-projects Vehicle Showroom Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Simple Laundry System checkcheckout.php cross site scripting
- code-projects Simple Laundry System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
code-projects Simple IT Discussion Forum user.php cross site scripting
- code-projects Simple IT Discussion Forum
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Sanluan PublicCMS FreeMarker Template AbstractFreemarkerView.java AbstractFreemarkerView.doRender special elements used in a template engine
- Sanluan PublicCMS
- Code injection
- CWE-791
- CVSS 6.9 Medium
MetaGPT has an Injection issue
- Other injection
- Code injection
<=0.8.1 · no fixed version yet
GHSA-g977-h85w-h2xj · CVE-2026-5970 - CVSS 6.9 Medium
FoundationAgents MetaGPT vulnerable to eval injection
- Code injection
<=0.8.1 · no fixed version yet
GHSA-3ghp-8r47-4gj4 · CVE-2026-5971 - CVSS 9.1 CriticalCritical · CVSS 9+
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.9.5, the safeEjs.ts file does not properly sanitize EJS templates. Users with the Man...
- Code injection
<6.9.5 · fixed in 6.9.5
GHSA-jv9r-jw2f-rhrf · CVE-2026-39980 - CVSS 7.2 High
Wago: Vulnerability in WBM through Open VPN
- WAGO CC100 (0751-9x01)
- WAGO PFC100 G1 (0750-810-xxxx-xxxx)
- Code injection
- CVSS 5.1 Medium
jeecgboot JimuReport Data Source testConnection DriverManager.getConnection code injection
- jeecgboot JimuReport
- Other injection
- Code injection
- CVSS 4.8 Medium
code-projects Online Shoe Store admin_product.php cross site scripting
- code-projects Online Shoe Store
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
code-projects Online Shoe Store admin_football.php cross site scripting
- code-projects Online Shoe Store
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
code-projects Online Shoe Store admin_running.php cross site scripting
- code-projects Online Shoe Store
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Simple IT Discussion Forum edit-category.php cross site scripting
- code-projects Simple IT Discussion Forum
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Simple Laundry System delmemberinfo.php cross site scripting
- code-projects Simple Laundry System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a crafted executable.
- Code injection
- CVSS 8.8 High
An issue was discovered in Kiamo before 8.4 allowing authenticated administrative attackers to execute arbitrary PHP code on the server.
- Code injection
- CVSS 5.7 Medium
Improper Control of Generation of Code ('Code Injection') in GitLab
- GitLab
- Code injection
- CVSS 5.1 Medium
SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting
- SourceCodester Sales and Inventory System
- Cross-site scripting (XSS)
- Code injection