Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.8 CriticalCritical · CVSS 9+
IBM HTTP Server is affected by multiple vulnerabilities
- IBM HTTP Server
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins
- IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty
- Code injection
- CVSS 5.3 Medium
teableio teable Sign-up LoginPage.tsx cross site scripting
- teable
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.1 High
IBM HTTP Server is affected by multiple vulnerabilities
- IBM HTTP Server
- Code injection
- CVSS 4.8 Medium
SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting
- SourceCodester Hospitals Patient Records Management System
- oretnom23 Hospitals Patient Records Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.0 Medium
Vowpal Wabbit: Shell injection via crafted PR title in python_checks.yml allows arbitrary command execution on CI runner
- VowpalWabbit vowpal_wabbit
- Command injection
- Code injection
- CVSS 8.6 High
OpenKM 6.3.12 Remote Code Execution via Administrative Scripting
- OpenKM Community Edition
- OpenKM Professional Edition
- Code injection
- CVSS 5.3 Medium
Blitz has a Cross-site Scripting issue
- Cross-site scripting (XSS)
- Code injection
<=3.0.2 · no fixed version yet
GHSA-h2p9-cr4h-px24 · CVE-2026-9520 - CVSS 9.3 CriticalCritical · CVSS 9+
Dolibarr ERP CRM contains a remote code evaluation vulnerability
- Code injection
<6.0.8 || >=7.0.0, <7.0.4 · fixed in 6.0.8, 7.0.4
GHSA-hxmh-2xc4-c894 · CVE-2018-25357 - CVSS 5.3 Medium
itsourcecode Electronic Judging System judges.php cross site scripting
- itsourcecode Electronic Judging System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting
- stonith404 pingvin-share
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
hemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent cross site scripting
- hemant6488 CodeIgniter-StudentManagementSystem
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.2 High
WordPress Broadcast Live Video plugin < 7.1.3 - Remote Code Execution (RCE) vulnerability
- VideoWhisper.com Broadcast Live Video
- Code injection
- CVSS 5.3 Medium
Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine
- Dromara lamp-cloud
- Code injection
- CWE-791
- CVSS 5.1 Medium
SourceCodester Student Grades Management System students.php cross site scripting
- SourceCodester Student Grades Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
yashpokharna2555 StudentManagementSystem student.php cross site scripting
- yashpokharna2555 StudentManagementSystem
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Employee Management System applyleave.php cross site scripting
- code-projects Employee Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Employee Management System empproject.php cross site scripting
- code-projects Employee Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Employee Management System changepassemp.php cross site scripting
- code-projects Employee Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Employee Management System myprofileup.php cross site scripting
- code-projects Employee Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Employee Management System myprofile.php cross site scripting
- code-projects Employee Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Employee Management System eloginwel.php cross site scripting
- code-projects Employee Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Indian Invoicing System Invoice Template Render Database-Backed add_order.php cross site scripting
- SourceCodester Indian Invoicing System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Indian Invoicing System category.php cross site scripting
- SourceCodester Indian Invoicing System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
SourceCodester SUP Online Shopping productedit.php cross site scripting
- SourceCodester SUP Online Shopping
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
vBulletin Login cross site scripting
- vBulletin
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection
- 546669204 vps-inventory-monitoring
- Other injection
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Cross-Site Scripting in SketchUp Dynamic Components
- Trimble SketchUp
- Code injection
- CVSS 8.7 High
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
- Code injection
>=3.15.0, <3.26.0 · fixed in 3.26.0
GHSA-45vw-wh46-2vx8 · CVE-2026-46640 - CVSS 8.7 High
Twig: PHP code injection via `{% use %}` template name
- Code injection
>=1.15.1, <3.26.0 · fixed in 3.26.0
GHSA-7p85-w9px-jpjp · CVE-2026-46633 - CVSS 7.8 High
lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out
- Code injection
- Broken access control
<0.13.0 · fixed in 0.13.0
GHSA-9xq9-36w5-q796 · CVE-2026-46517 - CVSS 7.8 High
LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization
- Code injection
<0.13.0 · fixed in 0.13.0
GHSA-m549-qq94-fvhg · CVE-2026-46432 - CVSS 4.9 Medium
Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail
- PowerDNS Authoritative
- Code injection
- CVSS 6.8 Medium
Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments
- Trilium
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.5 CriticalCritical · CVSS 9+
Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground
- Code injection
>=0.5.0, <1.1.0 · fixed in 1.1.0
GHSA-55hg-8qxv-qj4p · CVE-2026-8467 - CVSS 6.6 Medium
CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php
- panel
- Code injection
- CVSS 4.0, no score published
Caddy CVE-2026-30852 Fix Bypass
- Code injection
>=2.11.0, <=2.11.2 · no fixed version yet
GHSA-wwhq-w58m-w29c - CVSS 7.3 High
ModelScope is vulnerable to arbitrary code injection via a crafted module
- Code injection
- Insecure deserialization
<1.27.0 · fixed in 1.27.0
GHSA-fhhq-h4hg-549x · CVE-2025-51427 - CVSS 9.1 CriticalCritical · CVSS 9+
GlassFish's Administration Console is Vulnerable to RCE
- Code injection
<4.2.0 · fixed in 4.2.0
GHSA-96v6-hq43-x9h4 · CVE-2026-2586 - CVSS 9.6 CriticalCritical · CVSS 9+
GlassFish's gadget handler is vulnerable to RCE
- Code injection
<4.2.0 · fixed in 4.2.0
GHSA-29wv-cv7p-xjc2 · CVE-2026-2587 - CVSS 5.1 Medium
Angular template injection in Reports in Guardian/CMC before 26.1.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Code injection
- CVSS 8.8 High
Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution
- Apache Software Foundation Apache OFBiz
- Code injection
- CVSS 6.5 Medium
Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services
- Apache Software Foundation Apache OFBiz
- Code injection
- CVSS 6.5 Medium
Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass
- Apache Software Foundation Apache OFBiz
- Code injection
- CVSS 6.1 Medium
Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager
- Apache Software Foundation Apache OFBiz
- Path traversal
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component
- Apache Software Foundation Apache OFBiz
- Code injection
- CVSS 7.6 High
AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries
- Significant-Gravitas AutoGPT
- Code injection
- Insecure deserialization
- CVSS 9.8 CriticalCritical · CVSS 9+
scalar/astro v0.1.13 was discovered to contain an arbitrary file upload vulnerability in the the scalar_url query parameter of the Scalar Proxy endpoint.
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
ChromaDB Python project has a pre-authentication code injection vulnerability
- Code injection
- Insecure deserialization
>=1.0.0, <=1.5.9 · no fixed version yet
GHSA-f4j7-r4q5-qw2c · CVE-2026-45829 - CVSS 6.5 Medium
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
- Code injection
<3.38.1 · fixed in 3.38.1
GHSA-363w-hvwh-w7m6 · CVE-2026-45719 - CVSS 9.8 CriticalCritical · CVSS 9+
Formie: Pre-authenticated server-side template injection in Hidden fields
- Code injection
- CWE-693
<2.2.20 || >=3.0.0-beta.1, <3.1.24 · fixed in 2.2.20, 3.1.24
GHSA-x7m9-mwc2-g6w2 · CVE-2026-45697 - CVSS 8.8 High
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Microsoft Edge (Chromium-based)
- Path traversal
- Code injection
- CVSS 7.7 High
Code Injection in Perforce P4 (Helix Core)
- Perforce P4 (Helix Core)
- Code injection
- CVSS 7.3 High
Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration.
- Code injection
- CVSS 6.9 Medium
Beetl's SpELFunction extension function has an expression injection risk
- Code injection
- CWE-20
<=3.20.2.RELEASE · no fixed version yet
GHSA-fmmw-44rp-jcfp · CVE-2026-8759 - CVSS 9.3 CriticalCritical · CVSS 9+
ACL Analytics 11.x - 13.0.0.579 Arbitrary Code Execution
- ACL Analytics
- Code injection
- CVSS 5.3 Medium
Sanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engine
- Sanluan PublicCMS
- Code injection
- CWE-791
- CVSS 9.3 CriticalCritical · CVSS 9+
python jsonpickle 2.0.0 Remote Code Execution via py/repr
- python jsonpickle
- Code injection
- Insecure deserialization
- CVSS 8.7 High
Schlix CMS 2.2.6-6 Remote Code Execution via core.blockmanager
- Schlix CMS
- Code injection
- CVSS 8.1 High
Apache Flink: Remote code execution via SQL injection in code generation
- Code injection
>=1.15.0, <1.20.4 || >=2.0.0, <2.0.2 || >=2.1.0, <2.1.2 || >=2.2.0, <2.2.1 · fixed in 1.20.4, 2.0.2, 2.1.2, 2.2.1
GHSA-2f54-v4hm-fx73 · CVE-2026-35194