Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.5 High
Cursor Desktop sandbox escape via Claude hook configuration
- cursor
- Code injection
- CWE-829
- CVSS 10.0 CriticalCritical · CVSS 9+
WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability
- Edgar Rojas WooCommerce PDF Invoice Builder
- Code injection
- CVSS 7.5 High
Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS
- OpenSolution Quick.CMS
- Code injection
- Insecure deserialization
- CVSS 4.8 Medium
Subrion CMS vulnerable to Cross-site Scripting
- Cross-site scripting (XSS)
- Code injection
<=4.0.3 · no fixed version yet
GHSA-wrcg-234w-hfhq · CVE-2026-12202 - CVSS 6.9 Medium
jsonata: Function Binding Prototype Pollution via hasOwnProperty Override
- Code injection
- Prototype pollution
<1.8.8 || >=2.0.0, <2.2.1 · fixed in 1.8.8, 2.2.1
GHSA-663r-x48j-fg8p · CVE-2026-12208 - CVSS 6.9 Medium
RubyLouvre avalon Template Filter index.js prototype pollution
- RubyLouvre avalon
- Code injection
- Prototype pollution
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtain sensitive information via supplying a crafted HTTP reque…
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted…
- Code injection
- CVSS 5.3 Medium
SourceCodester CET Automated Grading System with AI Predictive Analytics index.php cross site scripting
- SourceCodester CET Automated Grading System with AI Predictive Analytics
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
CodeAstro Human Resource Management System Projects Management Add_Projects cross site scripting
- CodeAstro Human Resource Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
CodeAstro Human Resource Management System Dashboard add_tod cross site scripting
- CodeAstro Human Resource Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.3 High
Kitty vulnerable to command injection via unsanitized OSC 21 query reply
- kovidgoyal kitty
- Code injection
- CWE-150
- CVSS 7.8 High
@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE
- kovidgoyal kitty
- Code injection
- Broken access control
- CVSS 9.4 CriticalCritical · CVSS 9+
ChromaDB has a code injection vulnerability
- Code injection
>=0.4.17, <=1.5.9 · no fixed version yet
GHSA-36p7-vc44-83pf · CVE-2026-45833 - CVSS 7.5 High
Vim: Arbitrary Code Execution via Python Omni-Completion
- vim
- Code injection
- CVSS 7.3 High
Vim: Arbitrary Code Execution via Python Omni-Completion
- vim
- Code injection
- CWE-829
- CVSS 7.3 High
Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name
- vim
- Other injection
- Code injection
- CVSS 5.1 Medium
Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex
- vim
- Code injection
- CVSS 8.8 High
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri
- Code injection
<0.10.9 · fixed in 0.10.9
GHSA-4x76-22x2-rx8v · CVE-2026-48054 - CVSS 8.4 High
PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing
- Code injection
- CWE-829
<2.27.0 · fixed in 2.27.0
GHSA-qq6c-99pv-prvf · CVE-2026-47781 - CVSS 9.8 CriticalCritical · CVSS 9+
SSTI in Soagen Informatics' Apinizer
- Soagen Informatics Technologies Software and Consulting Inc. Apinizer
- Code injection
- CVSS 6.4 Medium
Spring Web Flow has Data Binding Vulnerability with Unified EL Parser
- Code injection
>=4.0.0, <4.0.1 || >=3.0.0, <3.0.2 || <=2.5.1 · fixed in 4.0.1, 3.0.2
GHSA-9ggw-87m9-9gfc · CVE-2026-40985 - CVSS 8.8 High
Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution
- Apache Software Foundation Apache OFBiz
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section save
- roxy-wi
- Command injection
- Code injection
- CVSS 6.4 Medium
Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries
- Code injection
>=4.0.0, <4.0.6 || >=3.5.0, <3.5.12 || >=3.4.0, <=3.4.14 || >=3.0.0, <=3.3.16 || <=2.7.19 · fixed in 4.0.6, 3.5.12
GHSA-xg2j-3hj6-pc24 · CVE-2026-41719 - CVSS 8.1 High
Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests
- Code injection
>=5.0.0, <5.0.6 || >=4.5.0, <4.5.12 || >=4.4.0, <=4.4.14 || >=4.3.0, <=4.3.16 || <=3.7.19 · fixed in 5.0.6, 4.5.12
GHSA-j388-8rm5-p97f · CVE-2026-41729 - CVSS 8.1 High
Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection
- Code injection
>=5.0.0, <5.0.6 || >=4.5.0, <4.5.12 || >=4.4.0, <=4.4.14 || >=4.0.0, <=4.3.16 || <=3.4.19 · fixed in 5.0.6, 4.5.12
GHSA-5whc-4q84-fj73 · CVE-2026-41717 - CVSS 7.8 High
Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability
- Microsoft Visual Studio Code - MSSQL Extension
- Code injection
- CWE-829
- CVSS 7.5 High
Microsoft Exchange Server Remote Code Execution Vulnerability
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 14
- Code injection
- CVSS 4.3 Medium
Insufficient Input Validation Allows Unauthorized Modification of Router Software in certain NETGEAR Routers
- NETGEAR RBE970
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Insert PHP Plugin < 2.5.1 PHP Code Injection via REST API
- Themeisle Woody Code Snippets
- Code injection
- CVSS 7.8 High
Injection in Rapid7 Velociraptor
- Rapid7 Velociraptor
- Other injection
- Code injection
- CVSS 8.8 High
Code injection in Google Chrome
- Google Chrome
- Code injection
- CVSS 8.7 High
nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml
- Code injection
<0.3.2 · fixed in 0.3.2
GHSA-7hp6-g3pq-3pc3 · CVE-2026-47722 - CVSS 9.0 CriticalCritical · CVSS 9+
Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin
- Code injection
<0.0.0-20240826075852-c651df0b8767 · fixed in 0.0.0-20240826075852-c651df0b8767
GHSA-hrj8-hjv8-mgwc · CVE-2026-47252 - CVSS 4.8 Medium
actual Allows Electron to Run As Node
- Code injection
- Privilege escalation
<26.5.0 · fixed in 26.5.0
GHSA-7rvm-xjpp-63r9 · CVE-2026-42890 - CVSS 8.7 High
OpenBullet2 0.3.2 Authenticated RCE via Job Configuration Interface
- openbullet2
- Code injection
- CVSS 5.1 Medium
imvks786 student_management_system add.php cross site scripting
- imvks786 student_management_system
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Inventory System header.php cross site scripting
- SourceCodester Inventory System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Inventory System User Management users.php cross site scripting
- SourceCodester Inventory System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
itsourcecode Hospital Management System billing.php cross site scripting
- itsourcecode Hospital Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
CodeAstro Human Resource Management System Notice Board Management All_notice cross site scripting
- CodeAstro Human Resource Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
SourceCodester Hospitals Patient Records Management System page room_types cross site scripting
- SourceCodester Hospitals Patient Records Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Mage AI Sign-in Flow index.tsx useMutation cross site scripting
- Mage AI
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
FluentCMS Blocks Plugin blocks cross site scripting
- FluentCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.4 High
Markdown Preview Enhanced 0.8.x Code Injection via WaveDrom Rendering
- shd101wyy Markdown Preview Enhanced
- shd101wyy crossnote
- Code injection
- CVSS 8.6 High
Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval()
- shd101wyy Markdown Preview Enhanced
- Code injection
- CVSS 8.6 High
Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()
- shd101wyy Markdown Preview Enhanced
- Code injection
- CVSS 8.8 High
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
- Code injection
<7.1.9 · fixed in 7.1.9
GHSA-hv83-ggc4-v385 · CVE-2026-48017 - CVSS 10.0 CriticalCritical · CVSS 9+
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
- Code injection
- CWE-20
<7.1.9 · fixed in 7.1.9
GHSA-8v3q-9vmx-36vc · CVE-2026-47668 - CVSS 4.8 Medium
SourceCodester Ship Ferry Ticket Reservation System manage_user cross site scripting
- SourceCodester Ship Ferry Ticket Reservation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
tittuvarghese CollegeManagementSystem fetch.php cross site scripting
- tittuvarghese CollegeManagementSystem
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.4 High
Command injection in Profile change function
- Teltonika Networks RUTOS
- Teltonika Networks TSWOS
- Code injection
- CVSS 8.1 High
Code injection in Google Chrome
- Google Chrome
- Code injection
- CVSS 6.8 Medium
Improper input validation in Google Chrome
- Google Chrome
- Code injection
- CWE-20
- CVSS 5.4 Medium
Code injection in Google Chrome
- Google Chrome
- Code injection
- CVSS 8.8 High
Code injection in Google Chrome
- Google Chrome
- Code injection
- CVSS 8.8 High
Code injection in Google Chrome
- Google Chrome
- Code injection
- Memory corruption
- CVSS 8.9 High
Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory
- Tautulli
- Code injection
- CVSS 5.3 Medium
itsourcecode Fees Management System navbar.php cross site scripting
- itsourcecode Fees Management System
- Cross-site scripting (XSS)
- Code injection