Code injection.

Bolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rendering

• bolt core
• Code injection

ember-dynamic-render-template Client-Side Template Injection via Unsanitized templateString

• miguelcobain ember-dynamic-render-template
• Code injection

rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation

• iot-ecology rust-iot-platform
• Code injection

Path traversal in Eclipse Foundation Eclipse Mojarra

• Eclipse Foundation Eclipse Mojarra
• Path traversal
• Code injection

DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering

• DjangoCRM django-crm
• Code injection

Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

• absmach magistrala
• Code injection

MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE

• magicblack maccms10
• Code injection

ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API

• devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
• Code injection

MaxSite CMS Unauthenticated RCE via Install Endpoint

• MaxSite CMS
• Code injection

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

• Code injection

<3.1.3 · fixed in 3.1.3

Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

• Code injection

<3.1.3 · fixed in 3.1.3

Flowise RCE via SQLite Record Manager Node

• Code injection

<3.1.3 · fixed in 3.1.3

Code injection in Veeam ONE

• Veeam ONE
• Code injection

Code injection in Veeam ONE

• Veeam ONE
• Code injection

Flowise: Remote Code Execution Vulnerability in CSVAgent

• Code injection

<3.1.3 · fixed in 3.1.3

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

• Code injection

<3.1.3 · fixed in 3.1.3

Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

• Code injection

<3.1.3 · fixed in 3.1.3

LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution

• dromara lamp-cloud
• Code injection

Flowise Sandbox Escape to RCE

• Code injection

<3.1.3 · fixed in 3.1.3

vibesurf-ai VibeSurf Python Validation code code injection

• VibeSurf
• Other injection
• Code injection

Flowise RCE via TypeORM DataSource

• Code injection

<3.1.3 · fixed in 3.1.3

Perspective 5.0.0 RCE via eval() Expression Injection

• perspective
• Code injection

Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)

• Create Block Theme
• Code injection

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c

• Code injection

Microsoft Edge (Chromium-based) Spoofing Vulnerability

• Microsoft Edge (Chromium-based)
• Code injection

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

• Adobe Campaign Classic
• Code injection

Adobe Campaign Classic (ACC) | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)

• Adobe Campaign Classic
• Code injection

Sensor Proxy Version 1.4.2 Fixes One Vulnerability

• Tenable, Inc. Sensor Proxy
• Code injection

OpenAkita File Upload API upload cross site scripting

• OpenAkita
• Cross-site scripting (XSS)
• Code injection

langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine

• langgenius dify
• Code injection
• CWE-791

WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

• WebsiteBaker Org e.V. WebsiteBaker CMS
• Code injection

OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection

• openemr
• Code injection

Duplicate Advisory: Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

• Code injection

>=2.0.7, <=2.0.10 · no fixed version yet

Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter

• wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
• Code injection

sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

• Code injection

<5.6.0 · fixed in 5.6.0

Savon::Model evaluates WSDL operation names as Ruby source

• Code injection

>=0.9.8, <2.17.2 · fixed in 2.17.2

@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification

• Code injection

<2.0.0 · fixed in 2.0.0

Unauthenticated RCE in Innotim Software's Logsign SIEM

• Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM
• Code injection

ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)

• ElementsKit Elementor Addons
• Code injection

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request

• Code injection

AWS Amplify Studio UI Component Properties Has an Input Validation Issue

• Code injection

<2.20.3 · fixed in 2.20.3

Remote Code Execution in CUGA Component CodeAgent

• IBM Langflow OSS
• Code injection

Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react

• AWS Amplify Codegen UI
• Code injection

CVE-2026-15971

• SGLang
• Code injection

Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure

• IBM Langflow OSS
• Code injection

Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter

• Remote API
• Code injection

Code injection in Google Chrome

• Google Chrome
• Code injection

AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping

• Code injection

>=0.3.0-preview.7.0, <=0.3.0-preview.9.0 || >=0.4.0, <0.14.2 || >=1.0.0-preview.1, <1.0.0-preview.9 · fixed in 0.14.2, 1.0.0-preview.9

swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

• Other injection
• Code injection

<13.12.2 · fixed in 13.12.2

swagger-typescript-api vulnerable to code injection via unescaped enum string values

• Other injection
• Code injection

<13.12.2 · fixed in 13.12.2

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

• Other injection
• Code injection

<13.12.2 · fixed in 13.12.2

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

• Other injection
• Code injection

<13.12.2 · fixed in 13.12.2

Server-Side Template Injection in SecureTransport's Apache Velocity mail templates

• Axway SecureTransport
• Code injection

Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter

• StylemixThemes Cost Calculator Builder PRO
• Code injection

Streamit < 4.5.2 - Unauthenticated Remote Code Execution via Arbitrary Function Call

• Streamit
• Code injection

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

• Code injection

>=0.14.1, <0.60.2 · fixed in 0.60.2

`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

• Code injection

>=0.17.0, <0.60.2 · fixed in 0.60.2

`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

• Code injection

>=0.52.1, <0.60.2 · fixed in 0.60.2

datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

• Code injection

>=0.11.6, <0.64.0 · fixed in 0.64.0

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

• Code injection

>=0.25.0, <0.60.1 · fixed in 0.60.1