Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection
- provectus kafka-ui
- Other injection
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c
- Code injection
- CVSS 8.1 High
In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.
- Code injection
- CVSS 5.1 Medium
Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine
- Dromara UJCMS
- Code injection
- CWE-791
- CVSS 5.3 Medium
SourceCodester Stock Management System getOrderReport.php cross site scripting
- SourceCodester Stock Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Stock Management System printOrder.php cross site scripting
- SourceCodester Stock Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting
- SourceCodester Class and Exam Timetabling System
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.8 High
Eval injection in CHIRP
- CHIRP
- Code injection
- CVSS 5.3 Medium
SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting
- SourceCodester Class and Exam Timetabling System
- Cross-site scripting (XSS)
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2
- fabrikar.com Fabrik extension for Joomla
- Code injection
- CVSS 9.5 CriticalCritical · CVSS 9+
Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2
- fabrikar.com Fabrik extension for Joomla
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2
- fabrikar.com Fabrik extension for Joomla
- Code injection
- CVSS 5.3 Medium
kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter
- properfraction kk Star Ratings – Rate Post & Collect User Feedbacks
- Code injection
- CVSS 7.2 High
Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite
- Forminator Forms
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
- Code injection
<1.8.8 || >=2.0.0, <2.2.1 · fixed in 1.8.8, 2.2.1
GHSA-66mm-25pp-rfff · CVE-2026-77415 - CVSS 9.3 CriticalCritical · CVSS 9+
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
- Code injection
<1.8.8 || >=2.0.0, <2.2.1 · fixed in 1.8.8, 2.2.1
GHSA-2943-5xfg-gq5f · CVE-2026-77414 - CVSS 7.8 High
Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
- Code injection
<1.3.4 · fixed in 1.3.4
GHSA-2cp2-2r3c-7p7r · CVE-2026-68508 - CVSS 9.3 CriticalCritical · CVSS 9+
JSONata: Arbitrary Code Execution via crafted JSONata expressions
- Code injection
<1.8.8 || >=2.0.0, <2.2.0 · fixed in 1.8.8, 2.2.0
GHSA-8gq3-vp5j-2grp · CVE-2026-77413 - CVSS 10.0 CriticalCritical · CVSS 9+
Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing
- Code injection
<2.7.0 · fixed in 2.7.0
GHSA-x2rj-828p-hx9m · CVE-2026-61539 - CVSS 9.2 CriticalCritical · CVSS 9+
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)
- Code injection
<5.16.0 · fixed in 5.16.0
GHSA-hrwp-4hh9-c8r8 · CVE-2026-59989 - CVSS 9.4 CriticalCritical · CVSS 9+
Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune Connector
- AWS Athena Federated Query Neptune Connector
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Code injection in SPIP
- SPIP
- Code injection
- CVSS 8.1 High
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass
- Drag and Drop Multiple File Upload for Contact Form 7
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Code injection in SPIP
- SPIP
- Code injection
- CVSS 7.8 High
Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability
- aeon
- Code injection
- CVSS 7.8 High
Aeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerability
- aeon
- Code injection
- CVSS 8.6 High
baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php
- baserproject basercms
- SQL injection
- Code injection
- CVSS 8.4 High
@cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag
- @cgauge/yaml
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability
- Jonathan Daggerhart Query Wrangler
- Code injection
- CVSS 7.2 High
n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution
- n8n
- Code injection
- CVSS 8.4 High
n8n before 1.123.69 Expression Injection via Resource Locator
- n8n
- Code injection
- CVSS 6.0 Medium
n8n before 1.123.69 SSRF via Edit Image Node
- n8n
- Code injection
- CVSS 6.6 Medium
Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder
- Royal Addons for Elementor
- Code injection
- CVSS 6.9 Medium
chenhg5 cc-connect webhook.go authenticate code injection
- chenhg5 cc-connect
- Other injection
- Code injection
- CVSS 8.8 High
Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise
- Splunk Enterprise
- Code injection
- CVSS 8.8 High
Code Injection through Splunk Web Manager Configuration in Splunk Enterprise
- Splunk Enterprise
- Code injection
- CVSS 8.8 High
Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise
- Splunk Enterprise
- Code injection
- CVSS 6.3 Medium
Logto: OS command injection vulnerability exists in the Commitlint workflow
- logto
- Code injection
- CVSS 7.2 High
Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
- Code injection
<9.1.0 · fixed in 9.1.0
GHSA-w47q-945m-q9pc · CVE-2026-53964 - CVSS 8.8 High
Copier has a trust-prefix bypass via path traversal that runs tasks unprompted
- Path traversal
- Code injection
>=9.5.0, <9.15.2 · fixed in 9.15.2
GHSA-9gmc-jqmh-3rvm · CVE-2026-53951 - CVSS 6.2 Medium
Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Code injection
- CVSS 8.7 High
marimo < 0.23.15 Code Injection via MCP Server Configuration
- marimo
- Code injection
- CVSS 9.5 CriticalCritical · KEV, CVSS 9+KEV
Code injection in TrueConf Server
- TrueConf Server
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Ground Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code execution
- sgoudelis ground-station
- Path traversal
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File
- PoxenStudio talebook
- Code injection
- CWE-829
- CVSS 7.8 High
Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution
- vim
- Red Hat Enterprise Linux 10.2 Extended Update Support
- Code injection
- CVSS 8.7 High
ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback
- ArcadeData arcadedb
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2
- balbooa.com Balbooa Forms extension for Joomla
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability
- Crocoblock. Jetimpex Inc. JetEngine
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection
- Broken Link Checker
- Code injection
- CVSS 5.3 Medium
xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine
- xianrendzw EasyReport
- Code injection
- CWE-791
- CVSS 9.8 CriticalCritical · CVSS 9+
jmespath.php has CompilerRuntime code injection via unescaped function names
- Code injection
- CWE-20
<2.9.1 · fixed in 2.9.1
GHSA-pcw8-m77r-2528 · CVE-2026-54133 - CVSS 10.0 CriticalCritical · CVSS 9+
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
- Code injection
>=0.1.0, <0.9.1 · fixed in 0.9.1
GHSA-7pwq-q9jf-539h · CVE-2026-55107 - CVSS 7.6 High
Server-side template injection in Integrated Publishing Toolkit
- GBIF Integrated Publishing Toolkit
- Code injection
- CVSS 7.5 High
RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading
- Code injection
<5.33.0 · fixed in 5.33.0
GHSA-6g32-pxv4-2wfj · CVE-2026-63337 - CVSS 9.8 CriticalCritical · CVSS 9+
MyBB: Installer database configuration RCE
- mybb
- Code injection
- CVSS 7.1 High
Vim: Arbitrary Ex Command Execution in C Omni-Completion
- vim
- Code injection
- CWE-829
- CVSS 8.8 High
Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files
- ohmyzsh
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability
- AresIT WP Compress
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability
- Cwicly
- Code injection