Code injection.

plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

• Code injection

>=5.0.0, <5.0.8 || >=6.0.0, <6.0.4 || >=7.0.0, <7.0.2 · fixed in 5.0.8, 6.0.4, 7.0.2

Remote Code Execution Vulnerability

• Zohocorp ManageEngine OpManager
• Zohocorp ManageEngine NetFlow Analyzer
• Code injection

Emacs: emacs: arbitrary code execution in flymake mode

• GNU Emacs
• Red Hat Enterprise Linux 10
• Code injection

YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache

• YAHMAN Add-ons
• Code injection

onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting

• onSite internet GmbH Auktion NG Auktionssoftware
• Cross-site scripting (XSS)
• Code injection

SourceCodester Smart Attendance System with QR Code Scanner Self-Registration student_signup.php prepend cross site scripting

• SourceCodester Smart Attendance System with QR Code Scanner
• Cross-site scripting (XSS)
• Code injection

webpy web.py 0.76 is vulnerable to server-side template injection (SSTI).

• Code injection

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

• IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Code injection

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

• IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Code injection

Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability

• Code injection
• Memory corruption

>=3.0.0, <3.10.0 · fixed in 3.10.0

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

• Path traversal
• Code injection

<0.22.0 · fixed in 0.22.0

dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting

• dgtlmoon Changedetection.io
• Cross-site scripting (XSS)
• Code injection

Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

• Adobe Campaign Classic
• Code injection

Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

• Adobe Campaign Classic
• Code injection

Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

• Adobe Campaign Classic
• Code injection

Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

• Adobe Campaign Classic
• Code injection

Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

• Adobe Campaign Classic
• Code injection

Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

• Adobe Campaign Classic
• Code injection

Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

• Adobe Campaign Classic
• Code injection

Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins

• Apache Software Foundation Apache Calcite Avatica
• Code injection

mtrano APENCMS Template weasel.php eval code injection

• mtrano APENCMS
• Other injection
• Code injection

sfturing hosp_order Public Search Handlers HospitalController.java cross site scripting

• sfturing hosp_order
• Cross-site scripting (XSS)
• Code injection

WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter

• roxnor WP Ultimate Review
• Code injection

Information Disclosure vulnerability in SAP Fiori Launchpad

• SAP_SE SAP Fiori Launchpad
• Code injection

xuxueli xxl-job insert cross site scripting

• xuxueli xxl-job
• Cross-site scripting (XSS)
• Code injection

Code injection in OpenStack Octavia

• OpenStack Octavia
• Code injection

Code injection in OpenStack Octavia

• OpenStack Octavia
• Code injection

Hyve5 Leantime Project Dashboard show.blade.php cross site scripting

• Hyve5 Leantime
• Cross-site scripting (XSS)
• Code injection

Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting

• Hyve5 Leantime
• Cross-site scripting (XSS)
• Code injection

Omega Solution HRM OS SVG File Upload view cross site scripting

• Omega Solution HRM OS
• Cross-site scripting (XSS)
• Code injection

xuxueli xxl-job Task Management JobInfoController.java cross site scripting

• xuxueli xxl-job
• Cross-site scripting (XSS)
• Code injection

RooCMS Frontend Rendering site_pagePHP.php eval code injection

• RooCMS
• Other injection
• Code injection

A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary…

• Code injection

A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary…

• Code injection

An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code ex…

• Code injection

Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to the setServerConfig API endpo…

• Code injection

newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting

• newbee-ltd newbee-mall
• Cross-site scripting (XSS)
• Code injection

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

• OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joomla
• OrdaSoft.com OrdaSoft Joomla Gallery extension for Joomla
• Code injection

SourceCodester Drug Recommendation System index.php cross site scripting

• SourceCodester Drug Recommendation System
• Cross-site scripting (XSS)
• Code injection

SourceCodester Drug Recommendation System Password Change change_password cross site scripting

• SourceCodester Drug Recommendation System
• Cross-site scripting (XSS)
• Code injection

SourceCodester Drug Recommendation System User Management add_user cross site scripting

• SourceCodester Drug Recommendation System
• Cross-site scripting (XSS)
• Code injection

SourceCodester Drug Recommendation System add_symptom cross site scripting

• SourceCodester Drug Recommendation System
• Cross-site scripting (XSS)
• Code injection

Code injection in Vanderbilt University REDCap

• Vanderbilt University REDCap
• Path traversal
• Code injection

DedeCMS mytag_js.php code injection

• DedeCMS
• Other injection
• Code injection

openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer

• openEQUELLA
• Code injection

code-projects Assessment Management add-single-mark.php cross site scripting

• code-projects Assessment Management
• Cross-site scripting (XSS)
• Code injection

code-projects Assessment Management add-user.php cross site scripting

• code-projects Assessment Management
• Cross-site scripting (XSS)
• Code injection

code-projects Assessment Management User Editing edit-user.php cross site scripting

• code-projects Assessment Management
• Cross-site scripting (XSS)
• Code injection

Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection

• Forminator Forms
• Code injection

olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting

• olivier-ls PHP-FTS
• Cross-site scripting (XSS)
• Code injection

OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE

• openpanel
• Code injection

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM

• Code injection

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Fi…

• properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
• Code injection

The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter

• sebwordpress The Welcomizer
• Code injection

Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute

• Save as PDF Plugin by PDFCrowd
• Code injection

WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

• brechtvds WP Recipe Maker
• Code injection

Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Code injection

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Code injection

Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

• MongoDB Inc. Mongoid
• Code injection

Icinga 2 DSL Injection via Unescaped Import Template Name

• icinga2
• Code injection