Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.5 High
Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.
- Code injection
- CVSS 5.1 Medium
LigeroSmart index.pl cross site scripting
- LigeroSmart
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
LigeroSmart index.pl cross site scripting
- LigeroSmart
- Cross-site scripting (XSS)
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter
- Code injection
<0.8.0 · fixed in 0.8.0
GHSA-5882-5rx9-xgxp · CVE-2026-26216 - CVSS 9.7 CriticalCritical · CVSS 9+
Dive allows One-click Remote Code Execution through Deep Links for MCP Install
- OpenAgentPlatform Dive
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
AVEVA Process Optimization Code Injection
- AVEVA Process Optimization
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
AVEVA Process Optimization Code Injection
- AVEVA Process Optimization
- Code injection
- CVSS 7.2 High
Shopware Has Improper Control of Generation of Code in Twig rendered views
- Code injection
>=6.7.0.0, <6.7.6.1 · fixed in 6.7.6.1
GHSA-7cw6-7h3h-v8pf · CVE-2026-23498 - CVSS 10.0 CriticalCritical · CVSS 9+
enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain
- Code injection
- CWE-693
<2.7.0 · fixed in 2.7.0
GHSA-7qm7-455j-5p63 · CVE-2026-22686 - CVSS 7.2 High
Cursor has a Terminal Tool Allowlist Bypass via Environment Variables
- cursor
- Other injection
- Command injection
- CVSS 8.6 High
4images 1.9 - Remote Command Execution (RCE)
- 4Homepages 4images
- Code injection
- CVSS 8.9 High
Eigent Allows Arbitrary Code Execution via pull_request_target CI Workflow
- eigent
- Code injection
- CVSS 7.5 High
UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation
- Code injection
- Insecure deserialization
<=8.13.16 · no fixed version yet
GHSA-vrgw-pc9c-qrrc · CVE-2025-68924 - CVSS 10.0 CriticalCritical · CVSS 9+
openc3-api Vulnerable to Unauthenticated Remote Code Execution
- Code injection
>=5.0.6, <6.10.2 · fixed in 6.10.2
GHSA-w757-4qv9-mghp · CVE-2025-68271 - CVSS 8.8 High
Envoy Extension Policy lua scripts injection causes arbitrary command execution
- Code injection
<1.5.7 || >=1.6.0-rc.0, <1.6.2 · fixed in 1.5.7, 1.6.2
GHSA-xrwg-mqj6-6m22 · CVE-2026-22771 - CVSS 8.8 High
Config-Upload Code Injection
- Phoenix Contact TC ROUTER 3002T-3G
- Phoenix Contact TC ROUTER 2002T-3G
- Code injection
- CVSS 9.6 CriticalCritical · CVSS 9+
Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)
- SAP_SE SAP Wily Introscope Enterprise Manager (WorkStation)
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)
- SAP_SE SAP S/4HANA (Private Cloud and On-Premise)
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Code Injection vulnerability in SAP Landscape Transformation
- SAP_SE SAP Landscape Transformation
- Code injection
- CVSS 4.8 Medium
Luxul XWR-600 Web Administration cross site scripting
- Luxul XWR-600
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting
- Cross-site scripting (XSS)
- Code injection
<1.1.10 · fixed in 1.1.10
GHSA-xf94-h87h-g9wr · CVE-2026-0824 - CVSS 9.3 CriticalCritical · CVSS 9+
AccessAlly < 3.3.2 Unauthenticated Arbitrary PHP Code Execution
- AccessAlly
- Code injection
- CVSS 4.8 Medium
PHPGurukul Staff Leave Management System SVG File adminviews.py UPDATE_STAFF cross site scripting
- PHPGurukul Staff Leave Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface /snail-job/workflow/check-node-expression can execute QLExpress expressions, but it does not filter user input, allowing…
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
JimuReport thru version 2.1.3 is vulnerable to remote code execution when processing user-controlled H2 JDBC URLs.
- Code injection
- CVSS 8.5 High
OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE
- Code injection
>=1.5.0, <1.11.4 · fixed in 1.11.4
GHSA-5f29-2333-h9c7 · CVE-2026-22244 - CVSS 7.6 High
pnpm vulnerable to Command Injection via environment variable substitution
- Command injection
- Code injection
>=6.25.0, <10.27.0 · fixed in 10.27.0
GHSA-2phv-j68v-wwqx · CVE-2025-69262 - CVSS 2.3 Low
carbone Code Injection vulnerability
- Code injection
- Prototype pollution
<3.5.6 · fixed in 3.5.6
GHSA-6rcw-ww3x-xqwm · CVE-2024-14020 - CVSS 4.8 Medium
projectworlds House Rental and Property Listing complaint.php cross site scripting
- projectworlds House Rental and Property Listing
- Cross-site scripting (XSS)
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
n8n Vulnerable to RCE via Arbitrary File Write
- Code injection
- Unrestricted file upload
>=0.123.0, <1.121.3 · fixed in 1.121.3
GHSA-v364-rw7m-3263 · CVE-2026-21877 - CVSS 8.6 High
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
- Code injection
>=4.0.0-RC1, <4.16.17 || >=5.0.0-RC1, <5.8.21 · fixed in 4.16.17, 5.8.21
GHSA-255j-qw47-wjh5 · CVE-2025-68455 - CVSS 5.2 Medium
Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI
- Code injection
>=4.0.0-RC1, <4.16.17 || >=5.0.0-RC1, <5.8.21 · fixed in 4.16.17, 5.8.21
GHSA-742x-x762-7383 · CVE-2025-68454 - CVSS 8.8 High
muffon has One-click Remote Code Execution via XSS and Custom URL Handling
- staniel359 muffon
- Code injection
- CVSS 5.1 Medium
Xinhu Rainrock RockOA API rockfun.php cross site scripting
- Xinhu Rainrock RockOA
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Xinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scripting
- Xinhu Rainrock RockOA
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Online Product Reservation System prod.php cross site scripting
- code-projects Online Product Reservation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester API Key Manager App Import Key cross site scripting
- SourceCodester API Key Manager App
- Cross-site scripting (XSS)
- Code injection
- CVSS 2.3 Low
zhanglun lettura RSS ContentRender.tsx cross site scripting
- zhanglun lettura
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
xnx3 wangmarket Backend Variable Search variableList.do variableList cross site scripting
- xnx3 wangmarket
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
xnx3 wangmarket System Variables variableSave.do cross site scripting
- xnx3 wangmarket
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.4 High
Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
- Code injection
<2.3.10 · fixed in 2.3.10
GHSA-mqhg-v22x-pqj8 · CVE-2026-21449 - CVSS 8.9 High
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
- Code injection
<2.3.10 · fixed in 2.3.10
GHSA-5j4h-4f72-qpm6 · CVE-2026-21448 - CVSS 7.3 High
Bagisto SSTI vulnerability in type parameter can lead to RCE
- Code injection
<2.3.10 · fixed in 2.3.10
GHSA-9hvg-qw5q-wqwp · CVE-2026-21450 - CVSS 8.1 High
Malware Remover
- QNAP Systems Inc. Malware Remover
- Code injection
- CVSS 7.3 High
Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package
- Code injection
<2.9.0 · fixed in 2.9.0
GHSA-93jc-vqqc-vvvh · CVE-2025-68619 - CVSS 5.1 Medium
LigeroSmart Environment Variable cross site scripting
- LigeroSmart
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
xnx3 wangmarket Add Global Variable save.do cross site scripting
- xnx3 wangmarket
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
iCMS POST Parameter ConfigAdmincp.php save code injection
- iCMS
- Other injection
- Code injection
- CVSS 5.3 Medium
Kohana KodiCMS Layout API Endpoint file.php save code injection
- Kohana KodiCMS
- Other injection
- Code injection
- CVSS 5.1 Medium
elinicksic Razgover Chat Message send.php cross site scripting
- elinicksic Razgover
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
EyouCMS Ask Module Ask.php cross site scripting
- EyouCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Philipinho Simple-PHP-Blog login.php cross site scripting
- Philipinho Simple-PHP-Blog
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
youlaitech vue3-element-admin Notice index.vue cross site scripting
- youlaitech vue3-element-admin
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.6 High
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter
- Code injection
- Insecure deserialization
<0.0.34 · fixed in 0.0.34
GHSA-46h3-79wf-xr6c · CVE-2025-71367 - CVSS 7.6 High
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller
- Code injection
- Insecure deserialization
<0.0.34 · fixed in 0.0.34
GHSA-955r-x9j8-7rhh · CVE-2025-71375 - CVSS 7.6 High
Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length
- Code injection
- Insecure deserialization
<0.0.33 · fixed in 0.0.33
GHSA-6556-fwc2-fg2p · CVE-2025-71339 - CVSS 7.6 High
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef
- Code injection
- Insecure deserialization
<0.0.33 · fixed in 0.0.33
GHSA-rrxm-2pvv-m66x · CVE-2025-71372 - CVSS 5.1 Medium
08CMS Novel System Template mtpls.inc.php code injection
- 08CMS Novel System
- Other injection
- Code injection
- CVSS 5.1 Medium
zhujunliang3 work_platform Content cross site scripting
- zhujunliang3 work_platform
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
sunhailin12315 product-review 商品评价系统 Write a Review cross site scripting
- sunhailin12315 product-review 商品评价系统
- Cross-site scripting (XSS)
- Code injection