Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.1 Medium
Blossom Article Title ArticleController.java content cross site scripting
- Blossom
- Cross-site scripting (XSS)
- Code injection
- CVSS 3.7 Low
OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions
- Other injection
- Code injection
<2026.2.3 · fixed in 2026.2.3
GHSA-782p-5fr5-7fj8 · CVE-2026-24764 - CVSS 9.9 CriticalCritical · CVSS 9+
A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers to execute arbitrary code via injecting crafted Freemarker…
- Code injection
- CVSS 5.1 Medium
cskefu File Upload MediaController.java upload cross site scripting
- cskefu
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
LigeroSmart index.pl AgentDashboard cross site scripting
- LigeroSmart
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
LigeroSmart index.pl cross site scripting
- LigeroSmart
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
LigeroSmart index.pl cross site scripting
- LigeroSmart
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
An issue in Visual Studio Code Extensions Markdown Preview Enhanced v0.8.18 allows attackers to execute arbitrary code via uploading a crafted .Md file.
- Code injection
- CVSS 7.8 High
An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace.
- Code injection
- CVSS 7.3 High
Apache Avro Java SDK is Vulnerable to Code Injection
- Code injection
>=1.12.0, <1.12.1 || <1.11.5 · fixed in 1.12.1, 1.11.5
GHSA-rp46-r563-jrc7 · CVE-2025-33042 - CVSS 8.8 High
Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC
- Code injection
<=0.19.0 · no fixed version yet
GHSA-wj8p-jj64-h7ff · CVE-2026-26056 - CVSS 9.1 CriticalCritical · CVSS 9+
authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint
- authentik
- Code injection
- CVSS 8.8 High
next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content
- Code injection
>=4.3.0, <6.0.0 · fixed in 6.0.0
GHSA-g4xw-jxrg-5f6m · CVE-2026-0969 - CVSS 7.8 High
An issue in filosoft Comerc.32 Commercial Invoicing v.16.0.0.3 allows a local attacker to execute arbitrary code via the comeinst.exe file
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
DiskCache has unsafe pickle deserialization
- Code injection
- Insecure deserialization
<=5.6.3 · no fixed version yet
GHSA-w8v5-vhqr-4h9v · CVE-2025-69872 - CVSS 9.3 CriticalCritical · CVSS 9+
Chevereto 3.13.4 Core - Remote Code Execution
- Chevere SpA Chevereto
- Code injection
- CVSS 4.6 Medium
KeePass 2.44 - Denial of Service (PoC)
- KeePass Password Safe
- Code injection
- CVSS 7.0 High
Code injection in Schneider Electric EcoStruxure Building Operation Workstation and others
- Schneider Electric EcoStruxure Building Operation Workstation
- Schneider Electric EcoStruxure Building Operation Webstation
- Code injection
- CVSS 1.1 Low
File Station 5
- QNAP Systems Inc. File Station 5
- Code injection
- CVSS 8.8 HighCritical · CVSS 7+ and EPSS
Custom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution
- nko Custom Block Builder – Lazy Blocks
- Code injection
- CVSS 7.2 High
Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter
- villatheme Lucky Wheel Giveaway
- Code injection
- CVSS 8.8 High
GitHub Copilot and Visual Studio Remote Code Execution Vulnerability
- Microsoft Visual Studio 2022 version 17.14
- Microsoft Visual Studio 2026 version 18.3
- Command injection
- Code injection
- CVSS 8.8 High
Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability
- Microsoft Defender for Endpoint for Linux
- Code injection
- CVSS 8.8 High
Unauthenticated Remote Code Execution via P2P Sharing in ZAI-Shell
- TaklaXBR zai-shell
- Code injection
- CVSS 8.6 High
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
- Code injection
>=4.0.0-RC1, <4.16.18 || >=5.0.0-RC1, <5.8.22 · fixed in 4.16.18, 5.8.22
GHSA-7jx7-3846-m7w7 · CVE-2026-25498 - CVSS 5.1 Medium
code-projects Online Reviewer System btn_functions.php cross site scripting
- code-projects Online Reviewer System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
code-projects Online Reviewer System btn_functions.php cross site scripting
- code-projects Online Reviewer System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
- GitLab AI Gateway
- Code injection
- CVSS 9.2 CriticalCritical · CVSS 9+
jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions
- Code injection
<1.3.0 · fixed in 1.3.0
GHSA-87r5-mp6g-5w5j · CVE-2026-1615 - CVSS 4.8 Medium
code-projects for Plugin AdminAddAlbum.php cross site scripting
- code-projects for Plugin
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
ZeroWdd studentmanager LeaveController.java addLeave cross site scripting
- ZeroWdd studentmanager
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
heyewei JFinalCMS API Endpoint save cross site scripting
- heyewei JFinalCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Simple Responsive Tourism Website Master.php cross site scripting
- SourceCodester Simple Responsive Tourism Website
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Simple Responsive Tourism Website Registration Master.php cross site scripting
- SourceCodester Simple Responsive Tourism Website
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
code-projects Online Student Management System Announcement Management index.php cross site scripting
- code-projects Online Student Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System Patient Registration registration.php cross site scripting
- SourceCodester Patients Waiting Area Queue Management System
- Patrick Mvuma Patients Waiting Area Queue Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System checkin.php cross site scripting
- SourceCodester Patients Waiting Area Queue Management System
- Patrick Mvuma Patients Waiting Area Queue Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System appointments.php cross site scripting
- SourceCodester Patients Waiting Area Queue Management System
- Patrick Mvuma Patients Waiting Area Queue Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
cym1102 nginxWebUI Web Management check cross site scripting
- cym1102 nginxWebUI
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.8 High
Calibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Export
- kovidgoyal calibre
- Code injection
- CVSS 8.2 High
calibre has a Path Traversal Leading to Arbitrary File Corruption and Code Execution
- kovidgoyal calibre
- Path traversal
- Code injection
- CVSS 5.1 Medium
Portabilis i-Educar User Data meusdadod.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
abhiphile fermat-mcp eqn_chart.py eqn_chart code injection
- abhiphile fermat-mcp
- Other injection
- Code injection
- CVSS 5.3 Medium
isaacwasserman mcp-vegalite-server visualize_data eval code injection
- isaacwasserman mcp-vegalite-server
- Other injection
- Code injection
- CVSS 4.8 Medium
Edimax BR-6288ACL wiz_WISP24gmanual.asp wiz_WISP24gmanual cross site scripting
- Edimax BR-6288ACL
- Cross-site scripting (XSS)
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
@nyariv/sandboxjs has a Sandbox Escape vulnerability
- Other injection
- Code injection
<0.8.29 · fixed in 0.8.29
GHSA-66h4-qj4x-38xp · CVE-2026-25587 - CVSS 5.9 Medium
LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845N
- TP-Link Systems Inc. Archer MR200 v5.2
- TP-Link Systems Inc. Archer C20 v6
- Code injection
- CVSS 8.6 High
PHP-Fusion 9.03.50 - 'panels.php' Eval Injection
- PHP Fusion
- Code injection
- CVSS 8.6 High
Potential code smuggling via doc comments in cmd/cgo
- Code injection
<1.24.13 || >=1.25.0-0, <1.25.7 · fixed in 1.24.13, 1.25.7
GO-2026-4433 · CVE-2025-61732 - CVSS 7.2 High
An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function
- Code injection
- CVSS 8.8 High
Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper
- Code injection
- Privilege escalation
<0.23.0 · fixed in 0.23.0
GHSA-cc8m-98fm-rc9g · CVE-2026-23742 - CVSS 7.8 High
Code injection in NVIDIA Megatron-LM
- NVIDIA Megatron-LM
- Code injection
- CVSS 7.7 High
Claude Code has a Command Injection in find Command Bypasses User Approval Prompt
- Command injection
- Code injection
<2.0.72 · fixed in 2.0.72
GHSA-qgqw-h4xq-7w8w · CVE-2026-24887 - CVSS 9.8 CriticalCritical · CVSS 9+
FUXA allows Remote Code Execution (RCE) via the project import functionality.
- Command injection
- Code injection
<=1.2.7 · no fixed version yet
GHSA-5r63-q8hg-p8qx · CVE-2025-69983 - CVSS 9.8 CriticalCritical · CVSS 9+
JinJava Bypass through ForTag leads to Arbitrary Java Execution
- Code injection
>=2.8.0, <2.8.3 || <2.7.6 · fixed in 2.8.3, 2.7.6
GHSA-gjx9-j8f8-7j74 · CVE-2026-25526 - CVSS 10.0 CriticalCritical · CVSS 9+
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
- Code injection
- Unrestricted file upload
<0.28.5.0 · fixed in 0.28.5.0
GHSA-gp56-f67f-m4px · CVE-2026-25510 - CVSS 7.7 High
@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
- Code injection
<1.13.11 || >=1.14.0, <1.14.1 · fixed in 1.13.11, 1.14.1
GHSA-6jr7-99pf-8vgf · CVE-2026-25153 - CVSS 10.0 CriticalCritical · CVSS 9+
SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE
- Code injection
- Prototype pollution
<0.8.27 · fixed in 0.8.27
GHSA-9p4w-fq8m-2hp7 · CVE-2026-25142 - CVSS 8.1 High
jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution
- Code injection
- CWE-116
<4.1.0 · fixed in 4.1.0
GHSA-pqxr-3g65-p328 · CVE-2026-24737 - CVSS 4.8 Medium
D-Link DSL-6641K sp_pppoe_user.js doSubmitPPP cross site scripting
- D-Link DSL-6641K
- Cross-site scripting (XSS)
- Code injection