Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.1 Medium
YiFang CMS D_singlePageGroup.php update cross site scripting
- YiFang CMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
YiFang CMS D_singlePage.php update cross site scripting
- YiFang CMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
YiFang CMS D_friendLink.php update cross site scripting
- YiFang CMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
RustSec Advisory
- Code injection
- Privilege escalation
>=0.1.20, <0.2.9 · fixed in 0.2.9
GHSA-9c4h-pwmf-m6fj · CVE-2026-30960 - CVSS 5.3 Medium
1024-lab/lab1024 SmartAdmin FreeMarker Template MailService.java freemarkerResolverContent special elements used in a template engine
- 1024-lab SmartAdmin
- lab1024 SmartAdmin
- Code injection
- CWE-791
- CVSS 5.1 Medium
1024-lab/lab1024 SmartAdmin Help Documentation HelpDocAddForm.java cross site scripting
- 1024-lab SmartAdmin
- lab1024 SmartAdmin
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
1024-lab/lab1024 SmartAdmin Notice notice-form-drawer.vue cross site scripting
- 1024-lab SmartAdmin
- lab1024 SmartAdmin
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Wavlink WL-WN579X3-C adm.cgi sub_401AD4 cross site scripting
- Wavlink WL-WN579X3-C
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
OpenCart Incomplete Fix CVE-2024-36694 template.php save special elements used in a template engine
- OpenCart
- Code injection
- CWE-791
- CVSS 5.3 Medium
SourceCodester Loan Management System index.php cross site scripting
- SourceCodester Loan Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 10.0 CriticalCritical · CVSS 9+
OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE
- Code injection
<10.0.18 · fixed in 10.0.18
GHSA-h343-gg57-2q67 · CVE-2026-30887 - CVSS 7.2 High
Easy PHP Settings <= 1.0.4 - Authenticated (Administrator+) PHP Code Injection via 'wp_memory_limit' Setting
- shahadul878 Easy PHP Settings
- Code injection
- CVSS 8.3 High
Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner
- mesa
- Code injection
- CVSS 6.1 Medium
WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'
- wpallimport WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
- Code injection
- CVSS 6.6 Medium
Natro Macro: Code Injection through Pattern/Path files
- NatroTeam NatroMacro
- Code injection
- CVSS 8.8 High
Chartbrew: Remote Code Execution (RCE) via Vulnerable API
- chartbrew
- Code injection
- CVSS 7.2 High
Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query
- chartbrew
- Code injection
- CVSS 5.3 Medium
HSC Cybersecurity Mailinspector URL mliUserValidation.php cross site scripting
- HSC Cybersecurity Mailinspector
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.5 High
WordPress JetEngine plugin <= 3.7.2 - Remote Code Execution (RCE) vulnerability
- Crocoblock JetEngine
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
WordPress Widget Options plugin <= 4.1.3 - Remote Code Execution (RCE) vulnerability
- Marketing Fire Widget Options
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress Builderall Builder for WordPress plugin <= 3.0.1 - Remote Code Execution (RCE) vulnerability
- Builderall Builder for WordPress
- Code injection
- CVSS 8.8 High
An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files.
- Code injection
- CVSS 8.8 High
changedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()
- Code injection
<0.54.4 · fixed in 0.54.4
GHSA-6fmw-82m7-jq6p · CVE-2026-29039 - CVSS 8.1 High
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection
- Code injection
<3.0.0 · fixed in 3.0.0
GHSA-fp25-p6mj-qqg6 · CVE-2026-29091 - CVSS 5.4 Medium
Client Isolation Bypass via GTK Manipulation
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8)
- Code injection
- CVSS 7.8 High
Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.
- Code injection
- Broken access control
- CVSS 4.0, no score published
OpenClaw hook transform path containment missed symlink-resolved escapes
- Code injection
<2026.2.22 · fixed in 2026.2.22
GHSA-659f-22xc-98f2 - CVSS 8.6 High
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI
- Code injection
>=4.0.0-RC1, <4.17.0-beta.1 || >=5.0.0-RC1, <5.9.0-beta.1 · fixed in 4.17.0-beta.1, 5.9.0-beta.1
GHSA-qc86-q28f-ggww · CVE-2026-28784 - CVSS 9.4 CriticalCritical · CVSS 9+
Craft CMS has Twig Function Blocklist Bypass
- Code injection
- CWE-184
>=4.0.0-RC1, <4.17.0-beta.1 || >=5.0.0-RC1, <5.9.0-beta.1 · fixed in 4.17.0-beta.1, 5.9.0-beta.1
GHSA-5fvc-7894-ghp4 · CVE-2026-28783 - CVSS 9.4 CriticalCritical · CVSS 9+
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
- Code injection
>=4.0.0-RC1, <4.17.0-beta.1 || >=5.0.0-RC1, <5.9.0-beta.1 · fixed in 4.17.0-beta.1, 5.9.0-beta.1
GHSA-v47q-jxvr-p68x · CVE-2026-28697 - CVSS 7.5 High
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
- Path traversal
- Code injection
>=4.0.0-RC1, <4.17.0-beta.1 || >=5.8.7, <5.9.0-beta.1 · fixed in 4.17.0-beta.1, 5.9.0-beta.1
GHSA-94rc-cqvm-m4pw · CVE-2026-28695 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache Ranger has a Code Injection vulnerability
- Code injection
<2.8.0 · fixed in 2.8.0
GHSA-c87w-642h-m97h · CVE-2025-59059 - CVSS 8.8 High
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI Name parameter.
- Code injection
- CVSS 2.0 Low
An issue was discovered in Nokia Impact before Mobile 23_FP1.
- Code injection
- CVSS 8.8 High
AFFiNE: One-click Remote Code Execution through Custom URL Handling
- toeverything AFFiNE
- Code injection
- CVSS 8.8 High
Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview
- Jewel Theme Master Addons for Elementor Premium
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Chamilo: Evaluation of untrusted user input leads to Remote Code Execution
- chamilo-lms
- Code injection
- CVSS 5.3 Medium
itsourcecode University Management System att_single_view.php cross site scripting
- itsourcecode University Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.9 Medium
eosphoros-ai db-gpt Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection
- eosphoros-ai db-gpt
- Other injection
- Code injection
- CVSS 4.8 Medium
PHPGurukul Student Record Management System edit-subject.php cross site scripting
- PHPGurukul Student Record Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
PHPGurukul Student Record Management System edit-course.php cross site scripting
- PHPGurukul Student Record Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.
- Code injection
- CVSS 7.2 High
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin_change_picture.php.
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue was discovered in Tenda W20E V4.0br_V15.11.0.6.
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi.
- Code injection
- CVSS 6.9 Medium
MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection
- MaxSite CMS
- Other injection
- Code injection
- CVSS 8.0 High
Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
- Code injection
<5.73.16 || >=6.0.0-alpha.1, <6.7.2 · fixed in 5.73.16, 6.7.2
GHSA-cpv7-q2wx-m8rw · CVE-2026-28425 - CVSS 8.1 High
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
- Code injection
<7.0.3 · fixed in 7.0.3
GHSA-5c6j-r48x-rmvq - CVSS 5.3 Medium
OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)
- Other injection
- Code injection
<2026.2.21 · fixed in 2026.2.21
GHSA-82g8-464f-2mv7 · CVE-2026-4039 - CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Langflow has Remote Code Execution in CSV Agent
- Code injection
<=1.8.0rc2 · no fixed version yet
GHSA-3645-fxcv-hqr4 · CVE-2026-27966 - CVSS 8.8 High
Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
- Johnson Controls Frick Controls Quantum HD
- Code injection
- CVSS 8.8 High
Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
- Johnson Controls Frick Controls Quantum HD
- Code injection
- CVSS 8.8 High
Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
- Johnson Controls Frick Controls Quantum HD
- Code injection
- CVSS 5.3 Medium
SourceCodester Doctor Appointment System Sign Up register.php cross site scripting
- SourceCodester Doctor Appointment System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.6 High
Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)
- Elastic Kibana
- Code injection
- CVSS 8.8 High
Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the ...
- Code injection
<0.86.8 · fixed in 0.86.8
GHSA-cfr2-mp74-3763 · CVE-2026-27961 - CVSS 8.8 High
Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluator. Agenta used RestrictedPython as a s...
- Code injection
<0.48.1 · fixed in 0.48.1
GHSA-pmgp-2m3v-34mq · CVE-2026-27952 - CVSS 7.8 High
An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java component
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
n8n: Expression Sandbox Escape Leads to RCE
- Code injection
<1.123.22 || >=2.0.0, <2.9.3 || >=2.10.0, <2.10.1 · fixed in 1.123.22, 2.9.3, 2.10.1
GHSA-vpcf-gvg4-6qwr · CVE-2026-27577 - CVSS 9.0 CriticalCritical · CVSS 9+
n8n has Arbitrary Command Execution via File Write and Git Operations
- Code injection
<1.123.8 || >=2.0.0, <2.2.0 · fixed in 1.123.8, 2.2.0
GHSA-x2mw-7j39-93xq · CVE-2026-27498