Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.6 High
JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
- Code injection
>=1.1.0-M1, <1.1.3 || <1.0.4 · fixed in 1.1.3, 1.0.4
GHSA-rp9g-qx29-88cp · CVE-2026-22729 - CVSS 4.8 Medium
itsourcecode University Management System add_result.php cross site scripting
- itsourcecode University Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Portabilis i-Educar Endpoint educar_servidor_curso_lst.php cross site scripting
- Portabilis i-Educar
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
TRENDnet TEW-824DRU Web apply_sec.cgi sub_420A78 cross site scripting
- TRENDnet TEW-824DRU
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.6 High
Code injection in Atlassian Bamboo Data Center
- Atlassian Bamboo Data Center
- Code injection
- CVSS 8.1 High
jsPDF has a PDF Object Injection via FreeText color
- Code injection
- CWE-116
<4.2.1 · fixed in 4.2.1
GHSA-7x6v-j9x4-qf24 · CVE-2026-31898 - CVSS 8.8 High
Chamilo LMS: Authenticated RCE via H5P Import
- chamilo-lms
- Code injection
- CVSS 8.6 High
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
- Code injection
>=4.0.0-RC1, <4.17.5 || >=5.0.0-RC1, <5.9.11 · fixed in 4.17.5, 5.9.11
GHSA-4484-8v2f-5748 · CVE-2026-32264 - CVSS 8.6 High
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
- Code injection
>=5.6.0, <5.9.11 · fixed in 5.9.11
GHSA-qx2q-q59v-wf3j · CVE-2026-32263 - CVSS 8.5 High
RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin
- Code injection
>=3.0.0, <3.2.0 · fixed in 3.2.0
GHSA-8wg7-wm29-2rvg · CVE-2026-32261 - CVSS 5.1 Medium
Aureus ERP vulnerable to cross-site scripting in the Chatter Message Handler
- Cross-site scripting (XSS)
- Code injection
<1.3.0-BETA1 · fixed in 1.3.0-BETA1
GHSA-76c2-3q6g-xvpm · CVE-2026-4175 - CVSS 7.5 High
MLflow has a command injection in mlflow/sagemaker/__init__.py
- Command injection
- Code injection
<3.8.0rc0 · fixed in 3.8.0rc0
GHSA-xch3-2f9x-wh9f · CVE-2025-14287 - CVSS 5.1 Medium
Lagom WHMCS Template Datatables prototype pollution
- Lagom WHMCS Template
- Code injection
- Prototype pollution
- CVSS 8.6 High
Authenticated RCE in Raytha CMS
- Raytha
- Code injection
- CVSS 7.8 High
Code Injection vulnerability affecting SOLIDWORKS Desktop from Release 2025 through Release 2026
- Dassault Systèmes SOLIDWORKS Desktop
- Code injection
- CVSS 4.8 Medium
CMS Made Simple User Management listusers.php cross site scripting
- CMS Made Simple
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.
- Code injection
- CVSS 8.8 High
The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution.
- Code injection
- CVSS 5.1 Medium
UEditor JSONP Callback controller.php cross site scripting
- UEditor
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Tecnick TCExam XML Export tce_xml_users.php F_xml_export_users cross site scripting
- Tecnick TCExam
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Tecnick TCExam Group tce_edit_group.php cross site scripting
- Tecnick TCExam
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Wavlink WL-NU516U1 login.cgi sub_404F68 cross site scripting
- Wavlink WL-NU516U1
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Worksuite HR, CRM and Project Management create cross site scripting
- Worksuite HR, CRM and Project Management
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.2 Medium
AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import
- Mintplex-Labs anything-llm
- Path traversal
- Code injection
- CVSS 8.7 High
SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox
- Code injection
- Broken access control
<1.0.5 · fixed in 1.0.5
GHSA-44vg-5wv2-h2hg · CVE-2026-32640 - CVSS 7.5 High
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
- Code injection
>=1.4.0, <2.14.2 · fixed in 2.14.2
GHSA-cwxj-rr6w-m6w7 · CVE-2026-105782 - CVSS 6.8 Medium
JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering
- jumpserver
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Locutus vulnerable to RCE via unsanitized input in create_function()
- Command injection
- Code injection
<3.0.14 · fixed in 3.0.14
GHSA-vh9h-29pq-r5m8 · CVE-2026-32304 - CVSS 10.0 CriticalCritical · CVSS 9+
SandboxJS affected by a Sandbox Escape
- Code injection
<0.8.34 · fixed in 0.8.34
GHSA-6r9f-759j-hjgv · CVE-2026-26954 - CVSS 7.2 High
WordPress Advanced Woo Labels plugin <= 2.36 - Remote Code Execution (RCE) vulnerability
- ILLID Advanced Woo Labels
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
WordPress Modal Dialog plugin <= 3.5.16 - Remote Code Execution (RCE) vulnerability
- Yannick Lefebvre Modal Dialog
- Code injection
- CVSS 5.1 Medium
Beghelli Sicuro24 SicuroWeb AngularJS Template Injection
- Beghelli SicuroWeb (Sicuro24)
- Code injection
- CVSS 5.3 Medium
itsourcecode Payroll Management System manage_employee_deductions.php cross site scripting
- itsourcecode Payroll Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
CesiumGS CesiumJS standalone.html cross site scripting
- CesiumGS CesiumJS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Campcodes Division Regional Athletic Meet Game Result Matrix System save_up_athlete.php cross site scripting
- Campcodes Division Regional Athletic Meet Game Result Matrix System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Campcodes Division Regional Athletic Meet Game Result Matrix System save-games.php cross site scripting
- Campcodes Division Regional Athletic Meet Game Result Matrix System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
itsourcecode University Management System view_result.php cross site scripting
- itsourcecode University Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
AutohomeCorp frostmourne Oracle Nashorn JavaScript ExpressionRule.java scriptEngine.eval code injection
- AutohomeCorp frostmourne
- Other injection
- Code injection
- CVSS 8.8 High
HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have improper neutralization of special elements used in an O…
- Code injection
- CVSS 5.3 Medium
Jcharis Machine-Learning-Web-Apps Jinja2 Template app.py render_template cross site scripting
- Jcharis Machine-Learning-Web-Apps
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
elecV2P jsfile Endpoint wbjs.js runJSFile code injection
- elecV2P
- Other injection
- Code injection
- CVSS 5.3 Medium
LockerProject Locker Error Response registry.js authIsAwesome cross site scripting
- Locker
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
NetGain EM Plus 10.1.68 Remote Code Execution via script_test.jsp
- NetGain Systems NetGain EM Plus
- Code injection
- CVSS 5.1 Medium
PHPEMS index.php cross site scripting
- PHPEMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.1 High
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
- Code injection
>=4.0.0-beta.1, <4.17.4 || >=5.0.0-RC1, <5.9.9 · fixed in 4.17.4, 5.9.9
GHSA-fp5j-j7j4-mcxc · CVE-2026-31857 - CVSS 8.6 High
Code injection in Micro Research Ltd. MR-GM5L-S1 and others
- Micro Research Ltd. MR-GM5L-S1
- Micro Research Ltd. MR-GM5A-L1
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Side prompt injection attack.
- Code injection
- CVSS 8.6 High
Lantronix EDS5000, G520, and X300 OS Command Injection
- Lantronix EDS5000 series
- Lantronix G520 series
- Command injection
- Code injection
- CVSS 8.6 High
Lantronix EDS5000, G520, and X300 OS Command Injection
- Lantronix EDS5000 series
- Lantronix G520 series
- Command injection
- Code injection
- CVSS 8.6 High
Lantronix EDS5000 OS Command Injection
- Lantronix EDS5000 series
- Command injection
- Code injection
- CVSS 8.6 High
Lantronix EDS5000, G520, and X300 OS Command Injection
- Lantronix EDS5000 series
- Lantronix G520 series
- Command injection
- Code injection
- CVSS 8.7 High
@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes
- Code injection
<1.24.0 · fixed in 1.24.0
GHSA-7fv4-fmmc-86g2 · CVE-2026-31861 - CVSS 7.2 High
Code injection in Schneider Electric EcoStruxure™ Automation Expert
- Schneider Electric EcoStruxure™ Automation Expert
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Eval injection in Siemens SIMATIC Drive Controller CPU 1504D TF and others
- Siemens SIMATIC Drive Controller CPU 1504D TF
- Siemens SIMATIC Drive Controller CPU 1507D TF
- Code injection
- CVSS 8.6 High
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs
- Code injection
<0.23.4 · fixed in 0.23.4
GHSA-93fx-5qgc-wr38 · CVE-2026-100857 - CVSS 5.1 Medium
SourceCodester Resort Reservation System Reservation Management page cross site scripting
- SourceCodester Resort Reservation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache IoTDB has an Improper Input Validation vulnerability
- Code injection
- CWE-20
>=1.0.0, <1.3.7 || >=2.0.0, <2.0.7 · fixed in 1.3.7, 2.0.7
GHSA-6w48-2g9j-v9q5 · CVE-2026-24713 - CVSS 5.3 Medium
itsourcecode Payroll Management System manage_employee_allowances.php cross site scripting
- itsourcecode Payroll Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Web-based Pharmacy Product Management System edit-profile.php cross site scripting
- SourceCodester Web-based Pharmacy Product Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Simple Flight Ticket Booking System showhistory.php cross site scripting
- code-projects Simple Flight Ticket Booking System
- Cross-site scripting (XSS)
- Code injection