Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
code-projects Simple Laundry System Parameter modify.php cross site scripting
- code-projects Simple Laundry System
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.8 High
BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml
- Code injection
<1.4.37 · fixed in 1.4.37
GHSA-jfjg-vc52-wqvf · CVE-2026-33744 - CVSS 5.3 Medium
dameng100 muucmf list.html cross site scripting
- dameng100 muucmf
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
dameng100 muucmf list.html cross site scripting
- dameng100 muucmf
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
dameng100 muucmf autoReply.html cross site scripting
- dameng100 muucmf
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
dameng100 muucmf index.html cross site scripting
- dameng100 muucmf
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
code-projects Accounting System Web Application add_costumer.php cross site scripting
- code-projects Accounting System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode
- SQL injection
- Code injection
<1.123.27 || >=2.0.0-rc.0, <2.13.3 || >=2.14.0, <2.14.1 · fixed in 1.123.27, 2.13.3, 2.14.1
GHSA-58qr-rcgv-642v · CVE-2026-33660 - CVSS 9.8 CriticalCritical · CVSS 9+
thumbler allows OS Command Injection
- Command injection
- Code injection
<=1.1.2 · no fixed version yet
GHSA-mvhf-547c-h55r · CVE-2026-26833 - CVSS 9.8 CriticalCritical · CVSS 9+
textract is vulnerable to OS Command Injection
- Command injection
- Code injection
<=2.5.0 · no fixed version yet
GHSA-9pcj-m5rr-p28g · CVE-2026-26831 - CVSS 9.1 CriticalCritical · CVSS 9+
WordPress Nelio AB Testing plugin <= 8.2.7 - Remote Code Execution (RCE) vulnerability
- Nelio Software Nelio AB Testing
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability
- jetmonsters JetFormBuilder
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress Total Poll Lite plugin <= 4.12.0 - Remote Code Execution (RCE) vulnerability
- TotalSuite Total Poll Lite
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
WordPress Widget Wrangler plugin <= 2.3.9 - Remote Code Execution (RCE) vulnerability
- Jonathan Daggerhart Widget Wrangler
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerability
- Themeisle Woody ad snippets
- Code injection
- CVSS 8.5 High
WordPress Post Snippets plugin <= 4.0.12 - Remote Code Execution (RCE) vulnerability
- Saad Iqbal Post Snippets
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter
- Command injection
- Code injection
<=2.0.0 · no fixed version yet
GHSA-q5mh-72xg-628w · CVE-2026-26830 - CVSS 6.1 Medium
A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution
- Code injection
- Broken access control
>=0.8.3 · no fixed version yet
GHSA-w5pc-m664-r62v · CVE-2026-33622 - CVSS 6.9 Medium
Unauthenticated arbitrary PHP class instantiation
- Zabbix
- Code injection
- CVSS 8.6 High
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
- Code injection
>=5.6.0, <5.9.13 · fixed in 5.9.13
GHSA-2fph-6v5w-89hh · CVE-2026-33157 - CVSS 6.5 Medium
Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation
- vikunja
- Code injection
- CVSS 6.5 Medium
Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
- vikunja
- Code injection
- Privilege escalation
- CVSS 10.0 CriticalCritical · CVSS 9+
Arbitrary Code Execution via Crafted Bytecode in dendibakh/perf-ninja
- dendibakh perf-ninja
- Code injection
- CVSS 5.1 Medium
projectworlds Lawyer Management System lawyer_booking.php cross site scripting
- projectworlds Lawyer Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
bolo-blog Article Title article cross site scripting
- bolo-blog
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula
- acowebs Woocommerce Custom Product Addons Pro
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Critical Remote Code Execution vulnerability reported in Windchill
- PTC Windchill PDMLink
- PTC FlexPLM
- Code injection
- CVSS 8.8 High
Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin
- Code injection
<1.41.1 || >=2.0.0, <2.41.1 · fixed in 1.41.1, 2.41.1
GHSA-hxqw-6qv7-cqfv · CVE-2026-32276 - CVSS 5.1 Medium
projectworlds Lawyer Management System lawyers.php cross site scripting
- projectworlds Lawyer Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
code-projects Exam Form Submission update_s6.php cross site scripting
- code-projects Exam Form Submission
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint
- Command injection
- Code injection
<=0.0.0-20260107162243-1101ffcb5672 · no fixed version yet
GHSA-fh3m-562m-w4f6 · CVE-2026-24516 - CVSS 4.8 Medium
code-projects Exam Form Submission update_s3.php cross site scripting
- code-projects Exam Form Submission
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
code-projects Exam Form Submission update_s4.php cross site scripting
- code-projects Exam Form Submission
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
code-projects Exam Form Submission update_s5.php cross site scripting
- code-projects Exam Form Submission
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
code-projects Exam Form Submission update_s2.php cross site scripting
- code-projects Exam Form Submission
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.3 High
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Limited Remote Code Execution
- ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema
- Code injection
- CVSS 5.1 Medium
yangzongzhuan RuoYi Quartz Job job code injection
- yangzongzhuan RuoYi
- Other injection
- Code injection
- CVSS 5.3 Medium
code-projects Exam Form Submission update_s1.php cross site scripting
- code-projects Exam Form Submission
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Wavlink WL-WN578W2 POST Request login.cgi cross site scripting
- Wavlink WL-WN578W2
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Foundation Agents MetaGPT operator.py code_generate code injection
- Foundation Agents MetaGPT
- Other injection
- Code injection
- CVSS 5.3 Medium
PbootCMS Parameter MemberController.php alert_location cross site scripting
- PbootCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.5 Medium
Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter
- eoxia Task Manager
- Code injection
- CVSS 5.6 Medium
Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode Execution
- reputeinfosystems Contact Form, Survey, Quiz & Popup Form Builder – ARForms
- Code injection
- CVSS 5.3 Medium
MindSQL is vulnerable to Code Injection through its ask_db function
- Other injection
- Code injection
<=0.2.1 · no fixed version yet
GHSA-m6m4-34cj-4hh7 · CVE-2026-4506 - CVSS 9.8 CriticalCritical · CVSS 9+
Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process
- wpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- Code injection
- CVSS 8.8 High
AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin
- Code injection
<=26.0 · no fixed version yet
GHSA-xggw-g9pm-9qhh · CVE-2026-33479 - CVSS 5.1 Medium
atjiu pybbs CommentApiController.java create cross site scripting
- atjiu pybbs
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
atjiu pybbs TopicApiController.java create cross site scripting
- atjiu pybbs
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.5 Medium
Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)
- louislam uptime-kuma
- File inclusion
- Code injection
- CVSS 4.8 Medium
itsourcecode University Management System admin_single_student_update.php cross site scripting
- itsourcecode University Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SysAK v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd.
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass
- SuiteCRM
- Code injection
- CWE-358
- CVSS 7.2 High
SuiteCRM has Authenticated RCE in Modules
- SuiteCRM
- Code injection
- CVSS 8.8 High
Intake has a Command Injection via shell() Expansion in Parameter Defaults
- Command injection
- Code injection
<=2.0.9 · no fixed version yet
GHSA-37g4-qqqv-7m99 · CVE-2026-33310 - CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Langflow has an Arbitrary File Write (RCE) via v2 API
- Path traversal
- Code injection
>=1.2.0, <1.9.0 · fixed in 1.9.0
GHSA-g2j9-7rj2-gm6c · CVE-2026-33309 - CVSS 9.8 CriticalCritical · CVSS 9+
An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter component
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the test connection function
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
OS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote attackers controlling the ACS endpoint t…
- Code injection
- CVSS 7.5 High
dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver
- Command injection
- Code injection
<3.2.13 · fixed in 3.2.13
GHSA-pxrr-hq57-q35p · CVE-2026-33154