Code injection.

Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers

• ays-pro Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
• Code injection

Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection

• Ultralytics FastSAM
• Code injection

ImprintLab Medical-SAM-Adapter AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection

• ImprintLab Medical-SAM-Adapter
• Code injection

An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.

• Code injection

Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway p…

• Red Hat Connectivity Link 1.4
• Red Hat Connectivity Link 1.5
• Code injection

Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates

• msgbyte tianji
• Code injection

CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)

• OpenPrinting cups
• Other injection
• Code injection

Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

• Red Hat Ansible Automation Platform 2.6
• Red Hat Ansible Automation Platform 2.7
• Code injection

Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint

• Sonatype Nexus Repository 3
• Code injection

Template injection in WebPros SolusVM 2

• WebPros SolusVM 2
• Code injection

WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability

• WPMU DEV Broken Link Checker
• Code injection

Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template

• oceanwp Ocean Extra
• Code injection

AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.

• Code injection

WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection

• LabRedesCefetRJ WeGIA
• Command injection
• SQL injection

Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`

• shd101wyy vscode-markdown-preview-enhanced
• Code injection

Stirling-PDF: Remote Code Execution via H2

• Stirling-Tools Stirling-PDF
• Code injection

WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability

• PluginUs.Net MDTF
• Code injection

WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability

• VillaTheme Salevo
• Code injection

PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks PAN-OS
• Code injection

HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking

• hestiacp
• Command injection
• Code injection

A remote code execution vulnerability exists within the Field UI module in Drupal core.

• Code injection

>=8.9.0, <10.6.19 || >=11.0.0, <11.3.19 || >=11.4.0, <11.4.10 || >=12.0.0-alpha1, <12.0.0-beta2 · fixed in 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2

Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS

• dokku
• Code injection

Gitea reusable workflow secret exposure in pull_request_target

• Gitea
• Code injection
• CWE-829

BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail

• MicroPyramid BottleCRM
• Code injection

WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability

• VillaTheme Email Template Customizer for WooCommerce
• Code injection

Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive

• affiliate-toolkit
• Code injection

TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection

• TEAMPLUS TECHNOLOGY TeamPlus Messenger
• Code injection

TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection

• TEAMPLUS TECHNOLOGY TeamPlus Messenger
• Code injection

Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder

• Click to Chat – HoliThemes
• Code injection

Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability

• Code injection

>=10.0.0, <10.0.14 || >=11.0.0-preview.1, <11.0.0-rc.3.26522.148 · fixed in 10.0.14, 11.0.0-rc.3.26522.148

ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

• Adobe ColdFusion 2025
• Adobe ColdFusion 2023
• Code injection

ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

• Adobe ColdFusion 2025
• Adobe ColdFusion 2023
• Code injection

ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)

• Adobe ColdFusion 2025
• Adobe ColdFusion 2023
• Code injection

Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php

• Omnispace Agora Project
• Code injection

Windows Assigned Access Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• Code injection

Windows Performance Monitor Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Code injection

Windows Encrypting File System (EFS) Remote Code Execution Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Code injection

Microsoft Office SharePoint Elevation of Privilege Vulnerability

• Microsoft SharePoint Server Subscription Edition
• Code injection

Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability

• Microsoft Visual Studio 2022 version 17.14
• Microsoft Visual Studio 2026 version 18.10
• Code injection

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

• Adobe Commerce
• Adobe Commerce B2B
• Code injection

dataclasses-avroschema enum symbols can inject statements through generated member names

• marcosschroh dataclasses-avroschema
• Code injection

dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string

• marcosschroh dataclasses-avroschema
• Code injection

dataclasses-avroschema enum field defaults can inject statements into generated modules

• marcosschroh dataclasses-avroschema
• Code injection

dataclasses-avroschema allows code injection through generated enum-symbol string literals

• marcosschroh dataclasses-avroschema
• Code injection

dataclasses-avroschema pydantic-class metadata allows code injection in generated annotations

• marcosschroh dataclasses-avroschema
• Code injection

dataclasses-avroschema field documentation allows code injection in generated Pydantic descriptions

• marcosschroh dataclasses-avroschema
• Code injection

dataclasses-avroschema fixed namespaces allow code injection in generated annotations

• marcosschroh dataclasses-avroschema
• Code injection

dataclasses-avroschema record documentation can terminate generated class docstrings

• marcosschroh dataclasses-avroschema
• Code injection

dataclasses-avroschema allows code injection through generated Meta.schema_name

• marcosschroh dataclasses-avroschema
• Code injection

dataclasses-avroschema allows code injection through record names in generated default factories

• marcosschroh dataclasses-avroschema
• Code injection

dataclasses-avroschema allows code injection through generated field-default literals

• marcosschroh dataclasses-avroschema
• Code injection

JumpServer: Ansible Automation Template Rendering Allows Unsafe Lookup Plugin Invocation

• jumpserver
• Code injection

FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater

• fearlessgeekmedia FearlessCMS
• Code injection

Fixed values in MongoDB Server $bucket stage may be misread as field references

• MongoDB Server
• Code injection

Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets

• saltyorg docs
• Code injection
• CWE-829

heym Python Tool Sandbox Escape

• heym
• Command injection
• Code injection

Eval injection in NVIDIA Isaac Lab

• NVIDIA Isaac Lab
• Code injection

Eval injection in Siemens SIMATIC Drive Controller CPU 1504D TF and others

• Siemens SIMATIC Drive Controller CPU 1504D TF
• Siemens SIMATIC Drive Controller CPU 1507D TF
• Code injection

storyicon comfyui_segment_anything GroundingDINO Model Loading slconfig.py SLConfig._file2dict code injection

• storyicon comfyui_segment_anything
• Other injection
• Code injection

PaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.__init__ code injection

• PaddlePaddle PaddleX
• Other injection
• Code injection