Advisories · Weakness
Code injection.
Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
itsourcecode Airline Reservation System book_flight.php cross site scripting
- itsourcecode Airline Reservation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
subhajitkhan online-clinic-management-system patientregistration.php cross site scripting
- subhajitkhan online-clinic-management-system
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting
- Bdtask Garage 24 Garage Management Software
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic.
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7.
- Code injection
- Unrestricted file upload
- CVSS 5.3 Medium
AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection
- AllenAI AllenNLP
- Other injection
- Code injection
- CVSS 6.9 Medium
DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection
- DedeCMS
- Other injection
- Code injection
- CVSS 5.4 Medium
Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
- Apache Software Foundation Apache Camel
- Code injection
- CVSS 5.1 Medium
ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting
- ffxiv-teamcraft FFXIV Teamcraft
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Edimax BR-6208AC Virtual Server cross site scripting
- Edimax BR-6208AC
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Sony Neural Network Libraries NNP Converter utils.py func_set_nnabla_version_decorate code injection
- Sony Neural Network Libraries
- Other injection
- Code injection
- CVSS 5.3 Medium
Sony Neural Network Libraries Encode Param encode_decode_param.py load_param_in_txt code injection
- Sony Neural Network Libraries
- Other injection
- Code injection
- CVSS 4.8 Medium
gougucms User Level Level.php add cross site scripting
- gougucms
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.8 High
An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver installer DLL-loading logic
- Code injection
- CVSS 5.3 Medium
CloudClassroom-PHP-Project addnewstudent.php cross site scripting
- CloudClassroom-PHP-Project
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
DedeCMS update_guide.php require_once code injection
- DedeCMS
- Other injection
- Code injection
- CVSS 5.3 Medium
Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection
- Alfresco Activiti
- Other injection
- Code injection
- CVSS 5.3 Medium
Privoce Vocechat Query Parameter widget.html cross site scripting
- Privoce Vocechat
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
onyx-dot-app Onyx PreviewTab.tsx cross site scripting
- Onyx
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting
- phpIPAM
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
phpIPAM index.php cross site scripting
- phpIPAM
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.9 Medium
Travisun Opptrix Import Endpoint import code injection
- Travisun Opptrix
- Other injection
- Code injection
- CVSS 7.2 High
GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
- GeoDirectory
- Code injection
- CVSS 7.1 High
virtualenv: Xonsh activation literals depend on the script decoding codec
- Code injection
<21.14.9 · fixed in 21.14.9
GHSA-394h-qwmc-48pf · CVE-2026-113718 - CVSS 6.5 Medium
MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- Code injection
- Server-side request forgery (SSRF)
>=3.12.0rc0, <3.17.0 · fixed in 3.17.0
GHSA-2wqp-q3c6-ccj5 · CVE-2026-115886 - CVSS 8.8 High
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
- Code injection
>=17.0.0, <21.0.4 · fixed in 21.0.4
GHSA-834v-8h66-3h79 · CVE-2026-115895 - CVSS 9.9 CriticalCritical · CVSS 9+
Arbitrary file read and backend crash through unrestricted provider method calls
- GitroomHQ postiz-app
- Path traversal
- Code injection
- CVSS 8.7 High
Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
- cms
- Code injection
- CVSS 6.5 Medium
Laravel relationship inclusion can trigger unauthorized data destruction
- Code injection
>=12.45.0, <12.68.0 || >=13.0.0, <13.27.0 · fixed in 12.68.0, 13.27.0
GHSA-5wcm-3v2w-8362 · CVE-2026-114508 - CVSS 8.7 High
Control panel only API response emulation replaces "securityKey" and reaches server RCE
- cms
- Code injection
- CVSS 7.5 High
@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function
- Command injection
- Code injection
<=1.0.1 · no fixed version yet
GHSA-jwc4-922r-f2rw · CVE-2026-106764 - CVSS 9.9 CriticalCritical · CVSS 9+
Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN
- conda infrastructure
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS
- intranda goobi-viewer-core
- Cross-site scripting (XSS)
- Other injection
- CVSS 4.8 Medium
hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import
- hydra-ecosystem hydra-ray-launcher
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Remote Code Execution in CGM CLININET
- CGM CLININET
- Code injection
- CVSS 8.6 High
Code Injection in CGM CLININET
- CGM CLININET
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action
- Advanced Custom Fields: Extended
- Advanced Custom Fields: Extended PRO
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Command Execution via Admin Console Input in Okta Access Gateway
- Okta Access Gateway
- Code injection
- CWE-20
- CVSS 5.3 Medium
gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting
- gedelumbung HospitalManagement
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting
- gedelumbung HospitalManagement
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.3 High
An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF
- Code injection
- CVSS 5.3 Medium
gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting
- gedelumbung HospitalManagement
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option
- lepture mistune
- Code injection
- CVSS 8.1 High
Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Code injection
- Authentication bypass
- CVSS 8.8 High
Unauthenticated Adjacent Remote Code Execution Vulnerability in AOS-10
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Code injection
- CVSS 8.7 High
Storybook dev server vulnerable to code injection from the local network
- Path traversal
- Code injection
>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6 · fixed in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6
GHSA-px85-f4q5-jh77 · CVE-2026-114126 - CVSS 5.1 Medium
subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting
- subhajitkhan online-clinic-management-system
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php
- DedeCMS
- Code injection
- CVSS 7.6 High
WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability
- WProyal Royal Elementor Addons
- Code injection
- CVSS 4.8 Medium
WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Email
- WP Ultimate Review
- Code injection
- CVSS 7.0 High
Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives
- grav
- Code injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
- Drupal Webform
- Code injection
- CVSS 3.5 Low
AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187
- Drupal AI CKEditor
- Code injection
- CVSS 7.2 High
Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise
- Splunk Enterprise
- Code injection
- CVSS 4.7 Medium
Vitest: Code injection via unauthenticated manual mock registration
- Code injection
- Authentication bypass
>=2.1.0-beta.7, <4.1.12 || >=5.0.0-beta.1, <5.0.3 · fixed in 4.1.12, 5.0.3
GHSA-qxg6-89mg-rqv8 · CVE-2026-112949 - CVSS 8.6 High
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
- Path traversal
- Code injection
>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6 · fixed in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6
GHSA-f2ph-cmg5-wxc8 · CVE-2026-114125 - CVSS 8.8 High
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability
- MindsDB
- Code injection
- CVSS 8.8 High
CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability
- CrewAI
- Code injection
- CVSS 7.8 High
virtualenv activation scripts run code from a path that contains a placeholder name
- Command injection
- Code injection
>=20.26.6, <21.14.2 · fixed in 21.14.2
GHSA-8rjx-v5ww-45pp · CVE-2026-113776 - CVSS 7.8 High
Cisco Expressway Series Software Hardening Release: October 2026 - Code Injection Vulnerabilities
- Cisco TelePresence Video Communication Server (VCS) Expressway
- Code injection