Code injection.

Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

• Code injection

>=0.7.3, <0.31.0 · fixed in 0.31.0

itsourcecode Online Cake Ordering System 404.php cross site scripting

• itsourcecode Online Cake Ordering System
• Cross-site scripting (XSS)
• Code injection

opensource-socialnetwork Cache Settings dynamic.php input code injection

• opensource-socialnetwork
• Other injection
• Code injection

Optimal IdM OptimalCloud Login cross site scripting

• Optimal IdM OptimalCloud
• Cross-site scripting (XSS)
• Code injection

Code injection in Advantech ADAM-3600

• Advantech ADAM-3600
• Code injection

An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and Rule.from_path in thefuck/types.py

• Code injection

H3C Magic NX15 RPC esps write code injection

• H3C Magic NX15
• Other injection
• Code injection

Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout

• cms
• Code injection

Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

• cms
• Code injection

Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection

• cms
• Code injection

Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable

• cms
• Code injection

grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting

• grandnode2
• Cross-site scripting (XSS)
• Code injection

Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting

• Wuxi Wubang Security Software Five-in-One Safety Production Management Information System
• Cross-site scripting (XSS)
• Code injection

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

• WSO2 Enterprise Integrator
• WSO2 API Manager
• Code injection

sqlparse through 0.6.0 PHP Code Injection via output_format='php'

• andialbrecht sqlparse
• Code injection

Camunda Expression Injection via orQueries RCE

• Camunda 7
• Command injection
• Code injection

speaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or code

• speaches
• Code injection

llSourcell Doctor-Dignity chat_module.py _get_lib_module code injection

• llSourcell Doctor-Dignity
• Other injection
• Code injection

Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON

• Apache Software Foundation Apache Johnzon
• Code injection

Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages

• Apache Software Foundation Apache Camel
• Code injection

Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers

• Apache Software Foundation Apache Camel
• Information disclosure
• Code injection

AXA Group NLP.js Condition Expression Pipeline evaluator.js Evaluator.walkFunction code injection

• AXA Group NLP.js
• Other injection
• Code injection

DeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ code injection

• DeepPavlov
• Other injection
• Code injection

WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability

• HivePress
• Code injection

DeepPavlov Config Reference Resolver params.py resolve code injection

• DeepPavlov
• Other injection
• Code injection

SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting

• SourceCodester Inventory System
• Cross-site scripting (XSS)
• Code injection

SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting

• SourceCodester Inventory System
• Cross-site scripting (XSS)
• Code injection

SourceCodester Inventory System Product Management products_handler.php save cross site scripting

• SourceCodester Inventory System
• Cross-site scripting (XSS)
• Code injection

subhajitkhan online-clinic-management-system feedback.php cross site scripting

• subhajitkhan online-clinic-management-system
• Cross-site scripting (XSS)
• Code injection

subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting

• subhajitkhan online-clinic-management-system
• Cross-site scripting (XSS)
• Code injection

Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service

• Koozali SME Server
• Code injection
• Denial of service

LlamaChinese Llama-Chinese Adapter Config chat_gradio_no_merge.py get_class_from_dynamic_module code injection

• LlamaChinese Llama-Chinese
• Other injection
• Code injection

RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection

• RVC-Project Retrieval-based-Voice-Conversion-WebUI
• Other injection
• Code injection

JDBC LogFactory 任意类加载/构造导致潜在 RCE

• openGauss-server openGauss-connector-jdbc
• Code injection

unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code

• unsloth
• Code injection

diem-project diem dmWidget dmBaseLinkTag.php text cross site scripting

• diem
• Cross-site scripting (XSS)
• Code injection

diem-project diem Administrative Console actions.class.php append cross site scripting

• diem
• Cross-site scripting (XSS)
• Code injection

diem-project diem Version Check Service dmAdminCtrl.js html cross site scripting

• diem
• Cross-site scripting (XSS)
• Code injection

Chamilo LMS Ticket TicketManager.php addProject cross site scripting

• Chamilo LMS
• Cross-site scripting (XSS)
• Code injection

WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code injection

• WongKinYiu yolov9
• Other injection
• Code injection

AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting

• AUTOMATIC1111 stable-diffusion-webui
• Cross-site scripting (XSS)
• Code injection

AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection

• AUTOMATIC1111 stable-diffusion-webui
• Other injection
• Code injection

AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting

• AUTOMATIC1111 stable-diffusion-webui
• Cross-site scripting (XSS)
• Code injection

JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval

• Code injection

WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability

• HivePress
• Code injection

hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting

• hrisikeshpal Blood_Bank_Management_System
• Cross-site scripting (XSS)
• Code injection

dext34-morgan Books4Cash search.php cross site scripting

• dext34-morgan Books4Cash
• Cross-site scripting (XSS)
• Code injection

THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection

• THU-MIG yoloe
• Code injection

User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag

• wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
• Code injection

WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint

• rachelos we-mp-rss
• Code injection

TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file

• helge17 tuxguitar
• Code injection

Apache Kylin: JDBC URL Whitelist Verification Bypass

• Apache Software Foundation Apache Kylin
• Code injection

SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter

• sgl-project sglang
• Code injection

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Render…

• properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
• Code injection

WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

• Theme-one The Grid
• Code injection

User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name

• wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
• Code injection

Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta

• rilwis Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated
• Code injection

Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Code injection

Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Code injection

Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback

• wpmudev Broken Link Checker
• Code injection