CWE-94 · Code Injection (page 9)
Page 9 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-5644 | Low | 2.4 | 2026-04-06 | A security flaw has been discovered in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. Affected is an unknown function of t… |
CVE-2026-5643 | Low | 2.4 | 2026-04-06 | A vulnerability was identified in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This impacts an unknown function of the f… |
CVE-2026-5631 | High | 7.3 | 2026-04-06 | A vulnerability has been found in assafelovic gpt-researcher up to 3.4.3. This affects the function extract_command_data of the file backend/server/server_util… |
CVE-2026-5630 | Medium | 4.3 | 2026-04-06 | A flaw has been found in assafelovic gpt-researcher up to 3.4.3. The impacted element is an unknown function of the file backend/server/app.py of the component… |
CVE-2026-5625 | Medium | 4.3 | 2026-04-06 | A weakness has been identified in assafelovic gpt-researcher up to 3.4.3. This issue affects some unknown processing of the file gpt_researcher/skills/research… |
CVE-2026-5615 | Medium | 4.3 | 2026-04-06 | A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload E… |
CVE-2026-5594 | Medium | 6.3 | 2026-04-05 | A weakness has been identified in premAI-io premsql up to 0.2.1. Affected is the function eval of the file premsql/agents/baseline/workers/followup.py. This ma… |
CVE-2026-5584 | High | 7.3 | 2026-04-05 | A vulnerability has been found in Fosowl agenticSeek 0.1.0. Impacted is the function PyInterpreter.execute of the file sources/tools/PyInterpreter.py of the co… |
CVE-2026-5568 | Low | 3.5 | 2026-04-05 | A vulnerability has been found in Akaunting up to 3.1.21. This issue affects some unknown processing of the component Invoice/Billing. The manipulation of the… |
CVE-2026-5562 | High | 7.3 | 2026-04-05 | A vulnerability was identified in provectus kafka-ui up to 0.7.2. This impacts the function validateAccess of the file /api/smartfilters/testexecutions of the… |
CVE-2026-5556 | Medium | 6.3 | 2026-04-05 | A security vulnerability has been detected in badlogic pi-mono up to 0.58.4. This vulnerability affects the function discoverAndLoadExtensions of the file pack… |
CVE-2026-5542 | Medium | 4.3 | 2026-04-05 | A vulnerability was determined in code-projects Simple Laundry System 1.0. Impacted is an unknown function of the file /modstaffinfo.php of the component Param… |
CVE-2026-5541 | Medium | 4.3 | 2026-04-05 | A vulnerability was found in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /modmemberinfo.php of the componen… |
CVE-2026-5539 | Medium | 4.3 | 2026-04-05 | A flaw has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /modifymember.php of the component Parameter Handler… |
CVE-2026-5533 | Medium | 4.3 | 2026-04-05 | A vulnerability was determined in badlogic pi-mono 0.58.4. The impacted element is an unknown function of the file packages/web-ui/src/tools/artifacts/SvgArtif… |
CVE-2026-3309 | Medium | 6.5 | 2026-04-04 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2026-28797 | High | 8.8 | 2026-04-03 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exis… |
CVE-2026-5468 | Low | 3.5 | 2026-04-03 | A security flaw has been discovered in Casdoor 2.356.0. This affects the function dangerouslySetInnerHTML. Performing a manipulation of the argument formCss/fo… |
CVE-2026-5370 | Low | 3.5 | 2026-04-02 | A vulnerability was identified in krayin laravel-crm up to 2.2. Impacted is the function composeMail of the file packages/Webkul/Admin/tests/e2e-pw/tests/mail/… |
CVE-2026-34725 | High | 8.2 | 2026-04-02 | DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled… |
CVE-2026-5332 | Low | 3.5 | 2026-04-02 | A vulnerability was identified in Xiaopi Panel 1.0.0. This vulnerability affects unknown code of the file /demo.php of the component WAF Firewall. The manipula… |
CVE-2026-2701 | Critical | 9.1 | 2026-04-02 | Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution. |
CVE-2026-5325 | Low | 3.5 | 2026-04-02 | A vulnerability was determined in SourceCodester Simple Customer Relationship Management System 1.0. This issue affects some unknown processing of the file /cr… |
CVE-2026-1540 | High | 7.2 | 2026-04-02 | The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows logging to a PHP file, which could allow an attacker with editor access to achieve Re… |
CVE-2026-5319 | Medium | 4.3 | 2026-04-02 | A security vulnerability has been detected in itsourcecode Payroll Management System up to 1.0. Affected is an unknown function of the file /navbar.php. Such m… |
CVE-2026-30643 | Critical | 9.8 | 2026-04-01 | An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload. |
CVE-2024-40489 | Critical | 9.8 | 2026-04-01 | There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on c… |
CVE-2026-35093 | High | 8.8 | 2026-04-01 | A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypa… |
CVE-2026-29014 | Critical | 9.8 | 2026-04-01 | MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by se… |
CVE-2026-5255 | Medium | 4.3 | 2026-04-01 | A vulnerability was detected in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /delstaffinfo.php of the component Parameter… |
CVE-2026-5254 | Low | 3.5 | 2026-04-01 | A security vulnerability has been detected in welovemedia FFmate up to 2.0.15. Affected by this issue is some unknown functionality of the file /ui/app/compone… |
CVE-2026-5253 | Low | 3.5 | 2026-04-01 | A weakness has been identified in bufanyun HotGo 1.0/2.0. Affected by this vulnerability is an unknown functionality of the file /web/src/layout/components/Hea… |
CVE-2026-5252 | Low | 3.5 | 2026-04-01 | A security flaw has been discovered in z-9527 admin 1.0/2.0. Affected is an unknown function of the file /server/routes/message.js of the component Message Cre… |
CVE-2026-5249 | Low | 3.5 | 2026-04-01 | A vulnerability was found in gougucms 4.08.18. This impacts an unknown function of the file \gougucms-master\app\admin\view\user\record.html of the component R… |
CVE-2026-35056 | High | 7.2 | 2026-04-01 | XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users. An attacker with admin panel access can… |
CVE-2025-71281 | High | 8.8 | 2026-04-01 | XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match fo… |
CVE-2026-5240 | Medium | 4.3 | 2026-04-01 | A security vulnerability has been detected in code-projects BloodBank Managing System 1.0. This affects an unknown part of the file /admin_state.php. The manip… |
CVE-2026-34585 | High | 8.6 | 2026-03-31 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute… |
CVE-2026-34448 | Critical | 9.0 | 2026-03-31 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigge… |
CVE-2026-4800 | High | 8.1 | 2026-03-31 | Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not appl… |
CVE-2026-5209 | Low | 2.4 | 2026-03-31 | A security vulnerability has been detected in SourceCodester Leave Application System 1.0. Affected by this issue is some unknown functionality of the componen… |
CVE-2026-34202 | High | 7.5 | 2026-03-31 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing… |
CVE-2026-34060 | Critical | 9.8 | 2026-03-31 | Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branc… |
CVE-2026-3300 | Critical | 9.8 | 2026-03-31 | The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is… |
CVE-2026-5157 | Medium | 4.3 | 2026-03-31 | A vulnerability was identified in code-projects Online Food Ordering System 1.0. Affected is an unknown function of the file /form/order.php of the component O… |
CVE-2026-4257 | Critical | 9.8 | 2026-03-30 | The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all version… |
CVE-2026-30313 | Critical | 9.8 | 2026-03-30 | DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineff… |
CVE-2026-30308 | Critical | 9.8 | 2026-03-30 | In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands. The descri… |
CVE-2026-30306 | Critical | 9.8 | 2026-03-30 | In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute all commands. The description for the for… |
CVE-2026-30307 | Critical | 9.8 | 2026-03-30 | Roo Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffec… |
CVE-2026-30305 | Critical | 9.8 | 2026-03-30 | Syntx's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffectiv… |
CVE-2026-28505 | Critical | 10.0 | 2026-03-30 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notification_handler.py impl… |
CVE-2026-2287 | Critical | 9.8 | 2026-03-30 | CrewAI does not properly check that Docker is still running during runtime, and will fall back to a sandbox setting that allows for RCE exploitation. |
CVE-2026-5106 | Low | 2.4 | 2026-03-30 | A flaw has been found in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_fst.php. Executing a man… |
CVE-2026-5015 | Medium | 4.3 | 2026-03-28 | A vulnerability was determined in elecV2 elecV2P up to 3.8.3. The impacted element is an unknown function of the file /logs of the component Endpoint. This man… |
CVE-2026-5011 | Medium | 6.3 | 2026-03-28 | A vulnerability was detected in elecV2 elecV2P up to 3.8.3. This vulnerability affects the function runJSFile of the file /webhook of the component JSON Parser… |
CVE-2026-4998 | High | 7.3 | 2026-03-28 | A weakness has been identified in Sinaptik AI PandasAI up to 3.0.0. This vulnerability affects the function CodeExecutor.execute of the file pandasai/core/code… |
CVE-2026-4995 | Low | 3.5 | 2026-03-28 | A vulnerability was determined in wandb OpenUI up to 1.0. Affected by this vulnerability is an unknown functionality of the file frontend/public/annotator/inde… |
CVE-2026-4992 | Medium | 4.3 | 2026-03-27 | A flaw has been found in wandb OpenUI up to 1.0. This affects the function create_share/get_share of the file backend/openui/server.py of the component HTMLAnn… |
CVE-2026-4991 | Low | 3.5 | 2026-03-27 | A vulnerability was detected in QDOCS Smart School Management System up to 7.2. The impacted element is an unknown function of the file /admin/enquiry of the c… |
CVE-2026-33976 | Critical | 9.6 | 2026-03-27 | Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalat… |
CVE-2026-33955 | High | 8.6 | 2026-03-27 | Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can e… |
CVE-2026-33943 | High | 8.8 | 2026-03-27 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerabil… |
CVE-2026-33941 | High | 8.2 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars… |
CVE-2026-33940 | High | 8.1 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context… |
CVE-2026-33938 | High | 8.1 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored… |
CVE-2026-33937 | Critical | 9.8 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST… |
CVE-2026-33881 | High | 7.2 | 2026-03-27 | Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolat… |
CVE-2026-33873 | Critical | 9.9 | 2026-03-27 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-g… |
CVE-2026-4973 | Low | 3.5 | 2026-03-27 | A vulnerability was detected in SourceCodester Online Quiz System up to 1.0. Affected by this vulnerability is an unknown functionality of the file endpoint/ad… |
CVE-2026-4972 | Low | 2.4 | 2026-03-27 | A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /system/system/studen… |
CVE-2026-33654 | Critical | 9.8 | 2026-03-27 | nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerability exists in the email channel processing module (`nanobot/… |
CVE-2026-4969 | Low | 3.5 | 2026-03-27 | A vulnerability was identified in code-projects Social Networking Site 1.0. The impacted element is an unknown function of the file /home.php of the component… |
CVE-2026-4965 | High | 7.3 | 2026-03-27 | A vulnerability was detected in letta-ai letta 0.16.4. This issue affects the function resolve_type of the file letta/functions/ast_parsers.py of the component… |
CVE-2026-4963 | Medium | 6.3 | 2026-03-27 | A weakness has been identified in huggingface smolagents 1.25.0.dev0. This affects the function evaluate_augassign/evaluate_call/evaluate_with of the file src/… |
CVE-2025-15616 | Medium | 6.7 | 2026-03-27 | Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers… |
CVE-2026-27876 | Critical | 9.1 | 2026-03-27 | A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature i… |
CVE-2026-32669 | Critical | 9.8 | 2026-03-27 | Code injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary code may be executed on the products. |
CVE-2026-4909 | Low | 2.4 | 2026-03-27 | A weakness has been identified in code-projects Exam Form Submission 1.0. This impacts an unknown function of the file /admin/update_s7.php. This manipulation… |
CVE-2026-33744 | High | 7.8 | 2026-03-27 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field… |
CVE-2026-4899 | Low | 2.4 | 2026-03-26 | A security flaw has been discovered in code-projects Online Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /dbfood/… |
CVE-2026-4898 | Medium | 4.3 | 2026-03-26 | A vulnerability was identified in code-projects Online Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /dbfood… |
CVE-2026-33622 | High | 8.8 | 2026-03-26 | PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.8.3` through `v0.8.5` allow arbitrary JavaScript e… |
CVE-2026-30457 | Critical | 9.8 | 2026-03-26 | An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code. |
CVE-2026-4877 | Medium | 4.3 | 2026-03-26 | A security flaw has been discovered in itsourcecode Payroll Management System up to 1.0. This affects an unknown function of the file /index.php. Performing a… |
CVE-2026-4849 | Medium | 4.3 | 2026-03-26 | A vulnerability was identified in code-projects Simple Laundry System 1.0. This impacts an unknown function of the file /modify.php of the component Parameter… |
CVE-2026-4848 | Medium | 4.3 | 2026-03-26 | A vulnerability was determined in dameng100 muucmf 1.9.5.20260309. This affects an unknown function of the file /admin/extend/list.html. Executing a manipulati… |
CVE-2026-4847 | Medium | 4.3 | 2026-03-26 | A vulnerability was found in dameng100 muucmf 1.9.5.20260309. The impacted element is an unknown function of the file /admin/config/list.html. Performing a man… |
CVE-2026-4846 | Medium | 4.3 | 2026-03-26 | A vulnerability has been found in dameng100 muucmf 1.9.5.20260309. The affected element is an unknown function of the file channel/admin.Account/autoReply.html… |
CVE-2026-4845 | Medium | 4.3 | 2026-03-26 | A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is an unknown function of the file /admin/Member/index.html. This manipulation of the argume… |
CVE-2026-4835 | Low | 3.5 | 2026-03-26 | A security vulnerability has been detected in code-projects Accounting System 1.0. Impacted is an unknown function of the file /my_account/add_costumer.php of… |
CVE-2026-33660 | High | 8.8 | 2026-03-25 | n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user with permission to create or modify w… |
CVE-2026-32573 | Critical | 9.1 | 2026-03-25 | Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue af… |
CVE-2026-32525 | Critical | 9.9 | 2026-03-25 | Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Code Injection.This issue affects J… |
CVE-2026-27044 | Critical | 9.9 | 2026-03-25 | Improper Control of Generation of Code ('Code Injection') vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Remote Code Inclusion.This issue af… |
CVE-2026-25447 | Critical | 9.1 | 2026-03-25 | Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue… |
CVE-2026-25366 | Critical | 9.9 | 2026-03-25 | Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Wood… |
CVE-2026-25001 | High | 8.5 | 2026-03-25 | Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.This issue affec… |
CVE-2026-26833 | Critical | 9.8 | 2026-03-25 | thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user input is concatenate… |
CVE-2026-26831 | Critical | 9.8 | 2026-03-25 | textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames… |