CVE-2025-27429 Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)

SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating...

Duplicate Advisory: Langflow Vulnerable to Code Injection via the `/api/v1/validate/code` endpoint

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rvqx-wpfh-mfx7. This link is maintained to preserve external references. Original Description Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote an...

PYSEC-2025-36

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code...

oa_system 代码注入漏洞

oasystem is a hailey individual developer's application for the day-to-day operation and management of an organization, used by employees and managers. A code injection vulnerability exists in oasystem version 2025.01.01 and earlier, which stems from the fact that incorrect manipulation of the...

CodeCanyon Perfex CRM 代码注入漏洞

CodeCanyon Perfex CRM is a self-hosted customer relationship management software from CodeCanyon. A code injection vulnerability exists in CodeCanyon Perfex CRM version 3.2.1, which stems from the fact that incorrect manipulation of the parameter description can lead to cross-site scripting...

CVE-2025-30580

Improper Control of Generation of Code 'Code Injection' vulnerability in kellydiek DigiWidgets Image Editor digiwidgets-image-editor allows Remote Code Inclusion.This issue affects DigiWidgets Image Editor: from n/a through = 1.10...

InternLM LMDeploy code injection vulnerability

A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has...

CVE-2025-3163 InternLM LMDeploy conf.py open code injection

A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has...

BIT-DOLIBARR-2022-0819 Code Injection in dolibarr/dolibarr

Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1...

ThinkOX 代码注入漏洞

ThinkOX is a lightweight social platform developed by individual developer Cai Peichao caipeichao. A code injection vulnerability exists in ThinkOX version 1.0, which stems from a cross-site scripting attack caused by incorrect operation of the parameter keywords...

PT-2025-14068 · Unknown · Romethemekit For Elementor

Name of the Vulnerable Software and Affected Versions: RomethemeKit For Elementor versions n/a through 1.5.4 Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability, which allows Command Injection. This problem affects over 30,000 active sites...

PT-2025-14390 · Digiwidgets · Digiwidgets Image Editor

Name of the Vulnerable Software and Affected Versions: DigiWidgets Image Editor versions 1.10 and earlier Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability, which allows Remote Code Inclusion. This means that an attacker could potentiall...

GHSA-29M8-WH9P-5WC4 Apache Kylin Code Injection via JDBC Configuration Alteration

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system an...

CVE-2025-30067

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Kylin. If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system an...

CVE-2025-28893

Improper Control of Generation of Code 'Code Injection' vulnerability in Govind Visual Text Editor visual-text-editor allows Remote Code Inclusion.This issue affects Visual Text Editor: from n/a through = 1.2.1...

CVE-2025-28893 WordPress Visual Text Editor plugin <= 1.2.1 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Govind Visual Text Editor visual-text-editor allows Remote Code Inclusion.This issue affects Visual Text Editor: from n/a through = 1.2.1...

CVE-2024-10208

CVE-2024-10208 is a Cross Site Scripting vulnerability in the APROL Web Portal of B&R APROL versions before 4.4-00P5. The issue stems from improper input-neutralization during web page generation, allowing an authenticated network-based attacker to insert malicious code that executes in the conte...

PHPGurukul Medical Card Generation System 代码注入漏洞

PHPGurukul Medical Card Generation System is a medical card generation system from PHPGurukul Inc. A code injection vulnerability exists in version 1.0 of the PHPGurukul Medical Card Generation System, which stems from an incorrect manipulation of the parameter searchdata that could lead to a...

Code-Projects Human Resource Management System 代码注入漏洞

Code-Projects Human Resource Management System is an open source human resource management system from Code-Projects. A code injection vulnerability exists in Code-Projects Human Resource Management System version 1.0.1, which stems from a code injection vulnerability in the handler A cross-site...

GHSA-JCCX-M9V4-9HWH LoLLMS Code Injection vulnerability

A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's eval function to evaluate mathematical expressions within a Python sandbox that disables builtins and only allows functions from the math module...