CVE-2025-8417 Catalog Importer, Scraper & Crawler <= 5.1.4 - Unauthenticated PHP Code Injection

The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token e.g. ?key= 900001705 without proper authentication, combined with the unsafe use of eval on...

Project AIRI 代码注入漏洞

Project AIRI is an AI dialog bot open-sourced by moeru-ai. Project AIRI version 0.7.2-beta.2 suffers from a code injection vulnerability that stems from the MarkdownRenderer.vue component directly using v-html to render unescaped HTML content, which could lead to cross-site scripting attacks, as...

WordPress plugin Catalog Importer Scraper Crawler 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability exists in...

erjinzhi 10OA 代码注入漏洞

erjinzhi 10OA is an enterprise automation system from China Binary erjinzhi. A code injection vulnerability exists in erjinzhi 10OA version 1.0, which stems from an incorrect manipulation of the parameter Name in the file /trial/mvc/finder, and could lead to a cross-site scripting attack...

PHP-Code-For-Unlimited-File-Upload 代码注入漏洞

PHP-Code-For-Unlimited-File-Upload is a software used for multiple file transfers by the individual developer Lokesh Kumar. A code injection vulnerability exists in PHP-Code-For-Unlimited-File-Upload, which stems from the incorrect manipulation of the parameter h in the file /f.php, which could...

CVE-2025-8417: Improper Control of Generation of Code

The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token e.g. ?key= 900001705 without proper authentication, combined with the unsafe use of eval on...

erjinzhi 10OA 代码注入漏洞

erjinzhi 10OA is an enterprise automation system from China Binary erjinzhi. A code injection vulnerability exists in erjinzhi 10OA version 1.0, which stems from an incorrect operation of the parameter Name in the file /trial/mvc/catalogue, and could lead to a cross-site scripting attack...

Scada-LTS 代码注入漏洞

Scada-LTS is an open source, web-based, multi-platform solution from Scada-LTS Open Source. A code injection vulnerability exists in Scada-LTS version 2.7.8.1 and earlier, which stems from an incorrect manipulation of the parameter Colour in the file /reports.shtm, and could lead to a cross-site...

Scada-LTS 代码注入漏洞

Scada-LTS is an open source, web-based, multi-platform solution from Scada-LTS Open Source. A code injection vulnerability exists in Scada-LTS version 2.7.8.1 and earlier, which stems from misuse of the parameter Text Renderer properties in the file /datapointedit.shtm, and could lead to a...

CVE-2025-10097

A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remotely...

Arbitrary Code Injection

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Arbitrary Code Injection via th...

Exploit for Code Injection in Xwiki

xwiki-15.10.8-revers...

Claude Code 代码注入漏洞

Claude Code is an open source proxy coding tool from Anthropic. A code injection vulnerability exists in versions of Claude Code prior to 1.0.105 that stems from a command parsing error that could lead to the execution of untrusted commands...

Claude Code 代码注入漏洞

Claude Code is an open source proxy coding tool from Anthropic. A code injection vulnerability exists in Claude Code versions prior to 1.0.105, which originates from a malicious user mailbox in the git configuration could lead to arbitrary code execution...

Linux Distros Unpatched Vulnerability : CVE-2021-32644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are vulnerable to code...

Linux Distros Unpatched Vulnerability : CVE-2022-0819

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1. CVE-2022-0819 Note that Nessus relies on the presence of the package as reported by the...

Arbitrary Code Injection

Overview pyinstaller is a package that bundles a Python application and all its dependencies into a single package Affected versions of this package are vulnerable to Arbitrary Code Injection in the bootstrap process. An attacker can achieve arbitrary code execution by placing malicious files or...

CVE-2025-58997

Cross-Site Request Forgery CSRF vulnerability in Frenify Mow mow allows Code Injection.This issue affects Mow: from n/a through = 4.10...

CVE-2025-58997 WordPress Mow Theme <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Frenify Mow allows Code Injection. This issue affects Mow: from n/a through 4.10...

CVE-2025-58997

CVE-2025-58997 is a CSRF vulnerability in the WordPress Mow theme (versions up to and including 4.10) that enables code injection. Public sources in the connected docs confirm affected software (Mow theme) and root cause: Cross-Site Request Forgery enabling unauthorized code execution. Exploitati...