CVE-2025-6204: Improper Control of Generation of Code

An Improper Control of Generation of Code Code Injection vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code...

Vvveb 代码注入漏洞

Vvveb is a powerful and easy-to-use CMS from Givan Individual Developers for building websites, blogs or e-commerce stores. A code injection vulnerability exists in Vvveb 1.0.5 and earlier versions, which stems from vulnerability to cross-site scripting attacks...

PT-2025-31836 · Unknown · Givanz Vvveb

Name of the Vulnerable Software and Affected Versions: givanz Vvveb version 1.0.5 Description: A critical issue exists in the Save function of the admin/controller/editor/code.php file within the Code Editor component. This manipulation can lead to code injection and may be launched remotely. The...

wx-shop 代码注入漏洞

wx-shop is a WeChat applet simple mall by the individual developer Feng Zhihui 495300897. A code injection vulnerability exists in wx-shop, which stems from a misbehavior in file/user/editUI that results in cross-site scripting...

Portábilis i-Educar 代码注入漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. A code injection vulnerability exists in Portábilis i-Educar version 2.9, which stems from cross-site scripting due to misbehavior of the parameter nmfuncao/abreviatura in the file...

Portábilis i-Educar 代码注入漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. A code injection vulnerability exists in Portábilis i-Educar version 2.9, which originates from cross-site scripting due to the incorrect operation of the parameter...

Portabilis i‑Diário 代码注入漏洞

Portabilis i-Diário is an open source school calendar and teacher interaction management system from Portabilis, Brazil. A code injection vulnerability exists in Portabilis i-Diário version 1.5.0, which stems from cross-site scripting due to the incorrect operation of the parameter Descrição in t...

Portábilis i-Educar 代码注入漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. A code injection vulnerability exists in Portábilis i-Educar version 2.10, which stems from cross-site scripting due to the incorrect operation of the parameter refcodaluno in the fil...

Portábilis i-Educar 代码注入漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. A code injection vulnerability exists in Portábilis i-Educar version 2.9, which stems from cross-site scripting due to the incorrect operation of the parameter matricula in the file...

Exploit for Code Injection in Xwiki

CVE-2025-24893 - XWiki Platform Remote Code Execution A Pytho...

CVE-2025-54586

GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visib...

CVE-2013-10035

A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPageAjax.php, and casesSchedulerGetPlugins.php, by supplying...

Arbitrary Code Injection

Overview github.com/hashicorp/vault/vault is a tool for securely accessing secrets. Affected versions of this package are vulnerable to Arbitrary Code Injection on the host by exploiting write permissions in the root namespace, creating audit files in the plugin directory, and using the plugin...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection on the host by exploiting write permissions in the root namespace, creating audit files in the plugin directory, and using the plugin registration functionality to execute the created files. Notes: - This is onl...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection on the host by exploiting write permissions in the root namespace, creating audit files in the plugin directory, and using the plugin registration functionality to execute the created files. Notes: - This is onl...

CVE-2025-50869

A stored Cross-Site Scripting XSS vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input fields for Query and Answer do not properly sanitize user input. Authenticated users can inject arbitrary JavaScript code...

Arbitrary Code Injection

letta is vulnerable to Arbitrary Code Injection. The vulnerability is due to insufficient enforcement of execution restrictions in the /v1/tools/run endpoint, allowing crafted payloads to bypass protections and execute arbitrary Python code or system commands...

Arbitrary Code Injection

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Arbitrary Code Injection in the CAPTCHA processing code, via the onCaptchaResult function. An attacker could execute arbitrary code in the client browser an...

CVE-2025-50869

A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0 . The root cause is the insufficient sanitization of user input within the Query and Answer input fields. This flaw allows authenticated users to inject and execute arbitrary...

CVE-2025-50869

A stored Cross-Site Scripting XSS vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input fields for Query and Answer do not properly sanitize user input. Authenticated users can inject arbitrary JavaScript code...