CVE-2026-108551 openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

CVE-2026-108551

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

CVE-2026-108551 openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

drow

drow Beschreibung TL;DR drow ist ein Kommandozeilenwerkzeug, das zum Injizieren von Code und zum Haken des Einstiegspunkts von ELF-Programmen nach dem Build verwendet wird. Es nimmt unveränderte ELF-Programme als Eingabe und exportiert eine modifizierte ELF-Datei, die eine benutzergegebene Nutzla...

CVE-2026-104021

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the fastcachesettingscachecookieexclude parameter. This is due to the plugin registering the cachecookieexclude setting via registersetting without a sanitizecallback, whi...

CVE-2026-104021 Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the fastcachesettingscachecookieexclude parameter. This is due to the plugin registering the cachecookieexclude setting via registersetting without a sanitizecallback, whi...

EUVD-2026-96068

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the fastcachesettingscachecookieexclude parameter. This is due to the plugin registering the cachecookieexclude setting via registersetting without a sanitizecallback, whi...

CVE-2026-104021

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to and including 1.7.4 . The flaw exists in the fastcache_settings[cache_cookie_exclude][] parameter because the plugin registers the setting via register_setting() without a sanitize_callback. The bu...

CVE-2026-103071: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3...

PT-2026-109666

Name of the Vulnerable Software and Affected Versions openapi-typescript-codegen versions prior to 0.31.1 Description Code injection occurs when the software processes an OpenAPI document containing unescaped values interpolated into single-quoted string literals. An attacker controlling the...

CVE-2026-104021: Improper Control of Generation of Code

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the fastcachesettingscachecookieexclude parameter. This is due to the plugin registering the cachecookieexclude setting via registersetting without a sanitizecallback, whi...

CVE-2026-108598: Improper Control of Generation of Code

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtim...

CVE-2026-108551: Improper Control of Generation of Code

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

PT-2026-109697

Name of the Vulnerable Software and Affected Versions Thank You Page Customizer for WooCommerce versions prior to 1.2.4 Description Improper Control of Generation of Code allows Code Injection within the VillaTheme Thank You Page Customizer for WooCommerce plugin. Code Injection is a flaw that...

PT-2026-109739

Name of the Vulnerable Software and Affected Versions Floci versions 1.1.0 through 2.1.9 Description A code injection issue exists in the VtlTemplateEngine. Unauthenticated attackers can execute operating system commands within the Floci JVM by creating a REST API with a MOCK integration. This is...

PT-2026-109768

Name of the Vulnerable Software and Affected Versions SiteVault – Backup, Restore, Migration & Cloning versions prior to 1.5.20 Description An unauthenticated remote code execution issue exists, allowing an attacker to perform code injection. This allows the execution of arbitrary code on the...

CVE-2026-108259

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCELGITCOMMITREF, GITHUBBRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in...

Tina: Code injection via unescaped Git branch name in generated client source

Summary @tinacms/cli inserts the raw Git branch value into the generated client.ts source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module...

GHSA-PWHX-CVV3-QJ5C Tina: Code injection via unescaped Git branch name in generated client source

Summary @tinacms/cli inserts the raw Git branch value into the generated client.ts source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module...

EUVD-2026-95987

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCELGITCOMMITREF, GITHUBBRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in...