CVE-2025-51472

Code Injection in AgentTemplate.evalagentconfig in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious values in agent template configurations such as the goal, constraints, or instruction field, which are evaluated using eval without validati...

Mozilla多款产品 代码注入漏洞

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. A code execution vulnerability exists in multiple Mozilla products, whic...

Letta-ai letta 代码注入漏洞

Letta-ai letta is a stateful agent framework with memory, inference, and context management from the Letta-ai open source. A security vulnerability exists in Letta-ai letta version 0.7.12, which originates in the /v1/tools/run endpoint and allows the execution of arbitrary Python code and system...

GO-2025-3802 Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm

Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm...

CVE-2025-24937

File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading to a full compromise of the web application and the container it is running on. The vulnerable component is bound to the network stack and the set of possible...

CVE-2025-24937 Access to local file system and its content

File contents could be read from the local file system by an attacker. Additionally, malicious code could be inserted in the file, leading to a full compromise of the web application and the container it is running on. The vulnerable component is bound to the network stack and the set of possible...

Microsoft SharePoint Remote Code Execution Vulnerability

SharePoint Server is a locally deployed enterprise collaboration platform from Microsoft that supports content sharing, knowledge management, and application integration, and works seamlessly with Microsoft 365 subscriptions to access the latest features. A remote code execution vulnerability...

Trellix Endpoint Security 代码注入漏洞

Trellix Endpoint Security ENS is an endpoint security solution from FireEye Trellix USA. A code injection vulnerability exists in the Trellix Endpoint Security HX Agent that originates from a privileged user being able to create a malicious OpenSSL configuration file that could lead to the loadin...

Microsoft Azure Monitor Code Injection Vulnerability

Microsoft Azure Monitor is a new observability tool from Microsoft that enables end-to-end monitoring capabilities for applications, infrastructure and networks. A security vulnerability exists in Microsoft Azure Monitor. An attacker exploiting this vulnerability could remotely execute code...

PHPGurukul Taxi Stand Management System 代码注入漏洞

PHPGurukul Taxi Stand Management System is a cab stand management system from PHPGurukul. A code injection vulnerability exists in version 1.0 of the PHPGurukul Taxi Stand Management System, which originates from cross-site scripting due to incorrect manipulation of the searchdata parameter in th...

WikiDocs 代码注入漏洞

WikiDocs is a database-less Markdown flat file Wiki engine by the individual developer Manuel Zavatta in Italy. A code injection vulnerability exists in WikiDocs version 1.0.78 and earlier, which stems from cross-site scripting due to incorrect manipulation of the parameter path in the file...

Portábilis i-Educar 代码注入漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. A code injection vulnerability exists in Portábilis i-Educar version 2.9.0, which originates from cross-site scripting due to improper handling of the parameter Motivo in the file...

PHPGurukul Apartment Visitors Management System 代码注入漏洞

PHPGurukul Apartment Visitors Management System is an apartment visitor management system from PHPGurukul. A code injection vulnerability exists in version 1.0 of the PHPGurukul Apartment Visitors Management System, which originates from cross-site scripting due to improper handling of the...

Portábilis i-Educar 代码注入漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. A code injection vulnerability exists in Portabilis i-Educar version 2.9.0, which stems from cross-site scripting due to improper handling of the parameter novotitulo in the file...

Portabilisu202fi‑Diário 代码注入漏洞

Portabilisu202fi-Diário is an open source school calendar and teacher interaction management system from Portabilis, Brazil. A code injection vulnerability exists in Portabilisu202fi-Diário version 1.5.0, which stems from cross-site scripting due to improper handling of the parameter Anexo in the...

Portábilis i-Educar 代码注入漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. A code injection vulnerability exists in Portábilis i-Educar version 2.9.0, which stems from cross-site scripting due to improper handling of the parameter nmtipo in the file...

Portabilisu202fi‑Diário 代码注入漏洞

Portabilisu202fi-Diário is an open source school calendar and teacher interaction management system from Portabilis, Brazil. A code injection vulnerability exists in Portabilisu202fi-Diário version 1.5.0, which originates from cross-site scripting due to improper handling of the parameter...

RuoYi 代码注入漏洞

RuoYi is a backend management system for individual developers of RuoYi in China. A code injection vulnerability exists in RuoYi 4.8.1 and earlier versions, which originates from cross-site scripting due to incorrect manipulation of the parameter configUrl in the file /swagger-ui/index.html...

Thinkgem JeeSite 代码注入漏洞

Thinkgem JeeSite is an open source Java EE enterprise-class rapid development platform for China Zhuo Yuan Thinkgem company . The platform includes system permissions components , data permissions components , data dictionary components , core tools components , view manipulation components ,...

webssh 代码注入漏洞

webssh is a web-based ssh client by the individual developer Shengdun Hua. A code injection vulnerability exists in WebSSH 1.6.2 and earlier versions, which originates from cross-site scripting due to incorrect manipulation of the hostname/port parameter by the Login Page component...