SourceCodester Student Result Management System 代码注入漏洞

SourceCodester Student Result Management System is a SourceCodester open source student result management system. A code injection vulnerability exists in SourceCodester Student Result Management System version 1.0, which originates from a cross-site scripting attack due to incorrect manipulation...

Code-Projects School Fees Payment System 代码注入漏洞

School Fees Payment System is a tuition payment system. School Fees Payment System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter translationremark in the file /fees.php, which can be exploited ...

CVE-2025-5255 TCC Bypass via Dylib Injection in Phoenix Code

The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library Dylib injection. A local attacker with unprivileged access can use...

Arbitrary Code Injection

Overview org.webjars.npm:jsonpath is a Query JavaScript objects with JSONPath expressions. Robust / safe JSONPath engine for Node.js. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on th...

Arbitrary Code Injection

Overview jsonpath is a Query JavaScript objects with JSONPath expressions. Robust / safe JSONPath engine for Node.js. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval...

PHPGurukul Notice Board System 代码注入漏洞

Notice Board System is a bulletin board system. Notice Board System has a cross-site scripting vulnerability, the vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the parameters Title/Description in the file /admin/manage-notices.php, which can be...

PHPGurukul Bus Pass Management System 代码注入漏洞

Bus Pass Management System is a bus pass management system. Bus Pass Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the profile name parameter in the file /admin/admin-profile.php, which can...

Code-Projects School Fees Payment System 代码注入漏洞

School Fees Payment System is a tuition payment system. School Fees Payment System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter Branch/Address/Detail in the file /branch.php, which can be...

SourceCodester My Food Recipe 代码注入漏洞

SourceCodester My Food Recipe is a SourceCodester open source recipe sharing web application. A code injection vulnerability exists in SourceCodester My Food Recipe version 1.0, which originates from cross-site scripting due to incorrect manipulation of the parameter Name in the file...

Pterodactyl Panel 代码注入漏洞

Pterodactyl Panel is a free open source game server administration panel from Pterodactyl Open Source. A code injection vulnerability exists in Pterodactyl Panel versions prior to 1.11.11, which stems from the /locales/locale.json endpoint that does not validate the locale and namespace parameter...

Code-Projects Responsive Blog 代码注入漏洞

Code-Projects Responsive Blog is an open source responsive blog by Code-Projects. A code injection vulnerability exists in Code-Projects Responsive Blog version 1.0/1.12.4/3.3.4, which originates from a cross-site scripting error in file /responsive/resblog/blogadmin/admin/pageViewMembers.php...

Code-Projects Responsive Blog 代码注入漏洞

Code-Projects Responsive Blog is an open source responsive blog by Code-Projects. A code injection vulnerability exists in Code-Projects Responsive Blog version 1.0, which stems from cross-site scripting due to incorrect manipulation of the parameter keyword in the file /search.php...

Arbitrary Code Injection

Overview pterodactyl/panel is a game management panel. Affected versions of this package are vulnerable to Arbitrary Code Injection via the /locales/locale.json endpoint when processing the locale and namespace query parameters. An attacker can execute arbitrary code on the server by sending...

Luna Imaging 代码注入漏洞

Luna Imaging is a web-hosted solution for displaying, managing, and preserving digital archival collections from Luna Imaging USA. A code injection vulnerability exists in Luna Imaging version 7.5.5.6 and earlier, which stems from improper manipulation of the parameter q in the file...

PHPGurukul COVID19 Testing Management System 代码注入漏洞

The COVID19 Testing Management System is a new crown pneumonia testing management system. COVID19 Testing Management System suffers from a code injection vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by parameter q in file...

CVE-2025-6101

A vulnerability classified as critical has been found in letta-ai letta up to 0.4.1. Affected is the function functionmessage of the file letta/letta/interface.py. The manipulation of the argument functionname/functionargs leads to improper neutralization of directives in dynamically evaluated...

VulnCheck KEV: CVE-2022-42045

Certain Zemana products are vulnerable to Arbitrary code injection. This affects Watchdog Anti-Malware 4.1.422 and Zemana AntiMalware 3.2.28...

PT-2025-26168 · Ibm · Ibm Sterling File Gateway +1

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator and IBM Sterling File Gateway versions 6.0.0.0 through 6.1.2.6 IBM Sterling B2B Integrator and IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.4 Description: The issue allows an authenticated user to embed...

Langflow Unauth RCE

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code...

GHSA-RVQX-WPFH-MFX7 Langflow Unauth RCE

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code...