Microweber <1.3.2 - Cross-Site Scripting

Code Injection in on search.php?keywords= GitHub repository microweber/microweber prior to 1.3.2. id: CVE-2022-3242 info: name: Microweber 1.3.2 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | Code Injection in on search.php?keywords= GitHub repository microweber/microweber...

EUVD-2026-116147

fastapi-code-generator: Import-time RCE via route path - unescaped @app.get'...' decorator...

EUVD-2026-116146

fastapi-code-generator: Import-time RCE via response status-code key - unescaped @app.get..., responses=... dict...

EUVD-2026-116145

fastapi-code-generator: Call-time RCE via operation summary - unescaped route-handler docstring...

CVE-2026-124916

PrestaShop contains an authenticated PHP code injection vulnerability within the back-office Performance debug-mode configuration . A back-office user authorized to modify debug settings can exploit the lack of sufficient escaping when providing debug_cookie_name or debug_cookie_value inputs. The...

CVE-2026-124916

PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debugcookiename or debugcookievalue that is written without sufficient escaping into a PH...

EUVD-2026-120080

PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted debugcookiename or debugcookievalue that is written without sufficient escaping into a PH...

CVE-2026-124588

A security flaw in huggingface finetrainers versions 0.1.0 and 0.2.0 allows for code injection via a remote attack. The vulnerability is located in the resolve_component_cls function within the finetrainers/utils/model.py file, specifically affecting the Model Index Handler component. The root ca...

CVE-2026-119503

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Code Injection.This issue affects Welcart e-Commerce: from n/a through 2.12.6...

CVE-2026-119503

The Welcart e-Commerce usc-e-shop plugin for WordPress is vulnerable to a Basic XSS (Improper Neutralization of Script-Related HTML Tags in a Web Page) vulnerability. This flaw allows for Code Injection and affects versions from n/a through 2.12.6 . No specific remediation details or exploit link...

EUVD-2026-119913

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Code Injection.This issue affects Welcart e-Commerce: from n/a through 2.12.6...

EUVD-2026-119898

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolvecomponentcls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The atta...

Netsweeper 4.0.3 - Cross-Site Scripting

A cross-site scripting vulnerability in webadmin/policy/grouptableajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO. id: CVE-2014-9608 info: name: Netsweeper 4.0.3 - Cross-Site Scriptin...

MediaWiki EasyTimeline - Code Injection RCE

MediaWiki EasyTimeline Timeline extension versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 contain a code injection vulnerability caused by insufficient neutralization of newlines in TextData text attributes in EasyTimeline.pl / Timeline.php. A crafted block can inject ploticus 'proc getdata' a...

TP-Link Archer A20 v3 Router - Cross-site Scripting

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution

N-able N-central versions before 2026.3.1.14 are vulnerable to pre-authentication remote code execution via static code injection CWE-96. An unauthenticated attacker with network access to the N-central management interface can execute arbitrary code on the server, potentially compromising every...

Google ADK-Python - Unauthenticated Builder Endpoint

Google Agent Development Kit ADK 1.7.0 through 1.28.1 and 2.0.0a1 through 2.0.0a2 on Python OSS, Cloud Run, and GKE contains a code injection and missing authentication vulnerability, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no authentication...

Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection

Citrix ADC and NetScaler Gateway are susceptible to remote code injection. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are before 13.0-58.30,...

Provectus kafka-ui <=0.7.2 - Remote Code Execution

Provectus kafka-ui versions 0.7.0 through 0.7.2 are vulnerable to code injection in the /api/smartfilters/testexecutions endpoint. The filterCode parameter is evaluated as a Groovy expression without sandboxing, allowing an unauthenticated attacker to execute arbitrary code and operating-system...

GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...