CVE-2024-9773

Removed by vendor...

Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname

...

CVE-2024-10208

An Improper Neutralization of Input During Web Page Generation vulnerability in the APROL Web Portal used in B APROL 4.4-00P5 may allow an authenticated network-based attacker to insert malicious code which is then executed in the context of the user’s browser session...

CVE-2024-45480

An improper control of generation of code 'Code Injection' vulnerability in the AprolCreateReport component of B APROL 4.4-00P5 may allow an unauthenticated network-based attacker to read files from the local system...

CVE-2025-30091

In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available...

CicadasCMS Code Injection Vulnerability (CNVD-2025-06474)

CicadasCMS is a content management system. CicadasCMS code injection vulnerability can be exploited by attackers to conduct cross-site scripting attacks...

Fortinet FortiSOAR Code Injection Vulnerability (CNVD-2025-12797)

Fortinet FortiSOAR is a Security Orchestration, Automation and Response SOAR solution from Fortinet. A code injection vulnerability exists in Fortinet FortiSOAR that stems from improper code generation controls and can be exploited by an attacker to cause arbitrary code to be executed...

SAP Business Objects Business Intelligence Platform Cross-Site Scripting Vulnerability (CNVD-2025-07541)

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. SAP Business Objects Business Intelligence Platform suffers from a cross-site scripting vulnerability that stems from the application's lack of effective...

Kentico 代码注入漏洞

Kentico is an ASP.NET-based content management system CMS from Kentico, Inc. A code injection vulnerability exists in Kentico version 13.0.178 and earlier, which stems from an incorrect operation of the parameter new database that can lead to a cross-site scripting attack...

PT-2025-13037 · Apache · Apache Kylin

Name of the Vulnerable Software and Affected Versions: Apache Kylin versions 4.0.0 through 5.0.1 Description: The issue is related to improper control of generation of code, also known as 'Code Injection'. If an attacker gains access to Kylin's system or project admin permission, they may alter t...

Apache Kylin 代码注入漏洞

Apache Kylin is an open source distributed analytics engine designed to provide SQL interfaces as well as multidimensional analytics support for Hadoop and Alluxio for very large datasets. A code injection vulnerability exists in Apache Kylin versions 4.0.0 through 5.0.1, which can be exploited b...

GitLab 代码注入漏洞

GitLab is an open source, end-to-end software development platform from US-based GitLab with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A code injection vulnerability exists in GitLab versions prior to 17.10.1,...

FoxCMS 代码注入漏洞

FoxCMS is a free commercial open source content management system from China Qianxu FoxCMS company. A security vulnerability exists in FoxCMS version 1.2.5, which originates from the index.html component that allows execution of arbitrary code...

FreeBSD : Gitlab -- Vulnerabilities (1daa2814-0a6c-11f0-b4e4-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1daa2814-0a6c-11f0-b4e4-2cf05da270f3 advisory. Gitlab reports: Cross-site Scripting XSS through merge-request error messages Cross-site...

The vulnerability of the htmlawed module in the GLPI system for job requests, incidents, and computer equipment inventory allows a hacker to inject arbitrary PHP code.

The vulnerability of the htmlawed module in the GLPI system for job requests, incidents, and computer equipment inventory management is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to inject arbitrary PHP code remotely...

GHSA-785H-76CM-CPMF Django TomSelect incomplete escaping of dangerous characters in widget attributes

Summary User supplied values passed through to certain attributes in form widgets are not fully escaped for potentially dangerous tokens, and in some cases are rendered in browser as valid html tags. Details Attributes passed to the widget such as labelfield containing , and similar tokens are no...

Django TomSelect incomplete escaping of dangerous characters in widget attributes

Summary User supplied values passed through to certain attributes in form widgets are not fully escaped for potentially dangerous tokens, and in some cases are rendered in browser as valid html tags. Details Attributes passed to the widget such as labelfield containing , and similar tokens are no...

CVE-2025-28893

Improper Control of Generation of Code 'Code Injection' vulnerability in Govind Visual Text Editor visual-text-editor allows Remote Code Inclusion.This issue affects Visual Text Editor: from n/a through = 1.2.1...

CVE-2025-28893 WordPress Visual Text Editor plugin <= 1.2.1 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Govind Visual Text Editor visual-text-editor allows Remote Code Inclusion.This issue affects Visual Text Editor: from n/a through = 1.2.1...

CVE-2025-28893

CVE-2025-28893 affects the WordPress plugin Visual Text Editor (versions up to 1.2.1). The vulnerability is described as a code-generation/remote code execution issue, with the CWE suggesting code injection via generation of code, and the CVE entry noting Remote Code Execution . The issue appears...