Code Injection Vulnerability in Various ABB Products (CNVD-2025-13767)

ABB ASPECT-Enterprise is a scalable building energy management and control solution.ABB NEXUS Series is a monitoring and control management system.ABB MATRIX Series is an embedded IoT ASPECT control engine designed to provide flexible field control for medium to large field control applications. ...

CVE-2025-6101 letta-ai letta interface.py function_message eval injection

A vulnerability classified as critical has been found in letta-ai letta up to 0.4.1. Affected is the function functionmessage of the file letta/letta/interface.py. The manipulation of the argument functionname/functionargs leads to improper neutralization of directives in dynamically evaluated...

CodeAstro Food Ordering System 代码注入漏洞

CodeAstro Food Ordering System is a food ordering system from CodeAstro. A code injection vulnerability exists in CodeAstro Food Ordering System version 1.0, which stems from cross-site scripting due to incorrect manipulation of the Restaurant Name/Address parameter in the file /admin/store/edit/...

PHPGurukul Rail Pass Management System 代码注入漏洞

Rail Pass Management System is a rail pass management system. A cross-site scripting vulnerability exists in Rail Pass Management System due to improper handling of the parameter Name in the /contact.php file. The vulnerability can be exploited by an attacker to execute malicious scripts on an...

TencentOS Server 4: ansible (TSSA-2024:0976)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0976 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

TencentOS Server 3: icedtea-web (TSSA-2022:0037)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0037 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 4: python-setuptools (TSSA-2024:0661)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0661 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Conda-build 代码注入漏洞

Conda-build is a Conda open source command and tool for building conda packages. A code injection vulnerability exists in versions of Conda-build prior to 25.4.0 that stems from an insecure evaluation of recipe selectors and could lead to arbitrary code execution...

TencentOS Server 3: nodejs:18 (TSSA-2023:0256)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0256 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

ComfyUI 代码注入漏洞

ComfyUI is one of the most powerful and modular diffusion model GUI and backend from comfyanonymous individual developers. A code injection vulnerability exists in ComfyUI version 0.3.39 and earlier, which stems from a cross-site scripting attack due to the incorrect manipulation of the parameter...

Exploit for Code Injection in Ispconfig

---- CVE-2023-46818...

Exploit for Code Injection in Ispconfig

---- CVE-2023-46818...

CVE-2025-49598

Summary: CVE-2025-49598 affects the conda-forge-ci-setup package (and its feedstock setup script) via an unsafe use of eval when parsing version information from a custom-formatted meta.yaml. An attacker who can modify the recipe (RECIPE_DIR) and supply a malicious meta.yaml can cause arbitrary c...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via script pluginmodel.rb. An attacker can upload a crafted requirements.txt file with a malicious plugin. Remediation There is no fixed version for openc3. References - PoC - Vulnerable Code...

CVE-2025-4232 GlobalProtect: Authenticated Code Injection Through Wildcard on macOS

An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate their privileges to root...

CVE-2025-48123

Improper Control of Generation of Code 'Code Injection' vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Code Injection.This issue affects Spreadsheet Price Changer for...

CVE-2025-48140

Improper Control of Generation of Code 'Code Injection' vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.This issue affects MetalpriceAPI: from n/a through = 1.1.4...

CVE-2025-49013

WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue arises from unsafe usage of $ github.event.review.body and other user controlled variables directly inside shell script contexts in GitHub...

IBM Cloud Pak for Security and IBM QRadar Suite Code Injection Vulnerabilities

IBM Cloud Pak for Security is a software application. An open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster.IBM QRadar Suite is an integrated security information and event management SIEM solution for...

RSJoomla! RSform!Pro 代码注入漏洞

RSJoomla! RSform!Pro is a form component from RSJoomla! A code injection vulnerability exists in RSJoomla! RSform!Pro versions 3.0.0 through 3.3.14, which stems from a flaw in the submit export functionality that could lead to remote code execution...