Lucene search
+L

37010 matches found

Cvelist
Cvelist
added last week36 views

CVE-2026-54621 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

7.8CVSS0.00142EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added last week4 views

CVE-2026-54621 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

7.8CVSS5.9AI score0.00142EPSS
SaveExploits0References3
OSV
OSV
added last week4 views

CVE-2026-54621 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

7.8CVSS5.9AI score
SaveExploits0References5
EUVD
EUVD
added last week7 views

EUVD-2026-50067

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

7.8CVSS5.9AI score0.00142EPSS
SaveExploits0References3
OSV
OSV
added last week4 views

CVE-2026-54654 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

7.8CVSS5.9AI score
SaveExploits0References5
CVE
CVE
added last week14 views

CVE-2026-54654

CVE-2026-54654 affects datamodel-code-generator (versions 0.14.1–0.60.2). The --extra-template-data comment field is rendered into Python comments in multiple templates without neutralizing carriage returns, allowing attacker-controlled comments to inject Python code into generated models that ex...

7.8CVSS5.9AI score0.00142EPSS
SaveExploits0References3
Cvelist
Cvelist
added last week32 views

CVE-2026-54654 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

7.8CVSS0.00142EPSS
SaveExploits0References3
NVD
NVD
added last week9 views

CVE-2026-15444

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

4.9CVSS0.00288EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/07/28 12:31 a.m.10 views

EUVD-2026-49669

Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request...

6AI score0.00403EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/28 12:0 a.m.7 views

PT-2026-65608

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.25.0 through 0.60.0 Description Code injection occurs when generating Python models from an attacker-controlled GraphQL schema. The issue stems from how GraphQL Union description values are rendered into...

7.8CVSS5.5AI score0.00142EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/07/28 12:0 a.m.9 views

PT-2026-65606

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.14.1 through 0.60.1 Description Code injection is possible when the --extra-template-data file contains a comment value with a carriage return r. The software renders this comment variable into Python commen...

7.8CVSS6.2AI score0.00142EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/07/27 7:22 p.m.33 views

CVE-2026-56747 Code Injection in JSON Pointer Processing Component in Cribl Stream

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

8.8CVSS0.00364EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/27 7:22 p.m.27 views

CVE-2026-56747

Cribl Stream before 4.18.2 is affected by an improper control of code generation in the JSON Pointer-to-accessor compiler. The vulnerability allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pa...

8.8CVSS6.3AI score0.00364EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/27 5:40 a.m.7 views

BIT-DOTNET-SDK-2026-50650 .NET Framework Elevation of Privilege Vulnerability

Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally...

7.8CVSS5.9AI score0.0029EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/07/27 4:16 a.m.118 views

Netsweeper <=6.4.3 - Python Code Injection

Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php with certain Referer headers launches a command line with client-supplied parameters, and allows injection of shell metacharacters. id: CVE-2020-13167 info: name: Netsweeper =6.4.4 to mitiga...

9.8CVSS7.8AI score0.95415EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/07/27 4:16 a.m.106 views

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

10CVSS7.5AI score0.98253EPSS
SaveExploits54References5
Positive Technologies
Positive Technologies
added 2026/07/27 12:0 a.m.16 views

PT-2026-65014

Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally...

7.8CVSS5.9AI score0.0029EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/27 12:0 a.m.15 views

PT-2026-65030

Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally...

7.8CVSS5.9AI score0.0029EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/07/26 7:49 a.m.7 views

Arbitrary Code Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Arbitrary Code Injection via the customBasePath schema field. An attacker can execute arbitrary Python code by supplying a specially crafted value containing embedded newlines and a...

7.5CVSS6.2AI score0.00419EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2026/07/26 3:51 a.m.11 views

CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

7.5CVSS6.7AI score0.00419EPSS
SaveExploits1References4
Rows per page
Query Builder