Lucene search
+L

37005 matches found

Cvelist
Cvelist
added last week32 views

CVE-2026-54654 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

7.8CVSS0.00142EPSS
SaveExploits0References3
OSV
OSV
added last week4 views

CVE-2026-54654 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

7.8CVSS5.9AI score0.00142EPSS
SaveExploits0References5
CVE
CVE
added last week13 views

CVE-2026-54654

CVE-2026-54654 affects datamodel-code-generator (versions 0.14.1–0.60.2). The --extra-template-data comment field is rendered into Python comments in multiple templates without neutralizing carriage returns, allowing attacker-controlled comments to inject Python code into generated models that ex...

7.8CVSS5.9AI score0.00142EPSS
SaveExploits0References3
NVD
NVD
added last week9 views

CVE-2026-15444

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

4.9CVSS0.00288EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/07/28 12:31 a.m.10 views

EUVD-2026-49669

Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request...

6AI score0.00403EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/28 12:0 a.m.7 views

PT-2026-65608

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.25.0 through 0.60.0 Description Code injection occurs when generating Python models from an attacker-controlled GraphQL schema. The issue stems from how GraphQL Union description values are rendered into...

7.8CVSS5.5AI score0.00142EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/07/28 12:0 a.m.9 views

PT-2026-65606

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.14.1 through 0.60.1 Description Code injection is possible when the --extra-template-data file contains a comment value with a carriage return r. The software renders this comment variable into Python commen...

7.8CVSS6.2AI score0.00142EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/07/27 7:22 p.m.33 views

CVE-2026-56747 Code Injection in JSON Pointer Processing Component in Cribl Stream

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

8.8CVSS0.00364EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/27 7:22 p.m.26 views

CVE-2026-56747

Cribl Stream before 4.18.2 is affected by an improper control of code generation in the JSON Pointer-to-accessor compiler. The vulnerability allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pa...

8.8CVSS6.3AI score0.00364EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/27 5:40 a.m.7 views

BIT-DOTNET-SDK-2026-50650 .NET Framework Elevation of Privilege Vulnerability

Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally...

7.8CVSS5.9AI score0.0029EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/07/27 4:16 a.m.118 views

Netsweeper <=6.4.3 - Python Code Injection

Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php with certain Referer headers launches a command line with client-supplied parameters, and allows injection of shell metacharacters. id: CVE-2020-13167 info: name: Netsweeper =6.4.4 to mitiga...

9.8CVSS7.8AI score0.95415EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/07/27 4:16 a.m.106 views

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

10CVSS7.5AI score0.98253EPSS
SaveExploits54References5
Positive Technologies
Positive Technologies
added 2026/07/27 12:0 a.m.16 views

PT-2026-65014

Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally...

7.8CVSS5.9AI score0.0029EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/27 12:0 a.m.15 views

PT-2026-65030

Improper control of generation of code 'code injection' in .NET Framework allows an unauthorized attacker to elevate privileges locally...

7.8CVSS5.9AI score0.0029EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/07/26 7:49 a.m.6 views

Arbitrary Code Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Arbitrary Code Injection via the customBasePath schema field. An attacker can execute arbitrary Python code by supplying a specially crafted value containing embedded newlines and a...

7.5CVSS6.2AI score0.00419EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2026/07/26 3:51 a.m.11 views

CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

7.5CVSS6.7AI score0.00419EPSS
SaveExploits1References4
OSV
OSV
added 2026/07/26 3:51 a.m.13 views

CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

7.5CVSS6.7AI score0.00419EPSS
SaveExploits1References5
Vulnrichment
Vulnrichment
added 2026/07/26 3:51 a.m.6 views

CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

7.5CVSS6.7AI score0.00419EPSS
SaveExploits1References3
CVE
CVE
added 2026/07/26 3:51 a.m.54 views

CVE-2026-63720

CVE-2026-63720 affects datamodel-code-generator prior to version 0.70.0. The issue is a code injection vulnerability where attackers who control input schemas can supply a malicious customBasePath containing embedded newlines and a dot-free Python expression, which is emitted into a generated fro...

7.5CVSS6.7AI score0.00419EPSS
SaveExploits1References3
Veracode
Veracode
added 2026/07/26 2:11 a.m.9 views

Code Injection

Kiota is vulnerable to Code Injection. The vulnerability is due to improper sanitization of OpenAPI documentation fields before generating C XML documentation comments, which allows an attacker to inject arbitrary C code into generated client source files...

8.7CVSS6AI score0.01016EPSS
SaveExploits0References5Affected Software2
Rows per page
Query Builder