PT-2026-84225

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An authenticated user with limited privileges can exploit a code injection flaw to execute arbitrary code with root privileges. Code injection is a type of attack where an attacker...

CVE-2026-18808: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Klemsan Electrical Electronics Inc. KIO Klemsan Internet Objects allows Code Injection. This issue affects KIO Klemsan Internet Objects: before v1.9...

Arbitrary Code Injection

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Arbitrary Code Injection in the /prompts/test endpoint through the renderedcontent path in litellm/proxy/prompts/promptendpoints.py. An attacker can execute arbitrary OS...

Exploit for Code Injection in Redhat Richfaces

CVE-2018-14667-Lab POC for the exploitation of CVE-2018-14667...

Exploit for Code Injection in Redhat Richfaces

CVE-2018-14667-Lab LAB PREREQUISITES Demo App From : htt...

CVE-2026-42588

A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...

CVE-2026-82666

A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate...

CVE-2026-82666 yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection

A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate...

EUVD-2026-68435

A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate...

CVE-2026-82666 yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection

A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate...

CVE-2026-82666

A code injection flaw exists in yaojingang GEOFlow up to version 2.1.0 , specifically in the preview function of app/Http/Controllers/Admin/SiteThemeEditorController.php within the Superadmin Theme Editor component. Manipulation of the blade argument allows remote code injection. The flaw require...

CVE-2026-82598

A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate the attack remotely. The exploit has been publicly disclose...

CVE-2026-77956

Improper Control of Generation of Code Code Injection vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context - ... end form lets t...

EEF-CVE-2026-77956 EEx template evaluation of prompt content in AshAi enables remote code execution

Summary Improper Control of Generation of Code Code Injection vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context - ... end for...

CVE-2026-77956 EEx template evaluation of prompt content in AshAi enables remote code execution

Improper Control of Generation of Code Code Injection vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context - ... end form lets t...

CVE-2026-77956 EEx template evaluation of prompt content in AshAi enables remote code execution

Improper Control of Generation of Code Code Injection vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context - ... end form lets t...

EUVD-2026-68303

Improper Control of Generation of Code Code Injection vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context - ... end form lets t...

CVE-2026-77956 EEx template evaluation of prompt content in AshAi enables remote code execution

Improper Control of Generation of Code Code Injection vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context - ... end form lets t...

CVE-2026-77956

CVE-2026-77956 is a code injection vulnerability in ash_ai (ash-project, Elixir), affecting versions 0.1.0 through before 1.0.0 . The root cause lies in AshAi.Actions.Prompt, which evaluates prompt content via EEx.eval_string/2. When a prompt uses the documented function form and incorporates req...

CVE-2026-82598

SeaCMS versions up to 13.6 contain a code injection vulnerability in the Template Engine component, specifically in the parseIf function within search.php . An attacker can remotely manipulate the searchtype argument without authentication to inject arbitrary code. The CVSS 3.1 score is 7.3 (HIGH...