Plenti < v0.7.2 - OS Command Injection

Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The /postLocal endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the...

Contact Form Generator <= 2.5.5 - Cross-Site Scripting

The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

WordPress WP Child Theme Generator < 1.1.3 - Arbitrary File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in WEN Solutions WP Child Theme Generator.This issue affects WP Child Theme Generator- from n/a through 1.0.9. id: CVE-2023-47873 info: name: WordPress WP Child Theme Generator 1.1.3 - Arbitrary File Upload author: cysamu,Crux severity...

PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download

The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5 via the rtwpgaepbdwnldpdf function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which...

PDF Generator for WordPress < 1.1.2 - Cross Site Scripting

The plugin includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be used against high privilege users such as admin id: CVE-2022-4321 info: name: PDF Generator for WordPress 1.1.2 - Cross Site Scripting author: r3Y3r53,HuTa0 severity: medium...

WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution

WordPress XML Sitemap Generator for Google plugin before 2.0.4 contains a cross-site scripting vulnerability that can lead to remote code execution. It does not validate a parameter which can be set to an arbitrary value, thus causing cross-site scripting via error message or remote code executio...

Companion Sitemap Generator < 4.5.3 - Cross-Site Scripting

The plugin does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. id: CVE-2023-1780 info: name: Companion Sitemap Generator 4.5.3 - Cross-Site Scripting author:...

Code Injection

datamodel-code-generator is vulnerable to Code Injection. The vulnerability is due to insufficient validation of x-python-type values from attacker-controlled JSON Schema content before inserting them into generated Python field annotations, which allows an attacker to execute arbitrary Python co...

Sensitive Information Exposure

datamodel-code-generator is vulnerable to Sensitive Information Exposure. The vulnerability is due to the reuse of Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, which allows an attacker controlling a redirect target to...

Server-Side Request Forgery (SSRF)

datamodel-code-generator is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to http.getbody in src/datamodelcodegenerator/http.py accepting --url targets and redirect chain targets without proper host/IP validation, which allows an attacker to perform server-side request...

Path Traversal

datamodel-code-generator is vulnerable to Path Traversal. The vulnerability is due to improper validation of schemaLocation values in XML Schema parsing xs:include, xs:import, xs:redefine, and xs:override, which allows an attacker to reference files outside the intended input base path, resulting...

SUSE CVE-2026-55391

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...

SUSE CVE-2026-55403

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodelcodegenerator/http.py getbody reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped...

SUSE CVE-2026-55415

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema...

SUSE CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

GHSA-HQJ5-CW9F-RX67 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

Summary swagger-typescript-api interpolates servers0.url directly into a TypeScript class-body field initializer of the generated fetch HttpClient templates/base/http-clients/fetch-http-client.ejs:75, without any escaping. A malicious URL containing a " closes the string literal that initializes...

CVE-2026-54654

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:44+00:00| published-proof-of-concept| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-wjv6-jcfj-mf9r 2026-07-29 03:28:01+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrqy7iat4v2y...

CVE-2026-55403

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:27+00:00| published-proof-of-concept| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-r5vv-ff45-prp2 2026-07-29 00:00:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqmmvyow724...

CVE-2026-54655

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:24+00:00| published-proof-of-concept| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q...

CVE-2026-55391

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:11+00:00| published-proof-of-concept| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-vx7x-vcc2-c44g 2026-07-28 23:01:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqjccj7di2u...