Code Injection

Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthenticated attackers to execute arbitrary code by abusing the ajax_calc endpoint of the bundled calc form plugin. The calc plugin evaluates user-influenced expressions server-side, and the AJAX handler exposes that evaluation without authentication, giving remote attackers full control of the underlying PHP process. CVSS 4.0 rates this 10.0 (maximum); no public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Cross-origin request forgery leading to remote code execution in OpenYak before 1.1.3 lets any malicious webpage a user visits drive the desktop backend's loopback HTTP API (typically 127.0.0.1:19141) to run arbitrary shell commands on the host, terminate the service, and steal chat history and account PII. The local API ships with no Origin validation, no loopback authentication, no Content-Type enforcement, and a wildcard CORS policy, so the victim's browser is abused as a proxy that defeats OS-level network isolation. No public exploit identified at time of analysis; the flaw is fixed in version 1.1.3.

Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permission, who can exploit an insufficiently restricted HikariCP connection-pool property passthrough in the DataStore configuration API to inject arbitrary SQL via the connectionInitSql property. On the default H2 embedded database backend - common in non-production and smaller deployments - H2's ability to invoke Java methods from SQL allows this injection to escalate to OS-level command execution as the Nexus process user. No public exploit has been identified at time of analysis, but the H2-to-RCE escalation path is a well-understood Java ecosystem technique that lowers the practical skill bar significantly.

Cross-namespace traffic hijacking in Traefik's Kubernetes Gateway API provider allows a low-privileged tenant to redirect another namespace's HTTP, GRPC, TCP, or TLS traffic to an attacker-controlled backend. The root cause is a non-injective route identity scheme: namespaces and route names are hyphen-concatenated without field delimiters, so namespace=team/route=a-app and namespace=team-a/route=app produce the identical key httproute-team-a-app-..., and the later-loaded route silently overwrites the earlier one via maps.Copy. No public exploit identified at time of analysis as a KEV entry, but a full proof-of-concept bash script is publicly available and was verified against the official traefik:v3.7.8 image. All Traefik v3 releases prior to v3.6.25 and v3.7.10 are affected.

Remote code execution in the CTX Feed (WebAppick Product Feed for WooCommerce) WordPress plugin through version 6.6.42 allows a user holding the Shop Manager role to inject and execute arbitrary code (CWE-94) on the underlying server. The CVSS 3.1 score of 9.1 reflects a scope change where WooCommerce-level access translates into full host compromise. No public exploit identified at time of analysis, and no EPSS or KEV data was provided.

Remote code execution in the Spider Analyser WordPress plugin (by wbolt.com) affects all versions up to and including 2.1.3, allowing remote attackers to inject and run arbitrary PHP code on the underlying web server without authentication. Because the CVSS vector carries PR:N/UI:N with a scope change, exploitation requires no login or user interaction and can compromise the entire hosting environment. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the maximal 10.0 score makes it a high-priority patch target for affected sites.

Remote code execution in the Betheme WordPress theme (muffingroup) through version 28.4.2 allows a user holding a low-privileged Contributor account to inject and execute arbitrary PHP/code (CWE-94) on the underlying host. Because the CVSS vector marks scope as changed (S:C) with full confidentiality, integrity, and availability impact, a successful attack escapes the WordPress application boundary and can compromise the web server itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk is elevated by the very low privilege bar and the widespread commercial deployment of Betheme.

Session hijacking via missing source address validation in Sonic 3 A.I.R.'s OxygenEngine ConnectionManager allows an on-path network attacker to inject arbitrary UDP packets into any established multiplayer session. The flaw exists because established connections are resolved solely by a two-byte local connection handle with no verification that the packet's source address matches the registered remote address, enabling session termination, channel message forgery, and response spoofing without IP address spoofing. No public exploit or CISA KEV listing exists, but the CVSS 4.0 score of 8.3 (AC:H) reflects that network on-path positioning is required, limiting opportunistic mass exploitation.

Authorization Code Substitution in Apache CXF's OpenID Connect Relying Party implementation allows remote attackers to hijack authenticated sessions when CXF is deployed in Hybrid Flow mode with a non-compliant or misconfigured Identity Provider that omits the c_hash parameter. Successful exploitation yields full authenticated access equivalent to account takeover, with high confidentiality and integrity impact. No public exploit has been identified at time of analysis, but SSVC classifies the attack as automatable with total technical impact once the prerequisite IdP condition is present.

Sandbox escape leading to remote code execution in FrontMCP (agentfront/frontmcp) before 1.5.7 lets a single tools/call to the codecall:execute tool break out of the script sandbox and run arbitrary code as the server user. The security membrane hands back live host Zod v4 schema instances via getTool(), giving script authors a path to the host Function constructor and full process control, exposing OAuth client secrets, JWT_SECRET, session keys, database credentials, and cloud metadata. Because the framework ships DEFAULT_AUTH_OPTIONS in public mode, unconfigured servers expose this to unauthenticated callers, and publicly available exploit code exists in the form of the fix commit's regression tests demonstrating the exact escape technique.

Unauthenticated remote code execution in Nuxt DevTools (@nuxt/devtools before 3.3.1) lets any client reaching the Vite HMR WebSocket invoke RPC methods that were never gated by the ensureDevAuthToken check. By chaining updateOptions() to poison the persisted behavior.openInEditor value and then calling openInEditor(), an attacker runs an arbitrary program on the developer's machine via the launch-editor package. Only development environments are affected; production builds do not run DevTools. This is rated CVSS 9.6 (scope-changed), and no public exploit has been identified at time of analysis.

Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe directory to execute arbitrary code as the PraisonAI process user. Affected are praisonai 3.9.26-4.6.57 and praisonaiagents 0.12.12-1.6.57. This is a hardening bypass: the vulnerable sink in Workflow._execute_include() skips the PRAISONAI_ALLOW_TEMPLATE_TOOLS/PRAISONAI_ALLOW_LOCAL_TOOLS opt-in gates and the centralized safe loader that protect all other tools.py autoload paths, making it a distinct variant within an established advisory family. No public exploit or CISA KEV listing has been identified at time of analysis.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by any authenticated attacker due to improper validation of module imports, classified under CWE-94 (Code Injection). The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact with no user interaction required beyond low-privilege authentication. No public exploit code has been identified at time of analysis, EPSS sits at 0.34% (27th percentile), and SSVC designates exploitation as 'none' currently - though the SSVC technical impact is rated 'total', confirming the severity of successful exploitation.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by remote attackers holding low-privilege credentials via server-side code injection (CWE-94). The CVSS score of 8.8 reflects full confidentiality, integrity, and availability impact with a low-complexity network attack path requiring only valid user authentication. No public exploitation has been confirmed - EPSS places the exploitation probability at 0.36% (29th percentile) and SSVC rates exploitation status as none and the attack as non-automatable, though SSVC's technical impact rating is total, consistent with arbitrary code execution.

Remote code execution in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated remote attackers to inject and execute arbitrary Python code by crafting payloads that evade the platform's AST-based security scanning mechanism. The flaw (CWE-94, Code Injection) is particularly insidious because the defensive AST validation layer gives a false sense of protection while silently passing malicious constructs to the Python runtime. No public exploit or CISA KEV listing exists at time of analysis, but the low-complexity, fully network-accessible attack path with complete confidentiality, integrity, and availability impact warrants urgent patching - especially for any internet-exposed or multi-tenant deployments.

Remote code execution in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated low-privilege users to trigger arbitrary Python execution on the backend server by submitting crafted Agentic Assistant workflows containing malicious LLM-generated components that are evaluated server-side during validation before user approval is granted. The flaw (CWE-94, Code Injection) arises because the validation pipeline eagerly executes model-generated Python without sandboxing or deferral, giving attackers backend process-level privileges to exfiltrate data, interact with the file system, or initiate outbound network connections. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS places exploitation probability at 0.22% (13th percentile), but SSVC rates technical impact as total, making this a high-priority patch target for multi-user or internet-exposed deployments.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 allows any internet-reachable attacker to execute arbitrary server-side code using only two HTTP requests. The vulnerability is rooted in CWE-94 (Code Injection), enabling full server compromise with no user interaction. A vendor patch is available via IBM advisory, and no public exploit has been identified at time of analysis - however the trivially low attack complexity makes any internet-exposed instance an immediate remediation priority.

Remote code injection in IBM Langflow OSS 1.0.0 through 1.10.3 allows an authenticated remote attacker to execute arbitrary code on the underlying server by supplying malicious input through user-controlled code fields within the platform. The CVSS vector (AV:N/AC:L/PR:L) confirms the attack is network-reachable at low complexity, requiring only low-privilege credentials, with full confidentiality, integrity, and availability impact on the host. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.

Unsandboxed Groovy script execution in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows any attacker holding Item/Create or Item/Configure permission to run arbitrary code directly on the Jenkins controller JVM. The plugin exposes Groovy scripting capabilities that intentionally bypass the Script Security Plugin - the standard Jenkins mechanism for confining script execution to a restricted sandbox - meaning scripts execute with the full privileges of the Jenkins service account. The fix is available in Multijob Plugin 677.v7ffc23d6a_4c2; no public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.

Unauthenticated remote code execution in iot-ecology's rust-iot-platform allows attackers to run arbitrary JavaScript in the server process by creating a malicious "calc rule". The POST /calc-rule/create endpoint omits the AuthToken guard applied to other routes, and the supplied script field is later passed unsandboxed to quick_js::Context::eval(), giving full script execution once triggered. CVSS is 9.8; no public exploit identified at time of analysis, though the flaw is trivially reachable and the root cause is confirmed by source-level reference.

Arbitrary server-side code execution in Magistrala's Rules Engine exposes any authenticated low-privileged user to full file system access, environment variable exfiltration, database manipulation, and SSRF against internal microservices. The platform's two script runtimes - Go via Yaegi and Lua - both fail to sandbox dangerous capabilities: the Go engine exposes the complete standard library behind a trivially insufficient regex filter, while the Lua engine performs no validation whatsoever and explicitly preloads file I/O, HTTP client, and database libraries. No public exploit code has been identified at time of analysis, but the attack requires only a valid account and the ability to create rules, making exploitation straightforward for any tenant or internal user.

Remote code execution in MacCMS10's admin template editor enables authenticated administrators to execute arbitrary OS commands by exploiting an incomplete PHP function blacklist in conjunction with ThinkPHP's native `{if}` template tag. The `Template.php` controller filtered dangerous functions via regex but omitted `exec`, `passthru`, `popen`, `create_function`, `register_shutdown_function`, `register_tick_function`, `show_source`, and `error_log`, allowing payloads such as `{if condition="exec('id > /tmp/pwned.txt')"}{/if}` to pass validation and execute at render time. No public exploit repository has been independently cited and this CVE is not listed in the CISA KEV catalog; an upstream fix was committed on 2026-06-22.

Persistent unauthenticated remote code execution in MaxSite CMS lets attackers POST a crafted db_dbprefix value to the install endpoint even after installation is complete, injecting attacker-controlled PHP into application/config/database.php that executes on every subsequent request. Reported by VulnCheck with a vendor patch available and rated CVSS 4.0 9.3 (AV:N/AC:L/PR:N/UI:N), it grants code execution as the web-server process user; no public exploit identified at time of analysis, though the advisory describes the technique in detail.

Remote code execution in Flowise (npm flowise / flowise-components <= 3.1.2) lets an unauthenticated attacker who can query a chatflow built on the CSV Agent node coerce the backing LLM, via prompt injection, into returning a Python payload that slips past the regex blocklist validator and runs in an unsandboxed pyodide runtime, yielding arbitrary code execution as the Flowise service account. Trend Micro ZDI (Dre Cura, TrendAI Research) demonstrated eight distinct validator-bypass techniques and shipped a working proof of concept; this is scored CVSS 4.0 9.5 (CWE-94). Publicly available exploit code exists, but there is no CISA KEV listing or evidence of active exploitation at time of analysis.

Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise process by abusing the CSVAgent node, which interpolates an attacker-controlled base64 segment of the csvFile data URI directly into a Python template run by Pyodide. Because Pyodide's default js bridge exposes globalThis (including eval and dynamic import on Node.js), the injected code can break out of the Python string, call js.eval, import fs and child_process, and run host commands; the surrounding validators are never applied to this bootstrap template. A low-privileged workspace user plants the malicious node, after which any unauthenticated request to the public POST /api/v1/prediction/:id endpoint triggers the RCE. No public exploit is identified at time of analysis (no KEV, no POC signal in the provided data), but the fix is confirmed in version 3.1.3.

Remote code execution in FlowiseAI Flowise 3.1.2 lets an authenticated user abuse the 'SQLite Record Manager' node's `additionalConfig` input to override the target database path and write an attacker-shaped SQLite file to any location on disk. Because the official Docker image runs as root, the file can be planted at /etc/chromium/exploit.conf, and a second Upsert operation that launches Puppeteer/Chromium sources that .conf file and executes an embedded reverse-shell payload, yielding full application compromise as root. No public exploit is identified at time of analysis beyond the detailed reproduction steps in the elttam advisory; the issue is patched in 3.1.3.

Remote code execution in Veeam ONE, the enterprise backup monitoring and analytics platform, is achievable by high-privileged authenticated users via a network-accessible code injection flaw (CWE-94). The vulnerability carries a CVSS 4.0 score of 8.6 with full confidentiality, integrity, and availability impact on the vulnerable system, reported through HackerOne and detailed in Veeam KB4892. No public exploit code or CISA KEV listing has been identified at time of analysis, moderating near-term mass-exploitation risk despite the critical impact class.

Remote unauthenticated code execution in Veeam ONE (CPE cpe:2.3:a:veeam:one) allows attackers to run arbitrary code on the agent host over the network with no credentials or user interaction. The flaw is a CWE-94 code injection carrying a maximal CVSS 4.0 base score of 10.0, reflecting full compromise of both the vulnerable and downstream systems. Reported via HackerOne with a Veeam KB advisory published; no public exploit has been identified at time of analysis.

Remote code execution in Flowise (flowise and flowise-components <= 3.1.2) is possible through the CSVAgent node, which executes user-supplied Python in a pyodide runtime. A regex denylist blocks imports and dangerous builtins, but attackers bypass it entirely by calling the pre-imported pandas library's read_pickle() to deserialize an attacker-controlled base64 pickle, achieving arbitrary command execution. A detailed working proof-of-concept (pickle __reduce__ gadget plus a custom file-like reader class to feed the payload) is published in the vendor GHSA advisory; publicly available exploit code exists, but there is no public exploit identified as being used in the wild and it is not in CISA KEV.

Remote code execution in FlowiseAI Flowise (npm packages flowise and flowise-components) versions 3.1.2 and earlier lets an authenticated user achieve root command execution on the host by injecting Python into the CSV Agent's Pyodide sandbox, which bridges back to the host Node.js process. Attackers reach OS command execution, credential theft, arbitrary file read, and server crash. A working Metasploit module and root Meterpreter session are documented, so publicly available exploit code exists, though the flaw is not listed in CISA KEV.

Remote code execution as root in Flowise (npm packages flowise and flowise-components, versions 3.0.5 through 3.1.2) lets any authenticated user with a valid API key escape the NodeVM sandbox used by the custom-function feature and run arbitrary OS commands. The flaw stems from executeJavaScriptCode() merging caller-supplied nodeVMOptions over its secure defaults with a JavaScript spread, so an attacker can re-enable blocked builtins (child_process, fs) via require.builtin:["*"]. A detailed working exploit is published in the vendor's GHSA advisory, so publicly available exploit code exists; there is no CISA KEV listing, meaning no confirmed active exploitation at time of analysis.

Remote code execution in LAMP Rapid Development Platform (dromara lamp-cloud) through version 5.6.2 allows low-privileged authenticated attackers to inject arbitrary Groovy code into message template script fields processed by the GlueFactory component, resulting in OS command execution on the backend server with the privileges of the Java process. The GlueFactory compiled and ran these scripts via GroovyClassLoader with no sandboxing, AST restrictions, or class whitelisting in place. A publicly available exploit exists via GitHub issue #408, and CVSS 4.0 rates this 8.7 with full confidentiality, integrity, and availability impact on the vulnerable system.

Authenticated remote code execution in FlowiseAI Flowise (versions ≤ 3.1.2, npm packages flowise and flowise-components) arises from a vm2 JavaScript sandbox escape reachable through the AgentAsTool, ChatflowTool, and ExecuteFlow nodes, which still run untrusted code in the deprecated in-process vm2 sandbox (useSandbox: false). An attacker who can edit a chatflow injects code via an unvalidated baseURL URL-hash fragment and abuses moment's CVE-2022-24785 path-traversal (whose fix is bypassable inside the sandbox) to break out of vm2 and run arbitrary commands as the Flowise service account, fully compromising the host. A complete working exploit is published in the elttam/GitHub advisory, but the flaw is not in CISA KEV.

Configuration injection in marimo before 0.23.15 enables a malicious notebook author to silently exfiltrate an operator's OpenAI API key by embedding an attacker-controlled `base_url` in PEP-723 inline script metadata, which the `sanitize_pyproject_dict` function merges into session configuration at higher precedence than the operator's own settings. When the operator opens the crafted notebook and invokes any AI feature - code completion, AI chat, or similar - marimo resolves the injected endpoint while supplying the operator's `OPENAI_API_KEY` as the Authorization credential, transmitting it to the attacker's server. Critically, no cell execution is required; the exfiltration fires on the AI request itself. No public exploit confirmed at time of analysis, though VulnCheck's detailed advisory materially lowers the reproduction barrier. Patch is available in marimo 0.23.15.

Authenticated remote code execution in FlowiseAI Flowise 3.1.2 and earlier lets any logged-in user escape the vm2 sandbox and run arbitrary OS commands on the host. The MySQL/Postgres/SQLite Record Manager and MySQL/Agent Memory nodes expose an unfiltered additionalConfig input passed directly into the TypeORM DataSource constructor, whose entities/subscribers/migrations options can load attacker-supplied JavaScript files. A full public reproduction (including a root reverse-shell payload) was published in the elttam advisory, and the vendor fixed it in 3.1.3.

Remote code execution in Perspective 5.0.0 exposes any network-reachable PolarsVirtualServer backend to arbitrary OS command execution via Python eval() injection. The server passes client-supplied expression strings to eval() with only __builtins__={} cleared - a well-known insufficient sandbox - enabling attackers to traverse Python's loaded class hierarchy to reach subprocess.Popen through crafted TableValidateExprReq or TableMakeViewReq protobuf messages. A public exploit is confirmed by VulnCheck, and five vulnerabilities were disclosed simultaneously in the researcher's blog post, suggesting a broader attack surface in this release. No KEV listing is identified, but the published PoC substantially lowers the exploitation barrier.

PHP code injection in the Create Block Theme WordPress plugin (before 2.10.0) enables a multisite subsite administrator to execute arbitrary server-side code by exploiting insufficient output escaping when the plugin writes user-supplied text into generated PHP pattern files. The vulnerability leverages a capability boundary mismatch unique to WordPress multisite: subsite admins hold the capability gating pattern file generation but are denied the capability normally required for PHP file editing, creating an unintended privilege escalation path to full remote code execution. A public proof-of-concept is available via WPScan, though EPSS sits at 0.15% (5th percentile), indicating exploitation is currently targeted rather than widespread.

Code injection in the LINE Android app (prior to version 26.7.2) allows an attacker who controls a LINE profile to embed malicious script content in profile templates, which executes with the app's full privileges when a victim views that profile. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact against the vulnerable system, with network-accessible, zero-privilege exploitation requiring only passive victim interaction. Critically, LY Corporation has deployed a server-side mitigation that protects even unpatched Android clients; no public exploit has been identified at time of analysis and no CISA KEV listing exists.

Arbitrary code injection in Vim 9.2.0389 and earlier exposes OpenVMS deployments to local code execution through a flaw in the platform-specific `vms_fixfilename()` function in `os_vms.c`. A local attacker can craft a malicious filename that bypasses sanitization controls in this VMS-only code path, causing Vim to execute injected code. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though a researcher's technical write-up is publicly accessible via GitHub Gist; the EPSS score of 0.16% (6th percentile) indicates very low exploitation probability in practice.

Remote code execution in Adobe Campaign Classic (ACC) lets an authenticated low-privileged attacker inject directives into dynamically evaluated code (CWE-95 eval injection) and run arbitrary code in the context of the current user. Because the CVSS scope is changed, the impact can reach components beyond the initially exploited one, driving the 9.6 critical score. Reported by Adobe with advisory APSB26-120; no public exploit identified at time of analysis and no CISA KEV listing.

Remote code execution in Tenable Sensor Proxy (versions before 1.4.2) lets an attacker run code with elevated privileges by luring an operator into connecting the sensor to an attacker-controlled host. The CWE-94 code-injection flaw is triggered during that connection, and the CVSS 4.0 score of 9.3 reflects full compromise of confidentiality, integrity, and availability on the proxy host. There is no public exploit identified at time of analysis and it is not on CISA KEV, but a vendor patch is available.

Credential exfiltration in Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before version 2.0.24 allows a remote unauthenticated attacker - operating through prompt injection - to redirect RabbitMQ broker credentials or OAuth access tokens to an attacker-controlled endpoint by supplying a crafted broker hostname in the MCP client context. The RabbitMQ broker connection tools fail to validate that hostnames resolved through the MCP client context correspond to legitimate Amazon MQ broker endpoints, enabling a server-side request forgery-like exfiltration primitive. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and the vendor (Amazon) has released a confirmed fix in version 2.0.24.

Man-in-the-middle credential theft and AI-response injection affects Emlog Pro through 2.6.23, where the AI integration module (include/service/ai.php) unconditionally disables TLS certificate validation on every outbound HTTPS call to configured LLM providers. A network-adjacent attacker who can intercept this traffic can present any TLS certificate to harvest the Authorization Bearer API keys sent with each AI request and to forge LLM responses that feed the automated tool-call pipeline, including the query_database and update_config handlers. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 9.1 reflects the high confidentiality and integrity impact.

Code injection in WebsiteBaker CMS before 2.13.10 allows an authenticated administrator to plant a PHP webshell that is subsequently exploitable by unauthenticated remote attackers. The Droplets editor's save_droplet handler writes the Code field verbatim - without any content sanitization - to a publicly accessible PHP file inside the modules directory. Once an admin submits malicious PHP, any unauthenticated user can trigger full remote code execution by issuing a direct HTTP request to the predictable file path. A public proof-of-concept exploit exists; no CISA KEV listing at time of analysis.

Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so that arbitrary PHP runs as the web server user. The flaw lives in library/classes/Tree.class.php, where an attacker chains SQL execution to change the categories table id column to VARCHAR and store a PHP payload that a later unsanitized eval() executes every time any page - including unauthenticated and low-privilege ones - instantiates CategoryTree, turning a one-time admin action into a persistent server-wide backdoor. Publicly available exploit code exists (documented by VulnCheck and Jiva Security), and CVSS 4.0 is 9.4; no active exploitation is confirmed in CISA KEV at time of analysis.

Arbitrary public static PHP method invocation in Grav CMS 2.0.7-2.0.10 allows any account holding page-editing rights (admin.pages) to read arbitrary server-readable files and create or copy files and directories under the web-server account. The flaw lies in Blueprint::isSafeDynamicCall(), which skips its dangerous-callable denylist entirely for strings containing '::' - meaning fully-qualified Class::method notation in blueprint dynamic-field directives is never checked against the blocklist. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis, but the low-privilege requirement and high-impact outcome make this a credible internal threat in multi-tenant or shared Grav deployments.

Signature-verification bypass in the Perl XML::Sig module before 0.71 allows remote attackers to forge which document node is validated by injecting XPath operators through the SignedInfo/Reference/@URI attribute. Because verify() and _get_signed_xml() concatenate the attacker-controlled URI into an XPath expression without escaping or NCName validation, a single quote breaks out of the string literal and lets the injected expression decide which element is digest-checked - undermining the integrity guarantee of any XML Signature the library verifies. No public exploit has been identified at time of analysis, and the flaw is not on CISA KEV; a vendor patch exists in release 0.71.

Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaScript trigger scripts, because ScriptTriggerExecutor grants sandbox access to the full java.lang.* package, allowing direct invocation of java.lang.Runtime.getRuntime().exec() or ProcessBuilder. Any account holding UPDATE_SCHEMA permission can create a trigger that fires OS commands server-side against the underlying host process. No public exploit has been identified at time of analysis, but SSVC rates the technical impact as total and the attack as automatable, and the GHSA advisory provides sufficient implementation detail to lower the barrier for capable threat actors.

HTTP request/header injection in FreeRDP through 3.28.0 allows a malicious or compromised RDP server to inject arbitrary data into a client's outbound HTTP proxy CONNECT request. The server-controlled RDP redirection TargetNetAddress field is copied into the client ServerHostname and written unfiltered into the proxy CONNECT request line and Host header, so a crafted redirection PDU carrying CRLF and control characters can forge headers or smuggle additional requests. Reported by VulnCheck; a vendor patch exists in FreeRDP 3.29.0. There is no public exploit identified at time of analysis, and no CISA KEV listing.

Remote code execution in the Kali Forms WordPress plugin (≤2.4.20) allows unauthenticated network attackers to execute arbitrary PHP on the server by submitting a crafted POST request to a vulnerable form. The _save_data() function fails to validate the 'thisPermalink' POST field before it overwrites a trusted callable placeholder, which is then passed unsanitized to call_user_func(). Exploitation is conditional on a specific form configuration (see exploitation_conditions), reflected in the CVSS AC:H rating; no public exploit code or CISA KEV listing has been identified at time of analysis.

Arbitrary code execution in the Hugging Face sentence-transformers Python library allows attackers who control the contents of a model directory to run code even when the caller explicitly passes trust_remote_code=False. The import_module_class helper in sentence_transformers/util/misc.py short-circuits its trust gate with an 'or os.path.exists(model_name_or_path)' clause, so any local path that exists satisfies the check and triggers dynamic loading of custom Python (e.g. modeling_*.py referenced in modules.json) at model-load time. This is classic CWE-94 code injection with no public exploit identified at time of analysis; the vendor commit deprecates rather than removes the behavior, deferring the actual fix to v6.0.

Code injection in the Savon Ruby SOAP client (rubygems/savon versions 0.9.8 through 2.17.1) enables arbitrary Ruby code execution in the application process when `Savon::Model.all_operations` is called with an attacker-controlled WSDL document. WSDL operation names are interpolated directly into Ruby source strings passed to `module_eval`, allowing an attacker who serves or intercepts a malicious WSDL to escape the generated method definition and execute arbitrary code. No public exploit identified at time of analysis, though a proof-of-concept was confirmed during responsible disclosure; vendor patch was released as version 2.17.2.

Remote code execution in Logsign SIEM (all versions before 6.4.108) allows unauthenticated network attackers to inject and execute arbitrary code, as tracked under CVE-2026-17561 (CWE-94, Code Injection). Reported through Turkey's national CERT (USOM), the flaw carries a critical CVSS 9.8 with a fully remote, no-privilege, no-interaction vector, meaning a single crafted request can compromise the appliance. No public exploit code has been identified at time of analysis and it is not listed in CISA KEV, but the low-complexity unauthenticated profile makes it a high-priority patch.

Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.

Remote code execution in the ElementsKit Elementor Addons WordPress plugin before 3.10.01 allows an authenticated administrator to inject arbitrary PHP code into server-side execution by crafting a malicious custom widget definition. The plugin writes this definition verbatim into a generated PHP file and subsequently executes it without sanitization. The critical escalation scenario occurs on WordPress multisite networks, where a subsite Administrator - ordinarily barred from file or code editing - can exploit this flaw to achieve host-level code execution, bypassing the privilege boundaries the network enforces. A publicly available exploit exists; no confirmed active exploitation (CISA KEV) at time of analysis.

Remote code execution is claimed in Hugo Leisink's Hiawatha web server version 12.1 and earlier, reachable by an unauthenticated attacker sending a single crafted HTTP request (CVSS 9.8, CWE-94). Notably, the primary referenced research (fenrisk.com/hiawatha-http-smuggling) and the cited RFCs on chunked/message parsing indicate the underlying defect is HTTP request smuggling rather than classic code injection, so the RCE framing should be treated cautiously. Publicly available exploit code exists (SSVC 'poc'); this is not listed in CISA KEV, and EPSS is low at 0.36% (29th percentile).

Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execute arbitrary code on the underlying host by supplying malicious user-controlled code that is improperly validated (CWE-94). Because Langflow evaluates user-supplied code as part of its low-code AI/agent flow-building functionality, exploitation grants full compromise of the server hosting the application. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score of 9.9 with a scope change reflects that a successful attack can break out of the application context to affect other system components.

Remote code execution in SGLang (versions ≤ v0.5.15) allows attackers to achieve arbitrary code execution through the optional dumper subsystem, escaping the intended sandbox when DUMPER_SERVER_PORT is configured. The flaw is code injection (CWE-95) triggered via inference requests, carrying a CVSS 9.8 with SSVC noting proof-of-concept exploit code and automatable exploitation. Currently there is publicly available exploit code exists per the CERT/CC disclosure, though EPSS remains low at 0.17% (7th percentile), and it is not listed in CISA KEV.

Arbitrary code execution in the Banks Python LLM-templating library (versions prior to 2.4.3) allows an attacker who can influence Tool JSON definitions within a {% completion %} block to run any importable Python callable in the host process. Banks resolves the attacker-controlled import_path field via importlib.import_module() plus getattr() with no allowlist, so values like os.system or subprocess.getoutput become invokable when the LLM emits a matching tool_calls entry, passing decoded arguments as kwargs. No public exploit identified at time of analysis; this bug is explicitly distinct from and unfixed by the 2.4.2 SandboxedEnvironment patch (GHSA-gphh-9q3h-jgpp / CVE-2026-44209) because the malicious payload is plain text in the rendered body and never touches Jinja attribute access.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.1 stems from improper input validation in the PythonREPL sandbox, allowing a low-privileged authenticated user to escape the sandbox and run arbitrary Python. Because the flaw carries a scope-changing CVSS 3.1 score of 9.9 (S:C, C/I/A all High), a successful exploit can compromise the underlying host beyond the intended sandbox boundary. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.

Improper input neutralization in Phoenix Contact CHARX SEC electric-vehicle charging controllers lets a remote, unauthenticated attacker inject malicious data through MQTT that the bundled ModbusServer application processes without validation, corrupting Modbus data and disrupting service. All CHARX SEC-3000/3050/3100/3150 units running firmware 1.0.0 through 1.9.0 are affected, with impact limited to integrity and availability (no data disclosure). No public exploit identified at time of analysis; the flaw was coordinated-disclosure reported through CERT@VDE and a fixed firmware (1.9.1) is available.

PHP object injection in the Remote API WordPress plugin (all versions through 0.2) lets unauthenticated attackers deserialize attacker-supplied input, and when a suitable gadget chain is available it escalates to remote code execution on the host. The flaw stems from the plugin processing serialized user input before any authentication check. Publicly available exploit code exists (WPScan), though EPSS remains low (0.25%, 17th percentile) and it is not listed in CISA KEV.

Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 allows a remote attacker to run arbitrary code within the browser by luring a victim to a crafted HTML page. The flaw stems from an inappropriate implementation in the Enterprise component and is classed as CWE-94 code injection. No public exploit identified at time of analysis, exploitation requires user interaction (visiting a malicious page), and EPSS risk is low at 0.26% (17th percentile).

Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can create Flow/Output custom resources to break out of the generated fluent.conf and achieve remote code execution inside the shared Fluentd aggregator. Because the FluentRender renderer writes CRD values (e.g. record_transformer records) into the config without escaping newlines, an attacker injects a `<match **>` block using the core `@type exec` plugin to run arbitrary commands. A working proof-of-concept is published in the GitHub advisory (GHSA-mjqf-28ph-426h); publicly available exploit code exists, but there is no CISA KEV listing indicating active exploitation.

Code injection in swagger-typescript-api (npm) versions <= 13.12.1 allows an attacker who controls an OpenAPI specification to achieve arbitrary code execution in the environment that consumes the generated client. Because OpenAPI path keys are interpolated raw into a JavaScript template literal in every generated method, a path containing a ${...} expression becomes live JS that runs with full process privileges on each call to the affected method. Publicly available exploit code exists (detailed reproducer against 13.12.1 on Node v24), but there is no public evidence of active exploitation; the flaw is fixed in 13.12.2.

Arbitrary code execution in swagger-typescript-api (npm, versions <= 13.12.1) occurs because the generator interpolates the OpenAPI spec's servers[0].url raw into the generated fetch HttpClient's `public baseUrl` field initializer with no escaping. An attacker who controls the spec can close the string literal and declare a `static` class field whose IIFE runs at class-definition time, so merely importing the generated module - no instantiation, no method call - executes attacker code with the importer's privileges. There is no CISA KEV listing, but publicly available exploit code exists (a self-contained, tested PoC) demonstrating exfiltration of /etc/passwd on a bare import; the vendor fixed it in 13.12.2.

Remote code execution in the StyleMixThemes Cost Calculator Builder PRO WordPress plugin (versions up to and including 4.0.3) lets unauthenticated attackers run arbitrary PHP on the server by injecting non-word XOR gadgets into the orderDetails[*].originalValue field, which is passed verbatim into a PHP eval() call inside js_to_php(). The only gate is a nonce, but that nonce is printed on every front-end page via wp_head, so any anonymous visitor can retrieve it, effectively removing the authentication barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.8 rating and trivial nonce bypass make this a high-priority, pre-authentication server-takeover flaw.

Unauthenticated remote code execution in the Streamit WordPress theme (versions up to and including 4.5.0) stems from a missing-authorization AJAX endpoint that invokes an attacker-supplied PHP function with attacker-supplied arguments, letting unauthenticated attackers create administrator accounts and run arbitrary code. Reported by WPScan and tracked as EUVD-2026-50115, it carries a CVSS 9.8 and publicly available exploit code exists, though there is no public exploit identified as being used in active attacks at time of analysis.

Code injection in datamodel-code-generator 0.17.0–0.60.1 allows attackers who control a schema’s default_factory value to inject arbitrary Python expressions into generated models, achieving remote code execution when the target imports the poisoned module. The vulnerability affects all supported input types (JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, XSD) and output model types (Pydantic v2, dataclass, msgspec). Public exploit code exists; the issue is fixed in version 0.60.2.

Code injection via unescaped validator entries in datamodel-code-generator's --extra-template-data feature allows arbitrary Python code execution when a generated Pydantic v2 model is imported. Affects versions 0.52.1 through 0.60.1, with a fix in 0.60.2. Publicly available exploit code exists, though no active exploitation has been reported to CISA KEV.

Code injection via unsanitized schema extensions in datamodel-code-generator allows arbitrary Python code execution when the generated model is imported. Affects versions from 0.11.6 to 0.63.0. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV.

Code injection in datamodel-code-generator versions before 0.60.1 allows an attacker who provides a malicious GraphQL schema to execute arbitrary Python code when a developer generates and imports the resulting model. The flaw exists because carriage return (\r) characters in Union type descriptions are not neutralized before being placed inside Python line comments, letting the rest of the description escape the comment and run as module‑level code upon import. A fix is available in version 0.60.1; no active exploitation is reported, and no public exploit is known.

Code injection in datamodel-code-generator allows an attacker who controls a JSON Schema to embed arbitrary Python code in generated model files, leading to arbitrary command execution when the module is imported. Affected versions 0.51.0 through 0.60.1 lack proper validation of the `x-python-type` extension, making the attack possible with default tool settings. No public exploit is identified at time of analysis, but the vulnerability is patched in version 0.60.2.

We are generating a synthetic analysis for CVE-2026-54654. We have a lot of data: description, CVSS, CWE, tags, references, GHSA advisory with detailed description, PoC, patch commit details, CPE. Need to produce JSON fields as instructed. Fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. Let's extract key info: - Product: "datamodel-code-generator" (pip package, from koxudaxi). Product name should be 1-3 words: "datamodel-code-generator". - Description: Code injection via unescaped carriage return in `--extra-template-data` comment field, fixed in 0.60.2. - CVSS: 7.8, vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE-94: Code Injection. - Tags: Python, RCE, Code Injection, Datamodel Code Generator. - KEV: not mentioned, assume not in KEV. POC: mentioned in advisory (secret gist). But we can't confirm if it's public or private secret gist; the advisory says "Complete self contained POC is available at my secret gist", so the reporter likely privately shared with maintainers? Or the link is there? Since the GHSA description says "PoC available at my secret gist: https://...", but the URL is there. It's a public gist? Might be public. But we don't have explicit POC=YES flag. The tags don't say POC available. Advisory text includes PoC section but the URL is given. Could be public. We'll treat as "publicly available exploit code exists" since the gist URL is embedded in the advisory and likely accessible to anyone who reads it. However, we must be careful: the description says "Complete self contained POC is available at my secret gist" - "secret" might indicate private. But it's in a public security advisory, so it's exposed. It's not a standard public POC, but I'll note it as possible public POC. The instructions say: if POC=YES but no

We are tasked with synthesizing a comprehensive analysis about CVE-2026-66745 from multiple sources, outputting a plain-text JSON. Let's go through each field. First, understand the CVE: Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) has a session fixation vulnerability. Unauthenticated attackers can set a known PHPSESSID on a victim's browser before authentication, and when the victim authenticates via fw.login.php, the attacker gains administrative session on port 9000. CVSS 4.0 vector given: AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. CWE-94 (Code Injection) is listed, but that seems odd for session fixation; maybe it's misattributed? But we'll use provided data. Tags: RCE, PHP, Code Injection, Artica Proxy. RCE? Session fixation doesn't give RCE directly; maybe there's more to it? Description only mentions session fixation leading to admin session hijack. Might be an error in tags. We'll stay factual. CPE: cpe:2.3:a:articatech:artica_proxy:*:*:*:*:*:*:*:* (all versions pre-fix). Patch: Available, with hotfix version 20260724-02 (provided). References: Articatech wiki, hotfixes page, VulnCheck advisory. Now we need to fill fields. product_name: "Artica Proxy" - that's the product, matches CPE. Only 1-3 words. Yes. summary: Start with specific impact verb and product. Not "A vulnerability..." So: "Administrative session hijacking in Artica Proxy before 4.50.000000 SP7 allows unauthenticated attackers to pre-set a session ID on a victim's browser, then wait for the victim to authenticate via fw.login.php, gaining full administrative control on port 9000. The vulnerability is a session fixation flaw with a CVSS 4.0 base score of 7.5. No exploitation evidence (KEV) or public POC is currently confirmed, but a hotfix is available." It says "session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions", so impact is administrative session hijack. So summary: "Administrative session h

Arbitrary command execution as root via udev property injection in sg3_utils when sg_inq --export parses a SCSI device with a crafted name string. Affects multiple Red Hat Enterprise Linux versions shipping sg3_utils. Publicly available exploit code exists as a proof-of-concept in the upstream fix; no active exploitation has been reported.

Authenticated remote code execution in Camaleon CMS 2.1.1 through 2.9.1 lets users who hold the custom_fields manage permission store an arbitrary Ruby expression in the 'command' option of a select_eval custom field, which is then evaluated via instance_eval inside an ERB view whenever a post edit page is rendered, yielding code execution with web-server process privileges. Publicly available exploit code exists (including a public proof-of-concept repository and writeup), but the flaw is not listed in CISA KEV and EPSS is modest at 0.74% (51st percentile), so practical risk concentrates on installations that delegate custom-field management to non-administrative roles. The vulnerability requires an authenticated principal with that permission (CVSS vector PR:L), and is not reachable by anonymous users.

Arbitrary command execution in WordPress Coding Standards (WordPressCS) before 3.4.1 lets attacker-controlled PHP source trigger code execution on the machine running the linter. The flawed WordPress.WP.EnqueuedResourceParameters sniff reconstructed the $ver argument of wp_enqueue_script()/wp_register_script() and passed it to eval(), so scanning a malicious file (for example a pull request in CI) with the WordPress or WordPress-Extra rulesets runs the attacker's payload. There is no public exploit identified at time of analysis and EPSS is low (0.18%), but the technical impact is total and a patched release (3.4.1) is available.

Remote code execution in Balbooa Forms prior to version 2.4.3 allows unauthenticated attackers to execute arbitrary PHP code on the Joomla server. Exploitation requires forms that include the signature field type, where insecure processing logic can be triggered via a crafted submission. No public exploit or active exploitation has been identified at the time of analysis.

Local privilege escalation in macOS before Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows an app to gain root privileges via an argument injection flaw. Apple has addressed the issue with improved validation, and no public exploit or active exploitation has been reported. The low attack complexity and full system compromise warrant immediate patching.

Arbitrary JavaScript execution in Cribl Stream before 4.18.2 allows authenticated attackers with edit privileges to run arbitrary code on the server via crafted database connection identifiers or pack configuration values. The vulnerability stems from improper code generation in the JSON Pointer-to-accessor compiler. No public exploit or active exploitation has been reported.

Remote code execution in vBulletin 5.x and 6.x allows unauthenticated attackers to execute arbitrary PHP code via a crafted request to the ajax/render endpoint. The vulnerability resides in the vB5_Template_Runtime::runMaths() method, where an insufficient regex filter can be bypassed using phpfuck-style encoding to inject and evaluate arbitrary PHP. Publicly available exploit code exists, and no CISA KEV listing was identified at the time of analysis, but the lack of authentication makes unpatched instances critically exposed.

Remote code execution in FacturaONE for WooCommerce plugin before version 5.37 allows unauthenticated attackers to write arbitrary files to a web-accessible directory and achieve code execution, because a request handler relies on an empty default cryptographic key and lacks authentication. Public exploit code is available.

Remote code execution in datamodel-code-generator prior to version 0.70.0 allows attackers who control input schemas to execute arbitrary Python code. By supplying a malicious customBasePath value containing embedded newlines and dot-free expressions, an attacker can inject code that executes when the generated module is imported. A patch is available in version 0.70.0; no public exploit is known at this time.

Remote code execution in OpenAM 16.1.1 and earlier allows unauthenticated attackers to execute arbitrary code via the /authservice endpoint by crafting XML that injects a malicious Java class, leading to full server compromise. The vulnerability, classified as CWE-94 (Code Injection), is rated Critical (CVSS 9.8) and has a publicly available patch. No exploitation in the wild or public exploit code has been confirmed at this time.

Improper certificate validation in epa4all's TLS handshake with the ePA backend allows a man-in-the-middle attacker who can intercept the connection to decrypt and manipulate all inner HTTP traffic, including patient consent decisions, medication data, and authorization tokens, and to inject arbitrary requests

Authenticated administrators can execute arbitrary OS commands on Microweber CMS through 2.0.20 by injecting unsandboxed Twig expressions into mail templates. The vulnerability allows full server compromise once an admin injects a payload, which auto-executes on every mail dispatch event. Public exploit code exists, though no active exploitation is confirmed.

Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute arbitrary PowerShell code on the server by injecting malicious variable values that are not escaped in the configuration file. No public exploit or active exploitation is known (EPSS 0.29%, SSVC exploitation: none), but the vulnerability has a critical CVSS score and the vendor has released a patch in version 2026.2.3.

Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to inject malicious PowerShell code. By crafting parameter names that are unsafe concatenated into a script invocation, an attacker can execute arbitrary commands on the underlying host. No public exploit or active exploitation is currently known, and EPSS indicates low exploit probability (0.29%).