#Code Injection
All CosmicBytez Labs articles tagged #Code Injection, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-108551: Code Injection in openapi-typescript-codegen Risks Supply Chain Compromise
A flaw in openapi-typescript-codegen lets malicious OpenAPI documents inject JavaScript into generated API clients, risking RCE.
- Security
CVE-2026-108259: TinaCMS CLI Code Injection via Unescaped Git Branch Name
TinaCMS CLI interpolates raw git branch names into generated JS, letting a crafted branch inject code during CI/CD builds.
- Security
CVE-2026-105812: AWS Bedrock AgentCore Starter Toolkit Code Injection Flaw
A critical flaw in AWS's Bedrock AgentCore Starter Toolkit lets an authenticated user inject arbitrary code via crafted agent-import configuration values.
- Security
CVE-2026-105135: InternLM MindSearch Planner Agent Code Injection
An unauthenticated code injection flaw in MindSearch's Planner Agent lets remote attackers execute arbitrary code via the /solve endpoint.
- Security
Ad Inserter Plugin Broken Access Control Enables Code Injection (CVE-2026-81655)
Ad Inserter for WordPress lets logged-in users as low as subscriber reach an unrestricted settings page and inject unfiltered code.
- Security
CVE-2026-78030: Perl DBI Loads Arbitrary Modules via DBD::DBM
DBI before 1.653 lets attacker-influenced dbm_type/dbm_mldbm connect attributes make Perl require() and execute an arbitrary file.
- Security
CVE-2026-93985: OpenPanel js-runtime Sandbox Escape to RCE
A webhook template validator flaw in OpenPanel js-runtime lets project users reach the Function constructor and run code in the worker process.
- Security
WP Recipe Maker Flaw Lets Attackers Run Shortcodes via Recipe Ratings
CVE-2026-89274 (CVSS 9.1) in WP Recipe Maker lets unauthenticated attackers trigger server-side shortcode execution through approved rating comments.
- Security
Forminator Forms Bug Lets Attackers Run Shortcodes via Quiz Parameter
CVE-2026-92229 (CVSS 9.1) in Forminator Forms lets unauthenticated attackers execute arbitrary shortcodes by abusing the quiz current_url parameter.
- Security
Critical Unauthenticated Hook Injection in ComboBlocks WordPress Plugin
ComboBlocks (Post Grid and Gutenberg Blocks) versions 2.2.32-2.3.1 let unauthenticated attackers inject dynamic action hooks, risking full RCE.
- Security
Critical Unauthenticated RCE in Hummingbird WordPress Plugin
A namespace-resolution bug leaves Hummingbird's debug log web-accessible and unsanitized, letting unauthenticated attackers plant PHP via a cookie.
- Security
CVE-2026-77009: Subscriber-to-RCE via Exposed Debug Console in WatchMan-Site7
A critical code injection flaw in WatchMan-Site7 lets any authenticated subscriber run arbitrary PHP through the plugin's unrestricted debug console.
- Security
CVE-2026-52490: Critical Code Injection in libtiff tiffcrop
CVSS 9.8 code injection in libtiff's tiffcrop.c allows unauthenticated remote code execution. No patch confirmed; PoC published.
- Security
CVE-2025-62593: Ray Project Code Injection — DNS Rebinding Enables Unauthenticated RCE
Critical RCE in Anyscale Ray via DNS rebinding attack bypasses User-Agent checks, exposing developer dashboards to unauthenticated job submission.
- Security
CVE-2026-9198: IBM Langflow Code Injection Vulnerability
A critical unauthenticated code injection flaw in Langflow 1.0.0–1.10.0 allows attackers to chain two API endpoints to obtain a SUPERUSER token and...
- Security
CVE-2026-17561: Critical Code Injection in Logsign SIEM
A critical code injection vulnerability in Logsign SIEM (CVSS 9.8) allows unauthenticated remote code execution on affected systems running versions prior...
- Security
WordPress Helpdesk Plugin Unauthenticated Code Injection — CVE-2026-15011
A critical unauthenticated PHP code injection vulnerability in the Customer Support Ticket System & Helpdesk WordPress plugin allows attackers to execute...
- Security
CVE-2026-47867: Remote Code Execution via Code Injection in VMware Avi Load Balancer
A CVSS 8.7 code injection vulnerability in VMware Avi Load Balancer enables high-privileged authenticated attackers to execute arbitrary code on the...
- Security
CVE-2026-47869: Second RCE Code Injection Path in VMware Avi Load Balancer
Broadcom discloses a second CVSS 8.7 code injection vulnerability in VMware Avi Load Balancer. CVE-2026-47869 shares the same vector and impact as...
- Security
CVE-2026-12866: expr-eval npm Package Enables Arbitrary Code Execution via toJSFunction()
All versions of the expr-eval JavaScript package are vulnerable to remote code execution through the toJSFunction() API. Crafted expressions escape the...
- Security
CVE-2026-49774: RD Station WordPress Plugin Remote Code Injection (CVSS 9.9)
A critical code injection vulnerability in the RD Station WordPress plugin allows unauthenticated remote code execution through Remote File Inclusion,...
- Security
CVE-2026-34263 — SAP Commerce Cloud Unauthenticated RCE
A critical unauthenticated remote code execution vulnerability in SAP Commerce Cloud allows any unauthenticated user to upload malicious configurations...
- Security
CVE-2026-39440: FunnelFormsPro WordPress Plugin Remote Code
A critical code injection vulnerability in the FunnelFormsPro WordPress plugin through version 3.8.1 allows remote code inclusion, enabling attackers to...
- Security
CVE-2026-41229 — Froxlor PHP Code Injection via MySQL
A critical PHP code injection vulnerability in Froxlor allows an admin with change_serversettings permission to inject arbitrary PHP code via unescaped...
- News
Actively Exploited Apache ActiveMQ Flaw Impacts 6,400
Shadowserver found over 6,400 Apache ActiveMQ servers exposed online and vulnerable to ongoing attacks exploiting a high-severity code injection...
- Security
CVE-2026-32613: Spinnaker Echo Spring Expression Language
A critical code injection flaw in Spinnaker's Echo service allows unrestricted Spring Expression Language (SPeL) execution via artifact processing,...
- Security
CVE-2026-39918: Vvveb CMS Unauthenticated PHP Code
Vvveb CMS versions prior to 1.0.8.1 allow unauthenticated attackers to inject arbitrary PHP code through the installation endpoint's unsanitized subdir...
- Security
CVE-2026-25776: Movable Type Critical Code Injection (CVSS
Six Apart's Movable Type CMS contains a critical code injection vulnerability allowing unauthenticated attackers to execute arbitrary Perl scripts on...
- Security
CVE-2026-39890: PraisonAI YAML Injection Achieves Remote
A critical code injection vulnerability in PraisonAI's AgentService allows attackers to craft malicious YAML files using dangerous js-yaml tags such as...
- Security
CVE-2026-1340: Ivanti EPMM Code Injection Vulnerability
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the Android File Transfer module allowing unauthenticated remote code...
- Security
CVE-2025-54068: Laravel Livewire Code Injection
A critical code injection vulnerability in Laravel Livewire v3 allows unauthenticated remote attackers to execute arbitrary commands. Over 130,000...
- Security
CVE-2025-32432: Craft CMS Code Injection Vulnerability
A critical code injection vulnerability in Craft CMS allows unauthenticated remote attackers to execute arbitrary code on affected servers. Added to...