cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 106

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 6.1CVE-2026-18562EPSS 0.4%

    The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficie…

  2. 7.5CVE-2026-18561EPSS 0.6%

    The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the la…

  3. 7.5CVE-2026-15462EPSS 0.5%

    The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() …

  4. 2.4CVE-2026-89145EPSS 0.2%

    Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin w…

  5. 7.7CVE-2026-17176EPSS 15%

    An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation ma…

  6. 8.8CVE-2026-82099EPSS 0.8%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  7. 8.8CVE-2026-82098EPSS 0.8%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  8. 8.8CVE-2026-82095EPSS 0.8%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  9. 8.8CVE-2026-81940EPSS 0.8%

    IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.

  10. 8.8CVE-2026-81550EPSS 0.8%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  11. 9.8CVE-2026-81204EPSS 0.9%

    IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction.

  12. 8.8CVE-2026-79742EPSS 0.9%

    IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist.

  13. 9.8CVE-2026-79724EPSS 0.7%

    IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

  14. 8.8CVE-2026-78575EPSS 0.8%

    IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration.

  15. 8.8CVE-2026-78571EPSS 0.8%

    IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.

  16. 8.8CVE-2026-78569EPSS 0.7%

    IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner.

  17. 5.9CVE-2026-49838EPSS 0.4%

    GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a …

  18. 5.4CVE-2026-36392EPSS 0.2%

    FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user …

  19. 7.8CVE-2026-2310EPSS 0.3%

    IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information o…

  20. 7.1CVE-2026-9176EPSS 0.2%

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected re…

  21. 6.5CVE-2026-89089EPSS 0.4%

    A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user (ROLE_USER) can run the shipped, default-enabled online reports "Ma…

  22. 4.7CVE-2026-3096EPSS 0.3%

    The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the newly opened page, allowing interaction between the two browser contexts when navigat…

  23. 8.4CVE-2026-19136EPSS 1.1%

    A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially craf…

  24. 5.4CVE-2022-26962EPSS 0.2%

    Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name, username, or mrfAnnouncementNameparameter. A malicious user leveraging this vu…

  25. 9.5CVE-2026-88062ExploitEPSS 1.4%

    OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand val…

  26. 8.6CVE-2026-88060EPSS 0.4%

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server seri…

  27. 8.6CVE-2026-88058EPSS 0.3%

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server seri…

  28. 5.3CVE-2026-88057EPSS 0.4%

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compile…

  29. 5.5CVE-2026-88055EPSS 0.3%

    AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can store meta_page_title or meta_page_favicon through /api/admin/system-pr…

  30. 7.8CVE-2026-88052EPSS 0.2%

    Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in src/ccutil/unicharset.cpp trusts the declared unichar count as a loop bound and uses id as an unchecked index into the unichars vector. uni…

  31. 8.6CVE-2026-73698EPSS 0.6%

    FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString() method in DB/DP.php t…

  32. 8.6CVE-2026-73694EPSS 2.2%

    FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsan…

  33. 8.7CVE-2026-73693EPSS 2.7%

    FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in thei…

  34. 9.5CVE-2026-65639EPSS 1.4%

    OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied …

  35. 9.2CVE-2026-65638EPSS 2.3%

    Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of …

  36. 9.8CVE-2026-52098EPSS 1.1%

    An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/<flowId> endpoint

  37. 6.8CVE-2026-52097EPSS 0.5%

    An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, localPathRegex (common_patterns.dart) components

  38. 7.2CVE-2026-81468EPSS 2.0%

    Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit …

  39. 9.8CVE-2026-81467EPSS 3.0%

    Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit…

  40. 8.8CVE-2026-81048EPSS 2.4%

    Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploi…

  41. 8.7CVE-2026-79987EPSS 0.6%

    A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

  42. 7.1CVE-2026-84819EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.

  43. 7.1CVE-2026-84816EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.

  44. 7.5CVE-2026-81803EPSS 0.6%

    Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.

  45. 9.3CVE-2026-81800EPSS 0.4%

    Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.

  46. 7.1CVE-2026-81795EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter &#8211; Lite <= 1.2.3 versions.

  47. 6.5CVE-2026-81791EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.

  48. 6.5CVE-2026-81782EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions.

  49. 6.5CVE-2026-66632EPSS 0.3%

    Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.

  50. 5.1CVE-2026-88921EPSS 0.5%

    MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references (attributes, objects, and tags) into inline HTML during PDF report export via the conve…