cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 119

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 5.3CVE-2026-85453EPSS 0.3%

    MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing attackers to inject malicious scripts. Any MOOS publisher can set variable values containing script payloads that execute in the bro…

  2. 8.5CVE-2026-85439EPSS 0.5%

    MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in lo…

  3. 9.3CVE-2026-85426EPSS 0.9%

    MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process use…

  4. 9.3CVE-2026-85425EPSS 1.8%

    MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY_MOOS messages containing backticks or command substitut…

  5. 5.5CVE-2026-85225EPSS 0.4%

    A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_login.php. The manipulation of the argument email leads to sql injection. The attack may be initiat…

  6. 8.5CVE-2026-85224EPSS 3.6%

    A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/file_sharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command inj…

  7. 8.6CVE-2026-85223EPSS 3.3%

    A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback_url/sync_interval …

  8. 8.5CVE-2026-85222EPSS 3.6%

    A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of the component Add-On Center. Such manipulation of the argument f_name/f_url/f_fl…

  9. 10.0CVE-2026-85061EPSS 0.5%

    MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collecti…

  10. 2.0CVE-2026-85207EPSS 0.3%

    A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack…

  11. 9.6CVE-2026-85047EPSS 0.5%

    Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: …

  12. 8.7CVE-2026-82527EPSS 0.5%

    R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the filter key parameter in the retrieval search endpoint. Attackers can e…

  13. 8.6CVE-2026-85388EPSS 0.5%

    Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based an…

  14. 5.3CVE-2026-85205EPSS 0.3%

    A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?action=addwish of the component Wishlist. This manipulation of the argumen…

  15. 9.3CVE-2026-82526EPSS 0.7%

    R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is in…

  16. 4.3CVE-2026-78593EPSS 0.3%

    An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting i…

  17. 5.5CVE-2026-85187EPSS 0.4%

    A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&actions=confirm of the component Ord…

  18. 8.5CVE-2026-85012EPSS 2.3%

    Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in…

  19. 5.1CVE-2026-82024EPSS 0.2%

    LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz qu…

  20. 9.1CVE-2026-58400EPSS 1.2%

    GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and…

  21. 6.5CVE-2026-85303EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7.

  22. 6.5CVE-2026-85302EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a th…

  23. 7.1CVE-2026-84848EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.

  24. 9.3CVE-2026-84813EPSS 0.4%

    Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.

  25. 7.1CVE-2026-84812EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.

  26. 6.1CVE-2026-84774EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.

  27. 7.2CVE-2026-84773EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.

  28. 9.3CVE-2026-84768EPSS 0.4%

    Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.

  29. 7.1CVE-2026-84765EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.

  30. 7.1CVE-2026-84763EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.

  31. 7.1CVE-2026-81776EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.

  32. 7.1CVE-2026-81773EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.

  33. 7.1CVE-2026-81300EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.

  34. 7.1CVE-2026-81295EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.

  35. 7.1CVE-2026-81292EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.

  36. 6.5CVE-2026-81282EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.

  37. 6.5CVE-2026-81281EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.

  38. 7.1CVE-2026-85239EPSS 0.4%

    A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate() method only per…

  39. 5.5CVE-2026-85138EPSS 0.4%

    A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launch…

  40. 5.5CVE-2026-85137EPSS 0.5%

    A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack…

  41. 5.1CVE-2026-84967EPSS 0.3%

    A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated…

  42. 5.7CVE-2026-84962EPSS 0.2%

    An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and d…

  43. 8.6CVE-2026-71963EPSS 0.9%

    Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets cor…

  44. 5.3CVE-2026-85230EPSS 0.3%

    A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a r…

  45. 6.1CVE-2026-85227EPSS 0.3%

    MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML esc…

  46. 5.0CVE-2026-63694EPSS 0.8%

    Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A high privileged attacker with remote access could potentially exp…

  47. 5.1CVE-2026-56128EPSS 1.1%

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored …

  48. 5.1CVE-2026-56127EPSS 1.1%

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in…

  49. 5.1CVE-2026-56126EPSS 1.1%

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including g…

  50. 5.0CVE-2026-35160EPSS 0.8%

    Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentia…