cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 121

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 7.1CVE-2026-79991EPSS 0.5%

    Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect ag…

  2. 9.9CVE-2026-77009EPSS 0.5%

    The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.

  3. 5.4CVE-2026-2811EPSS 0.3%

    The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitr…

  4. 3.5CVE-2026-19698EPSS 0.3%

    The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitra…

  5. 6.6CVE-2026-10821EPSS 0.7%

    The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-crea…

  6. 3.5CVE-2025-15692EPSS 0.2%

    The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site…

  7. 5.9CVE-2024-3773EPSS 0.2%

    The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor ro…

  8. 5.3CVE-2026-81205EPSS 0.3%

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0…

  9. 6.1CVE-2026-81201EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.

  10. 4.8CVE-2026-81167EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.

  11. 6.1CVE-2026-81160EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0.

  12. 7.3CVE-2026-76782EPSS 0.3%

    Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.

  13. 7.3CVE-2026-76759EPSS 0.3%

    Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.

  14. 5.9CVE-2026-76758EPSS 0.3%

    Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*.

  15. 4.8CVE-2026-18986EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.

  16. 8.6CVE-2026-84803EPSS 0.4%

    SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, …

  17. 4.8CVE-2026-84793EPSS 0.3%

    Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute…

  18. 6.5CVE-2026-84781EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.

  19. 6.5CVE-2026-83562EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.

  20. 7.1CVE-2026-81775EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.

  21. 7.1CVE-2026-81771EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions.

  22. 7.1CVE-2026-81770EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions.

  23. 7.1CVE-2026-81289EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions.

  24. 7.1CVE-2026-81288EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.

  25. 9.3CVE-2026-81286EPSS 0.4%

    Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.

  26. 7.6CVE-2026-82958EPSS 0.4%

    In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message header…

  27. 6.1CVE-2026-32773EPSS 0.4%

    There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged…

  28. 7.2CVE-2026-75528EPSS 0.5%

    The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes…

  29. 8.8CVE-2026-14828EPSS 3.1%

    Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.

  30. 6.4CVE-2025-7963EPSS 0.3%

    The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywaveformplayer() function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escapi…

  31. 7.1CVE-2026-82883EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1.

  32. 6.4CVE-2026-3850EPSS 0.3%

    The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` parameter of the `et_pb_contact_form` shortcode in all versions up to, and including, 4.27.6. This is due to the `redirect_url` attribute bein…

  33. 4.1CVE-2026-82182EPSS 0.3%

    The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.

  34. 8.8CVE-2026-81807EPSS 0.5%

    The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone view…

  35. 8.8CVE-2026-81737EPSS 0.4%

    The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent…

  36. 7.5CVE-2026-77792EPSS 0.4%

    The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripti…

  37. 7.1CVE-2026-19723EPSS 0.3%

    The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Sit…

  38. 6.8CVE-2026-19719EPSS 0.4%

    The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform St…

  39. 5.3CVE-2026-19704EPSS 0.4%

    The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, com…

  40. 7.1CVE-2026-12865EPSS 0.3%

    The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so …

  41. 6.8CVE-2025-15664EPSS 0.4%

    The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role…

  42. 6.8CVE-2025-15663EPSS 0.4%

    The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role …

  43. 7.6CVE-2025-46418EPSS 0.7%

    Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.

  44. 6.4CVE-2026-3851EPSS 0.3%

    The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: (1) the save-time sanitizati…

  45. 8.6CVE-2026-19754EPSS 0.4%

    Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is tr…

  46. 2.0CVE-2026-84438EPSS 0.3%

    A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross s…

  47. 2.0CVE-2026-84437EPSS 0.3%

    A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address_1 result…

  48. 5.1CVE-2026-84701EPSS 0.3%

    NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in th…

  49. 9.3CVE-2026-84695EPSS 0.5%

    BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG…

  50. 8.7CVE-2026-84694EPSS 0.8%

    Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitra…