cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 124

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 9.3CVE-2026-82971EPSS 3.3%

    A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attac…

  2. 5.5CVE-2026-82922EPSS 0.4%

    A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_update_cart of the file /flow.php?step=update_cart. The manipulation of the argument rec_id leads to sql injection. The a…

  3. 5.4CVE-2026-82396EPSS 0.3%

    Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its …

  4. 7.5CVE-2026-82393EPSS 0.6%

    pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for u…

  5. 4.6CVE-2026-77353EPSS 0.3%

    Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequen…

  6. 5.5CVE-2026-82914EPSS 0.4%

    A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch …

  7. 7.1CVE-2026-82229EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.

  8. 7.1CVE-2026-82224EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.

  9. 7.1CVE-2026-82221EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.

  10. 5.1CVE-2026-81887EPSS 0.7%

    Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotNotatedValueIntoData(), accepts the __pro…

  11. 6.5CVE-2026-81778EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.

  12. 7.1CVE-2026-81768EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.

  13. 7.1CVE-2026-81765EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.

  14. 7.1CVE-2026-81764EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.

  15. 9.3CVE-2026-81763EPSS 0.4%

    Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.

  16. 9.3CVE-2026-81756EPSS 0.4%

    Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.

  17. 7.1CVE-2026-81298EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.

  18. 9.3CVE-2026-81293EPSS 0.4%

    Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.

  19. 7.1CVE-2026-81291EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.

  20. 7.1CVE-2026-81290EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.

  21. 8.5CVE-2026-81287EPSS 0.4%

    Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.

  22. 9.8CVE-2026-79408EPSS 2.1%

    An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py.

  23. 4.4CVE-2026-54179EPSS 0.3%

    backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/Sing…

  24. 6.1CVE-2025-63607EPSS 0.3%

    TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser.

  25. 3.3CVE-2023-31308EPSS 0.1%

    A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read.

  26. 6.9CVE-2026-83492EPSS 0.4%

    Improper input validation vulnerability in Extend Themes Kubio AI Website Builder. This issue affects Kubio AI Website Builder: before 2.9.1.

  27. 2.1CVE-2026-82805EPSS 0.5%

    A vulnerability was found in Typora up to 1.13.8/1.14.6. This vulnerability affects unknown code of the component Mermaid Rendering Engine. The manipulation of the argument classDef/style results in cross site scripting. The attack may be …

  28. 7.1CVE-2026-75132EPSS 0.5%

    WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the `columns` parameter of the GET `/api/v3/hosts` endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expre…

  29. 5.4CVE-2026-51153EPSS 0.2%

    Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/<taskid>/run, the handler renders task log content (logtmp) into the HTML response using Pytho…

  30. 2.0CVE-2026-82703EPSS 2.9%

    A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component asp_setPing Endpoint. Performing a manipulation of the argument pingstr results in os com…

  31. 2.0CVE-2026-82702EPSS 2.9%

    A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component asp_WlanMP Endpoint. Such manipulation of the argument ateFunc leads to os command injection. It is possib…

  32. 5.5CVE-2026-82701EPSS 0.4%

    A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword cause…

  33. 9.3CVE-2026-59111EPSS 1.3%

    Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopaut…

  34. 2.1CVE-2026-82700EPSS 0.5%

    A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email …

  35. 8.6CVE-2026-78077EPSS 0.4%

    Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.11 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were re…

  36. 6.1CVE-2026-76986EPSS 0.6%

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no…

  37. 5.1CVE-2026-76985EPSS 0.5%

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display…

  38. 7.8CVE-2026-19702EPSS 0.8%

    Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus …

  39. 2.1CVE-2026-82696EPSS 0.3%

    A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be i…

  40. 8.6CVE-2026-82692EPSS 3.3%

    A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os comma…

  41. 8.8CVE-2026-5956EPSS 0.4%

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affects Site Management Panel: through 15062026.

  42. 8.5CVE-2026-82691EPSS 3.6%

    A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usb_device.cgi of the component CGI Handler. Such manipulation of t…

  43. 8.5CVE-2026-82690EPSS 3.6%

    A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve_mgr.cgi. This manipulation of the argument f_dev causes os command injection. The atta…

  44. 8.6CVE-2026-82689EPSS 3.3%

    A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIs…

  45. 5.1CVE-2026-76984EPSS 0.5%

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link> header tags. It escaped the attribute names it wrote, but ran the attribute values …

  46. 5.1CVE-2026-76983EPSS 0.5%

    Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The reso…

  47. 5.1CVE-2026-76982EPSS 0.5%

    Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag in its constructor, so that the value attribute it writes is not encoded twice — …

  48. 5.1CVE-2026-75802EPSS 0.5%

    AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for …

  49. 5.1CVE-2026-82881EPSS 0.3%

    Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat respon…

  50. 8.5CVE-2026-82688EPSS 3.6%

    A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-bin/virtual_vol.cgi of the component Virtual Volume Handler. The manipulation of …