cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 13

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 7.8CVE-2026-51831EPSS 0.1%

    An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to execute arbitrary code via the id_service.exe component

  2. 5.3CVE-2026-118776EPSS 0.1%

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or sec…

  3. 7.2CVE-2026-11587EPSS 0.3%

    SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database

  4. 7.8CVE-2026-115805EPSS 0.2%

    Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges. Exploitation requires existing local access and depends on the Agent's inventory collec…

  5. 9.8CVE-2026-107050EPSS 0.5%

    An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution.

  6. 6.6CVE-2026-90872EPSS 0.3%

    Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to exec…

  7. 7.5CVE-2026-90869EPSS 0.4%

    A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.

  8. 9.9CVE-2026-90868EPSS 1.5%

    An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.

  9. 9.0CVE-2026-90865EPSS 1.1%

    An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.

  10. 5.3CVE-2026-66912EPSS 0.5%

    Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containi…

  11. 5.3CVE-2026-66911EPSS 0.5%

    Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticate…

  12. 8.5CVE-2026-61996EPSS 0.4%

    Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

  13. 7.1CVE-2026-61995EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.

  14. 7.1CVE-2026-61993EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.

  15. 10.0CVE-2026-61991EPSS 0.7%

    Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

  16. 7.1CVE-2026-61989EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.

  17. 7.1CVE-2026-61988EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.

  18. 7.1CVE-2026-54866EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.

  19. 6.5CVE-2026-54865EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.

  20. 7.1CVE-2026-54864EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.

  21. 4.3CVE-2026-42694EPSS 0.2%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.

  22. 7.1CVE-2026-42692EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.

  23. 7.1CVE-2026-27394EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.

  24. 9.8CVE-2026-18894EPSS 0.5%

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the…

  25. 5.9CVE-2026-119143EPSS 0.2%

    Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length …

  26. 2.1CVE-2026-119130EPSS 0.2%

    Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the co…

  27. 5.3CVE-2026-119121EPSS 0.3%

    Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css_selector and wait_for fields. A…

  28. 7.1CVE-2026-118085EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.

  29. 6.5CVE-2026-116848EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This is…

  30. 8.8CVE-2026-110309EPSS 0.6%

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.

  31. 8.8CVE-2026-110193EPSS 0.8%

    IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary oper…

  32. 9.8CVE-2026-110186EPSS 0.6%

    IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

  33. 7.1CVE-2026-108494EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.

  34. 8.8CVE-2026-107329EPSS 0.9%

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

  35. 8.8CVE-2026-107328EPSS 0.9%

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.

  36. 8.8CVE-2026-107326EPSS 0.7%

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  37. 9.8CVE-2026-104339EPSS 0.7%

    IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  38. 8.8CVE-2026-104328EPSS 0.7%

    IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  39. 4.3CVE-2026-104308EPSS 0.3%

    IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command.

  40. 8.8CVE-2026-101288EPSS 0.7%

    IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.

  41. 6.5CVE-2026-39742EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence…

  42. 6.5CVE-2026-39737EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.…

  43. 6.5CVE-2026-118097EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0.

  44. 6.5CVE-2026-118095EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a t…

  45. 6.5CVE-2026-116850EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a throug…

  46. 6.5CVE-2026-116849EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6.

  47. 6.5CVE-2026-115610EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.

  48. 6.5CVE-2026-114706EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.15.

  49. 6.5CVE-2026-110881EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.

  50. 6.5CVE-2026-54862EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export us…