cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 131

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 9.1CVE-2026-77542EPSS 1.3%

    A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device.

  2. 9.1CVE-2026-77540EPSS 1.3%

    A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.

  3. 9.1CVE-2026-77539EPSS 1.3%

    A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.

  4. 10.0CVE-2026-77537EPSS 1.6%

    A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.

  5. 9.1CVE-2026-77535EPSS 1.3%

    A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device.

  6. 6.4CVE-2026-2388EPSS 0.4%

    The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wp_display() shortcode handler, used by multiple shortcodes, allowing …

  7. 8.8CVE-2026-19042EPSS 1.8%

    A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the …

  8. 8.8CVE-2026-80236EPSS 0.5%

    Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents.

  9. 9.9CVE-2026-77533EPSS 1.4%

    A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.

  10. 6.3CVE-2026-9668EPSS 0.8%

    With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded qu…

  11. 7.8CVE-2026-78237EPSS 0.2%

    Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended.

  12. 6.4CVE-2026-6178EPSS 0.4%

    The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attr…

  13. 7.5CVE-2026-18884EPSS 0.5%

    The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lac…

  14. 6.4CVE-2026-3002EPSS 0.3%

    The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all versions up to, and including, 4.0.2 due to insufficient input sanitization …

  15. 7.2CVE-2026-18331EPSS 0.5%

    The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due…

  16. 5.5CVE-2026-77790EPSS 0.3%

    The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.

  17. 7.2CVE-2026-74851EPSS 0.7%

    The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the rest…

  18. 7.2CVE-2026-19760EPSS 0.4%

    The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. Th…

  19. 6.8CVE-2026-19226EPSS 0.4%

    The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Si…

  20. 5.3CVE-2026-19094EPSS 0.4%

    The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answe…

  21. 8.6CVE-2026-80214EPSS 0.5%

    LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server.

  22. 2.0CVE-2026-80201EPSS 0.2%

    Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls…

  23. 8.4CVE-2026-76148EPSS 0.2%

    CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.

  24. 7.8CVE-2026-57170EPSS 0.2%

    Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse…

  25. 9.2CVE-2026-80138EPSS 1.2%

    ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_f…

  26. 5.5CVE-2026-79912EPSS 2.1%

    A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection.…

  27. 5.4CVE-2026-55805EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0…

  28. 7.8CVE-2026-54757EPSS 0.4%

    Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead t…

  29. 5.7CVE-2026-18261EPSS 0.3%

    Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.

  30. 5.7CVE-2026-18260EPSS 0.4%

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

  31. 5.7CVE-2026-16643EPSS 0.3%

    Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.

  32. 5.7CVE-2026-16642EPSS 0.3%

    Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.

  33. 9.8CVE-2026-16641EPSS 0.5%

    Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.

  34. 6.1CVE-2026-16640EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.

  35. 6.1CVE-2026-16638EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.

  36. 4.7CVE-2026-15917EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.…

  37. 5.7CVE-2026-15088EPSS 0.3%

    Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.

  38. 5.5CVE-2026-79845EPSS 0.4%

    A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the file /InventoryManagement/edit.php. The manipulation of the argument ID leads to sql injection. The attack is possi…

  39. 5.5CVE-2026-79804EPSS 0.4%

    A vulnerability was found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. Affected by this issue is some unknown functionality of the file /search.php. Performing a manipulation of the argument sear…

  40. 9.8CVE-2026-65637EPSS 0.8%

    Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are …

  41. 5.4CVE-2026-38473EPSS 0.4%

    A Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, whi…

  42. 6.1CVE-2026-38472EPSS 0.4%

    A Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajax_get_…

  43. 5.4CVE-2026-38469EPSS 0.4%

    A Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonu…

  44. 4.3CVE-2026-38468EPSS 0.4%

    A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with users_view_ips privileges to execute arbitrary SQL co…

  45. 5.4CVE-2026-38467EPSS 0.3%

    A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with users_mod privileges to execute arbitrary SQL commands via the tagid …

  46. 5.4CVE-2026-38466EPSS 0.4%

    A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the remaster_cust…

  47. 5.4CVE-2026-38465EPSS 0.4%

    A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the avatar_mouse_o…

  48. 2.1CVE-2026-79793EPSS 0.5%

    A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sumit_form.php. Such manipulation of the argument Success leads to cross site scripti…

  49. 2.9CVE-2026-79792EPSS 1.6%

    A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py of the component Yt-dlp Download. This manipulation of the argument url causes …

  50. 6.5CVE-2026-79288EPSS 0.3%

    Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)