cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 140

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 8.6CVE-2026-76635EPSS 0.4%

    baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence …

  2. 4.8CVE-2026-64972EPSS 0.4%

    ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribute value, and append a new event handler such as onload. The re…

  3. 4.8CVE-2026-64971EPSS 0.5%

    ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported a…

  4. 5.1CVE-2026-64970EPSS 0.5%

    ATutor is vulnerable to Stored Cross Site Scripting in registration functionality.  An attacker can register a new account and enter a JavaScript payload in the phone field during registration. When any authenticated user visits the attack…

  5. 7.6CVE-2026-74011EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9.

  6. 9.8CVE-2026-18482EPSS 3.4%

    Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled abs…

  7. 7.7CVE-2026-77084EPSS 0.7%

    n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node ope…

  8. 8.7CVE-2026-77080EPSS 0.6%

    n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snow…

  9. 7.2CVE-2026-77077EPSS 0.6%

    n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an…

  10. 8.4CVE-2026-77075EPSS 0.5%

    n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL …

  11. 6.0CVE-2026-77074EPSS 0.4%

    n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blin…

  12. 8.4CVE-2026-77072EPSS 0.3%

    n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redir…

  13. 7.1CVE-2026-77071EPSS 0.6%

    n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value withou…

  14. 8.5CVE-2026-74013EPSS 0.4%

    Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.

  15. 8.5CVE-2026-73998EPSS 0.4%

    Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.

  16. 9.9CVE-2026-73992EPSS 0.8%

    Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.

  17. 6.5CVE-2026-73402EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.

  18. 9.3CVE-2026-68566EPSS 0.4%

    Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.

  19. 7.1CVE-2026-68564EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.

  20. 9.3CVE-2026-66680EPSS 0.4%

    Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.

  21. 7.1CVE-2026-66673EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.

  22. 9.3CVE-2026-66649EPSS 0.4%

    Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.

  23. 7.1CVE-2026-66616EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.49.

  24. 7.1CVE-2026-66615EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.

  25. 7.1CVE-2026-66614EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.

  26. 7.1CVE-2026-66612EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.

  27. 7.1CVE-2026-66611EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.

  28. 9.3CVE-2026-66609EPSS 0.4%

    Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.

  29. 7.1CVE-2026-66607EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.

  30. 7.1CVE-2026-66606EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.

  31. 7.1CVE-2026-66605EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.

  32. 7.1CVE-2026-66604EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.

  33. 6.5CVE-2026-66601EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.

  34. 7.1CVE-2026-66598EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.

  35. 7.1CVE-2026-66597EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.

  36. 8.5CVE-2026-66594EPSS 0.4%

    Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.

  37. 9.3CVE-2026-66593EPSS 0.4%

    Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.

  38. 9.3CVE-2026-66592EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Blind SQL Injection.This issue affects rtMedia for Word…

  39. 7.1CVE-2026-66590EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.

  40. 6.6CVE-2026-66586EPSS 0.4%

    Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

  41. 7.1CVE-2026-66582EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.

  42. 7.1CVE-2026-66581EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.

  43. 8.1CVE-2026-28150EPSS 0.5%

    Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.

  44. 9.3CVE-2025-15688EPSS 0.4%

    Unauthenticated SQL Injection in Capella <= 2.5.5 versions.

  45. 8.1CVE-2025-15637EPSS 0.5%

    Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.

  46. 5.3CVE-2026-76569EPSS 0.4%

    Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4

  47. 5.3CVE-2026-76565EPSS 0.4%

    Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7

  48. 8.6CVE-2026-76564EPSS 0.4%

    Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

  49. 8.6CVE-2026-75948EPSS 0.4%

    Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fields as raw strings with no output-side HTML-attribute escaping.

  50. 5.1CVE-2026-71368EPSS 0.3%

    F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed.