cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 143

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 7.4CVE-2026-18526EPSS 0.5%

    HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting (XSS) vulnerability in the oEmbed confirmation rendering workflow.

  2. 9.9CVE-2026-16816EPSS 0.8%

    IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  3. 9.9CVE-2026-15068EPSS 0.8%

    IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  4. 7.5CVE-2026-76240EPSS 0.4%

    stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a sche…

  5. 8.4CVE-2026-76233EPSS 1.0%

    Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write…

  6. 8.4CVE-2026-76232EPSS 1.0%

    Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository…

  7. 8.4CVE-2026-76231EPSS 1.0%

    Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with …

  8. 8.4CVE-2026-76230EPSS 1.0%

    Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository w…

  9. 8.4CVE-2026-76229EPSS 1.0%

    Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with rep…

  10. 8.4CVE-2026-76228EPSS 1.0%

    Renovate versions >=32.124.0 and before 42.68.5 (and Mend renovate-ce/renovate-ee before 13.3.0) contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wr…

  11. 6.8CVE-2026-76226EPSS 0.3%

    Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies th…

  12. 8.7CVE-2026-76224EPSS 0.9%

    ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java (gremlin-lang) engine, ArcadeGremlin.execu…

  13. 8.7CVE-2026-76221EPSS 0.5%

    GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. A…

  14. 8.7CVE-2026-76220EPSS 0.6%

    GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dic…

  15. 7.2CVE-2026-76219EPSS 0.5%

    GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option vali…

  16. 7.7CVE-2026-76218EPSS 0.7%

    GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execut…

  17. 6.9CVE-2026-76212EPSS 0.4%

    phpMyFAQ before 4.1.7, when configured to use PostgreSQL via the native pgsql PHP extension, declares an incorrect LIKE ESCAPE character ('=') in the Search/Database/Pgsql.php backend while escapeLikeWildcards() escapes user input with the…

  18. 8.6CVE-2026-76205EPSS 0.4%

    phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions…

  19. 9.3CVE-2026-75917EPSS 0.2%

    SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()) used by the 'move/link to' path-selection dialogs, where document meta…

  20. 9.3CVE-2026-75916EPSS 0.2%

    SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block's name, alias, and memo fields are concatenate…

  21. 9.3CVE-2026-74804EPSS 0.4%

    Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), w…

  22. 8.8CVE-2026-70422EPSS 0.4%

    Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit thi…

  23. 5.1CVE-2026-65612EPSS 0.4%

    nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victi…

  24. 5.1CVE-2026-65611EPSS 0.4%

    nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that dire…

  25. 8.8CVE-2026-56088EPSS 0.4%

    Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit thi…

  26. 7.2CVE-2026-54796EPSS 2.0%

    Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially expl…

  27. 8.8CVE-2026-54795EPSS 2.3%

    Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially explo…

  28. 9.9CVE-2026-51366EPSS 0.8%

    SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_chat parameter

  29. 7.8CVE-2026-43961EPSS 0.2%

    A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leverage…

  30. 9.8CVE-2026-16019EPSS 0.5%

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injection. This issue affects FAYDAM Datalogger: from 2.7.1 before 2.8.0.

  31. 8.4CVE-2024-58376EPSS 0.7%

    Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registry…

  32. 9.3CVE-2026-73391EPSS 0.4%

    Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.

  33. 9.3CVE-2026-73388EPSS 0.4%

    Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.

  34. 8.1CVE-2026-73387EPSS 0.5%

    Unauthenticated Local File Inclusion in Resido <= 1.5 versions.

  35. 7.1CVE-2026-73354EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.

  36. 9.3CVE-2026-73185EPSS 0.4%

    Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.

  37. 7.1CVE-2026-73184EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.

  38. 9.3CVE-2026-73183EPSS 0.4%

    Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.

  39. 7.1CVE-2026-73182EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.

  40. 10.0CVE-2026-67364EPSS 0.5%

    Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescap…

  41. 8.5CVE-2026-66668EPSS 0.4%

    Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.

  42. 7.1CVE-2026-66596EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions.

  43. 7.1CVE-2026-61986EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.

  44. 8.5CVE-2026-32552EPSS 0.4%

    Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.

  45. 4.8CVE-2026-18372EPSS 0.4%

    CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users.

  46. 5.1CVE-2026-18371EPSS 0.4%

    HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users.

  47. 7.2CVE-2026-75981EPSS 0.4%

    The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!tr…

  48. 7.2CVE-2026-15780EPSS 0.6%

    The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient …

  49. 6.4CVE-2026-15446EPSS 0.4%

    The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output …

  50. 7.1CVE-2026-19056EPSS 0.3%

    The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the se…