cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 145

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 4.8CVE-2026-71572EPSS 0.2%

    Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-…

  2. 7.5CVE-2026-63337EPSS 0.6%

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system…

  3. 6.3CVE-2026-63335EPSS 0.5%

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processe…

  4. 0.0CVE-2026-61634EPSS 0.5%

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP frame_max value, but src/main/java/com/rab…

  5. 6.1CVE-2026-52606EPSS 0.3%

    A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjuncti…

  6. 6.8CVE-2026-50576EPSS 0.5%

    ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUP…

  7. 6.1CVE-2026-30250EPSS 0.4%

    Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute arbitrary code

  8. 8.3CVE-2026-75912EPSS 0.4%

    CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values l…

  9. 8.5CVE-2026-75911EPSS 0.2%

    CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml f…

  10. 8.5CVE-2026-75858EPSS 0.4%

    CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats…

  11. 7.1CVE-2026-73073EPSS 0.2%

    Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, a…

  12. 8.7CVE-2026-55839EPSS 0.4%

    Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScr…

  13. 5.3CVE-2026-45125EPSS 0.4%

    MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do_emailuser accepts the fromname HTTP parameter for gu…

  14. 9.3CVE-2026-45118EPSS 0.5%

    MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirec…

  15. 9.8CVE-2026-45117EPSS 1.1%

    MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote …

  16. 8.7CVE-2026-45116EPSS 0.4%

    MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fiel…

  17. 8.7CVE-2026-45115EPSS 0.4%

    MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy…

  18. 6.9CVE-2026-75872EPSS 0.7%

    HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's…

  19. 9.3CVE-2026-74015EPSS 0.4%

    Unauthenticated SQL Injection in Readabler < 2.0.18 versions.

  20. 4.6CVE-2026-73426EPSS 0.3%

    Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can cr…

  21. 8.1CVE-2026-73400EPSS 0.5%

    Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.

  22. 7.1CVE-2026-73393EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

  23. 7.1CVE-2026-73382EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.2.0.

  24. 7.1CVE-2026-73378EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.

  25. 7.1CVE-2026-73375EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

  26. 9.3CVE-2026-73365EPSS 0.4%

    Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.

  27. 7.1CVE-2026-73362EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.

  28. 7.1CVE-2026-73361EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.

  29. 7.1CVE-2026-73360EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.

  30. 6.5CVE-2026-73359EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.

  31. 7.1CVE-2026-73358EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.

  32. 9.3CVE-2026-73355EPSS 0.4%

    Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.

  33. 7.1CVE-2026-73351EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.

  34. 7.1CVE-2026-73345EPSS 0.3%

    Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.

  35. 10.0CVE-2026-73343EPSS 0.9%

    Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.

  36. 7.1CVE-2026-73342EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.

  37. 9.3CVE-2026-73339EPSS 0.4%

    Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.

  38. 7.1CVE-2026-73338EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.

  39. 7.1CVE-2026-73190EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7…

  40. 9.3CVE-2026-73187EPSS 0.4%

    Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.

  41. 2.0CVE-2026-68939EPSS 0.2%

    Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-versio…

  42. 7.1CVE-2026-68567EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Testing: from n/a thr…

  43. 6.5CVE-2026-68565EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.

  44. 8.8CVE-2026-66793EPSS 0.8%

    A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy …

  45. 7.1CVE-2026-66667EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.

  46. 6.5CVE-2026-66646EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.

  47. 6.5CVE-2026-66645EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.

  48. 6.5CVE-2026-66644EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.

  49. 6.5CVE-2026-66643EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.

  50. 6.5CVE-2026-66641EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.