cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 146

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 6.5CVE-2026-66640EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.

  2. 6.5CVE-2026-66639EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.

  3. 6.5CVE-2026-66638EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.

  4. 6.5CVE-2026-66637EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.

  5. 6.5CVE-2026-66636EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise Chat: from n/a through 3.4.3.

  6. 7.1CVE-2026-66633EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

  7. 7.1CVE-2026-66629EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

  8. 7.5CVE-2026-66622EPSS 0.3%

    Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.

  9. 7.1CVE-2026-66621EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a…

  10. 8.8CVE-2026-50187EPSS 0.5%

    Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env …

  11. 8.3CVE-2026-45733EPSS 0.4%

    Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute e…

  12. 7.1CVE-2026-32547EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

  13. 8.5CVE-2026-32466EPSS 0.4%

    Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.

  14. 8.1CVE-2026-32464EPSS 0.5%

    Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.

  15. 9.9CVE-2026-32444EPSS 0.8%

    Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.

  16. 7.1CVE-2026-32333EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.

  17. 8.1CVE-2026-28570EPSS 0.5%

    Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.

  18. 7.1CVE-2026-28569EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.

  19. 7.1CVE-2026-28568EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

  20. 7.5CVE-2026-24301EPSS 1.1%

    Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

  21. 5.5CVE-2026-75778EPSS 0.4%

    A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select_with_multiple_condition of the file /index.php of the component Login Form. Such manipulation of the argument email lea…

  22. 5.1CVE-2026-75838EPSS 0.4%

    DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that exec…

  23. 5.1CVE-2026-75834EPSS 0.3%

    Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). All XSS detection patterns use the PCRE /u (UTF-8) modifier, so a single invalid UTF-8 byt…

  24. 5.1CVE-2026-75831EPSS 0.4%

    Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowi…

  25. 9.3CVE-2026-75828EPSS 0.4%

    Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like one…

  26. 9.3CVE-2026-75827EPSS 0.9%

    Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access …

  27. 5.1CVE-2026-75107EPSS 0.2%

    Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML…

  28. 5.1CVE-2026-74908EPSS 0.3%

    Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api…

  29. 9.3CVE-2026-74902EPSS 0.2%

    SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containin…

  30. 9.3CVE-2026-75626EPSS 0.3%

    SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts …

  31. 5.4CVE-2026-19447EPSS 0.2%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5.

  32. 6.3CVE-2026-43971EPSS 0.5%

    Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1. cow_link:do_link/1 in cowlib interpolates the target URI, rel value, and…

  33. 7.2CVE-2026-75091EPSS 0.3%

    The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. …

  34. 8.5CVE-2026-75094EPSS 3.2%

    A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command …

  35. 5.5CVE-2026-75089EPSS 0.4%

    A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file user/check_availability.php. This manipulation of the argument email causes sql injection. Remot…

  36. 2.1CVE-2026-75088EPSS 0.3%

    A vulnerability was determined in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewbilling.php. Executing a manipulation of the argument delid can lead to sql injection. The attack can be launc…

  37. 2.1CVE-2026-75087EPSS 0.3%

    A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /viewdepartment.php. Performing a manipulation of the argument delid results in sql injection. The attack can be initiat…

  38. 2.1CVE-2026-75086EPSS 0.3%

    A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewroom.php. Such manipulation of the argument delid leads to sql injection. It is possible to launch …

  39. 2.1CVE-2026-75082EPSS 0.4%

    A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument first_name/last_na…

  40. 5.5CVE-2026-75080EPSS 0.4%

    A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edit_subject1.php. The manipulation of the argument ID leads to sql injection. The …

  41. 5.5CVE-2026-75079EPSS 0.4%

    A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /edit_subject2.php. Executing a manipulation of the argument ID can lead to sql injection. The atta…

  42. 2.1CVE-2026-75078EPSS 0.5%

    A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exp…

  43. 7.8CVE-2026-67961EPSS 0.2%

    An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution.

  44. 9.8CVE-2026-67919EPSS 0.9%

    An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components

  45. 9.8CVE-2026-38165EPSS 0.9%

    A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression.

  46. 2.1CVE-2026-75077EPSS 0.5%

    A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. Th…

  47. 9.8CVE-2026-67960EPSS 0.7%

    An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components

  48. 9.8CVE-2026-67854EPSS 0.7%

    SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code

  49. 4.3CVE-2026-65340EPSS 0.6%

    This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may…

  50. 4.3CVE-2026-65337EPSS 0.6%

    This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may…