cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 152

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 8.5CVE-2026-66658EPSS 0.4%

    Subscriber SQL Injection in Reviewer <= 3.14.2 versions.

  2. 8.1CVE-2026-66657EPSS 0.5%

    Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.

  3. 8.1CVE-2026-66656EPSS 0.5%

    Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.

  4. 7.1CVE-2026-66655EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.

  5. 8.1CVE-2026-66653EPSS 0.5%

    Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.

  6. 9.3CVE-2026-66478EPSS 0.4%

    Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.

  7. 9.3CVE-2026-66472EPSS 0.4%

    Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.

  8. 6.5CVE-2026-66471EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.

  9. 7.1CVE-2026-66468EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.

  10. 6.5CVE-2026-66467EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.

  11. 6.5CVE-2026-66460EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.

  12. 9.3CVE-2026-66458EPSS 0.4%

    Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.

  13. 6.5CVE-2026-66456EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.

  14. 8.1CVE-2026-66450EPSS 0.5%

    Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.

  15. 7.1CVE-2026-66449EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.

  16. 9.3CVE-2026-66446EPSS 0.4%

    Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.

  17. 9.3CVE-2026-66436EPSS 0.4%

    Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.

  18. 8.5CVE-2026-66430EPSS 0.4%

    Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

  19. 7.1CVE-2026-66429EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

  20. 7.1CVE-2026-66426EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.

  21. 7.1CVE-2026-65580EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.

  22. 7.1CVE-2026-61974EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.

  23. 9.3CVE-2026-61969EPSS 0.4%

    Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.

  24. 9.3CVE-2026-61966EPSS 0.4%

    Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.

  25. 7.1CVE-2026-61965EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

  26. 10.0CVE-2026-61962EPSS 0.7%

    Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.

  27. 7.1CVE-2026-61960EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.

  28. 7.1CVE-2026-28187EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.

  29. 6.5CVE-2026-28182EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.

  30. 7.1CVE-2026-28175EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.

  31. 7.1CVE-2026-28170EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.

  32. 8.5CVE-2026-28168EPSS 0.4%

    Subscriber SQL Injection in CubeWP <= 1.1.30 versions.

  33. 7.1CVE-2026-28158EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.

  34. 8.5CVE-2026-28156EPSS 0.4%

    Subscriber SQL Injection in Do Lasso <= 358 versions.

  35. 9.3CVE-2026-28142EPSS 0.4%

    Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.

  36. 7.1CVE-2026-28004EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

  37. 7.1CVE-2026-28003EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.

  38. 8.5CVE-2026-28002EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.

  39. 9.3CVE-2026-28001EPSS 0.4%

    Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

  40. 10.0CVE-2026-27544EPSS 0.9%

    Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.

  41. 7.1CVE-2026-27539EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.

  42. 7.5CVE-2026-27538EPSS 0.3%

    Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

  43. 6.5CVE-2026-27537EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

  44. 7.1CVE-2026-27536EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.

  45. 5.1CVE-2026-19716EPSS 0.5%

    Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, …

  46. 3.4CVE-2025-62315EPSS 0.2%

    HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or secu…

  47. 9.8CVE-2026-49827EPSS 0.9%

    WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Co…

  48. 8.8CVE-2026-15741EPSS 0.4%

    SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, …

  49. 5.3CVE-2026-73628EPSS 0.3%

    Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode(…

  50. 8.7CVE-2026-73625EPSS 0.7%

    GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictio…