cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 162

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 6.5CVE-2026-64663EPSS 0.4%

    Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose template…

  2. 8.6CVE-2026-63725EPSS 0.4%

    sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this->path directly into the command line ('tar czf …

  3. 5.4CVE-2026-54717EPSS 0.3%

    Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb tra…

  4. 5.3CVE-2026-50159EPSS 0.6%

    Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied cl…

  5. 5.1CVE-2026-49391EPSS 0.5%

    Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that e…

  6. 8.1CVE-2026-48081EPSS 0.2%

    OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `javascript:` URLs in the tenant `links` configuration (`website`, `imprint`, `pri…

  7. 8.8CVE-2026-48054EPSS 0.6%

    OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts…

  8. 5.1CVE-2026-47185EPSS 0.4%

    Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's…

  9. 4.8CVE-2026-45572EPSS 0.3%

    Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML conte…

  10. 8.3CVE-2026-19177EPSS 0.3%

    Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium securit…

  11. 8.8CVE-2026-19169EPSS 0.3%

    Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)

  12. 9.6CVE-2026-19164EPSS 0.3%

    Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

  13. 8.1CVE-2026-19153EPSS 0.3%

    Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity…

  14. 8.6CVE-2026-19143EPSS 0.1%

    Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

  15. 1.9CVE-2026-19110EPSS 0.4%

    A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of t…

  16. 2.1CVE-2026-19071EPSS 0.3%

    A flaw has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewappointment.php. This manipulation of the argument delid causes sql injection. It is possible to initiate the attack rem…

  17. 2.1CVE-2026-19070EPSS 0.3%

    A vulnerability was detected in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewadmin.php. The manipulation of the argument delid results in sql injection. The attack may be performed from rem…

  18. 2.1CVE-2026-19069EPSS 0.3%

    A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /treatmentrecord.php. The manipulation of the argument editid leads to sql injection. The attack is pos…

  19. 2.1CVE-2026-19068EPSS 0.3%

    A weakness has been identified in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /treatmentdetail.php. Executing a manipulation of the argument patientid can lead to sql injection. The …

  20. 2.1CVE-2026-19067EPSS 0.3%

    A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Performing a manipulation of the argument editid results in sql injection. Remote e…

  21. 5.5CVE-2026-19062EPSS 0.4%

    A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.action. The manipulation of the argument zuname leads to sql injection. The attack…

  22. 1.9CVE-2026-19060EPSS 0.2%

    A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This impacts an unknown function. Such manipulation leads to code injection. The attack needs to be performed locally. The exploit is publicly available and might be u…

  23. 1.9CVE-2026-19058EPSS 0.2%

    A vulnerability was found in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function DataInterpreter of the file metagpt/roles/di/data_interpreter.py. The manipulation results in code injection. The attack must be initia…

  24. 9.8CVE-2026-15733ExploitEPSS 10%

    A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root.

  25. 4.8CVE-2026-15256EPSS 0.2%

    The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitr…

  26. 5.3CVE-2026-15149EPSS 0.3%

    The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to cre…

  27. 2.7CVE-2026-14225EPSS 0.3%

    The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire str…

  28. 4.3CVE-2025-6508EPSS 0.3%

    The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malic…

  29. 6.8CVE-2024-6541EPSS 0.3%

    The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations …

  30. 8.8CVE-2024-39024EPSS 0.8%

    In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution.

  31. 2.3CVE-2026-68747EPSS 0.4%

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an …

  32. 8.6CVE-2026-3430EPSS 0.4%

    The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail.

  33. 1.9CVE-2026-19047EPSS 1.1%

    A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component ludus_cli_execute. Performing a manipulation of t…

  34. 9.8CVE-2026-67261EPSS 2.3%

    Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability,…

  35. 7.1CVE-2026-66711EPSS 0.3%

    Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.

  36. 8.1CVE-2026-66710EPSS 0.5%

    Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.

  37. 9.1CVE-2026-66709EPSS 0.8%

    Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.

  38. 7.1CVE-2026-66707EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.

  39. 5.9CVE-2026-66706EPSS 0.2%

    Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.

  40. 7.1CVE-2026-66705EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.

  41. 6.5CVE-2026-66703EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.

  42. 7.1CVE-2026-66702EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.

  43. 7.1CVE-2026-66694EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.

  44. 7.1CVE-2026-66690EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.

  45. 6.5CVE-2026-66688EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.

  46. 7.1CVE-2026-66664EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.

  47. 7.1CVE-2026-66663EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.

  48. 7.1CVE-2026-66457EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.

  49. 9.3CVE-2026-66447EPSS 0.4%

    Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.

  50. 7.1CVE-2026-66440EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.