cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 163

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 7.1CVE-2026-66439EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.

  2. 8.5CVE-2026-65569EPSS 0.4%

    Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.

  3. 7.1CVE-2026-65565EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.

  4. 7.1CVE-2026-65560EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.

  5. 10.0CVE-2026-65553EPSS 0.9%

    Unauthenticated Remote Code Execution (RCE) in Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.

  6. 9.9CVE-2026-65548EPSS 0.8%

    Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.

  7. 9.3CVE-2026-65546EPSS 0.4%

    Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.

  8. 7.1CVE-2026-65545EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.

  9. 7.1CVE-2026-65544EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.

  10. 9.3CVE-2026-65520EPSS 0.4%

    Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

  11. 7.1CVE-2026-65517EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.

  12. 7.1CVE-2026-65515EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.

  13. 7.1CVE-2026-65513EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.

  14. 7.1CVE-2026-65509EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.

  15. 9.3CVE-2026-65508EPSS 0.4%

    Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.

  16. 7.1CVE-2026-61982EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.

  17. 7.1CVE-2026-61964EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.

  18. 7.1CVE-2026-61963EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.

  19. 7.1CVE-2026-61961EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.

  20. 6.5CVE-2026-61959EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.

  21. 9.3CVE-2026-53975EPSS 1.7%

    OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbat…

  22. 9.1CVE-2026-34191EPSS 0.6%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

  23. 5.9CVE-2026-28179EPSS 0.2%

    Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.

  24. 6.5CVE-2026-28178EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.

  25. 7.1CVE-2026-28177EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0.

  26. 7.1CVE-2026-28143EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

  27. 7.1CVE-2026-28141ExploitEPSS 0.5%

    Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.

  28. 7.1CVE-2026-28082EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.

  29. 1.9CVE-2026-19045EPSS 0.8%

    A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component get_credential_from_user. This manipulation of…

  30. 1.9CVE-2026-19044EPSS 0.9%

    A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create_scene/add_node. This manipulation of the argument projectPath causes com…

  31. 9.8CVE-2026-5134EPSS 0.5%

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was c…

  32. 2.1CVE-2026-19041EPSS 2.1%

    A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipula…

  33. 6.4CVE-2026-18501EPSS 0.3%

    The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and inclu…

  34. 1.3CVE-2026-16316EPSS 0.2%

    OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values (SV) frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for …

  35. 1.9CVE-2026-19039EPSS 0.8%

    A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function ssh_exec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of th…

  36. 7.3CVE-2026-19036EPSS 3.2%

    A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument ppp_custom results in os command injection. The attack may be launched r…

  37. 5.3CVE-2026-0673EPSS 0.4%

    The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of ne…

  38. 5.4CVE-2026-8166EPSS 0.2%

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS. This issue affects e-Logo Purchasing Portal: before 1.…

  39. 6.4CVE-2026-5391EPSS 0.3%

    The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input s…

  40. 6.4CVE-2026-5158EPSS 0.3%

    The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficie…

  41. 7.3CVE-2026-19035EPSS 3.2%

    A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function new_qoslimit_start of the file /etc/qoslimit. The manipulation of the argument new_qoslimit_enable leads to os command injection. The attack …

  42. 7.2CVE-2025-15028EPSS 0.3%

    The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to…

  43. 8.1CVE-2026-57817EPSS 0.7%

    The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omi…

  44. 7.3CVE-2026-19034EPSS 3.2%

    A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function new_qoslimit_stop of the file /tmp/qoslimittc_stop.sh. Executing a manipulation of the argument wan_iface can lead to os command inje…

  45. 5.3CVE-2026-19022EPSS 1.8%

    A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request.py. This manipulation causes command injection. Remote exploitation of the atta…

  46. 5.5CVE-2026-19021EPSS 0.4%

    A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_product. Such manipulation of the argume…

  47. 2.1CVE-2026-19020EPSS 0.3%

    A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /servicetype.php. This manipulation of the argument editid causes sql injection. It is po…

  48. 5.4CVE-2026-0637EPSS 0.2%

    When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to influe…

  49. 4.3CVE-2025-13909EPSS 0.3%

    The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants…

  50. 5.8CVE-2024-10302EPSS 0.3%

    The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing…