cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 177

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 4.9CVE-2026-16811EPSS 0.4%

    The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping o…

  2. 7.1CVE-2026-14870ExploitEPSS 0.5%

    The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could b…

  3. 3.5CVE-2026-14819EPSS 0.2%

    The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting at…

  4. 5.3CVE-2026-17528EPSS 0.4%

    Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing…

  5. 6.5CVE-2026-65448EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner &#8211; AcyChecker <= 1.8.1 versions.

  6. 7.1CVE-2026-65447EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.

  7. 7.1CVE-2026-65446EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.

  8. 7.1CVE-2026-65443EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.

  9. 7.1CVE-2026-65441EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.

  10. 7.1CVE-2026-65440EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.

  11. 7.1CVE-2026-65439EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions.

  12. 7.1CVE-2026-65438EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions.

  13. 7.1CVE-2026-65437EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.

  14. 7.1CVE-2026-61957EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.

  15. 6.1CVE-2026-51565EPSS 0.4%

    Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request

  16. 6.9CVE-2026-53668EPSS 0.3%

    React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected ex…

  17. 6.1CVE-2026-53667EPSS 0.4%

    React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consumi…

  18. 6.1CVE-2026-53666EPSS 0.4%

    React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for a…

  19. 7.5CVE-2026-51077EPSS 0.5%

    SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the sys_sql_query.php component

  20. 6.9CVE-2026-66825EPSS 0.4%

    Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating …

  21. 9.2CVE-2026-66824EPSS 0.4%

    A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data c…

  22. 4.3CVE-2026-59728EPSS 0.3%

    Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-char…

  23. 7.1CVE-2026-43813EPSS 0.2%

    A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A maliciously crafted app may be able to bypass code signing enfo…

  24. 9.8CVE-2026-43793EPSS 0.6%

    An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system…

  25. 7.5CVE-2026-43777EPSS 0.7%

    This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote attacker may be able to cause a denial of service.

  26. 5.5CVE-2026-43714EPSS 0.2%

    The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. A maliciou…

  27. 7.8CVE-2026-43698EPSS 0.2%

    An injection issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

  28. 5.1CVE-2026-59729EPSS 0.5%

    Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_…

  29. 2.1CVE-2026-59727EPSS 0.4%

    Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied t…

  30. 8.7CVE-2026-56747EPSS 0.7%

    Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database …

  31. 5.1CVE-2026-66031EPSS 0.3%

    Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field.…

  32. 6.3CVE-2026-64647EPSS 0.3%

    Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the…

  33. 5.1CVE-2026-66030EPSS 0.3%

    Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field…

  34. 5.1CVE-2026-66029EPSS 0.3%

    Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field o…

  35. 8.6CVE-2026-59239EPSS 0.7%

    Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leadi…

  36. 8.8CVE-2026-55578EPSS 0.7%

    Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to…

  37. 8.8CVE-2026-54540EPSS 0.7%

    Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configu…

  38. 6.9CVE-2026-54272EPSS 0.4%

    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies …

  39. 9.9CVE-2026-48030ExploitEPSS 7.5%

    Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS comman…

  40. 6.1CVE-2026-66390EPSS 0.6%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrad…

  41. 7.8CVE-2026-24252EPSS 1.5%

    NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure.

  42. 8.5CVE-2026-17191EPSS 0.4%

    An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges a…

  43. 9.3CVE-2026-66396EPSS 0.5%

    SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor perm…

  44. 9.4CVE-2026-66395EPSS 0.6%

    SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML…

  45. 9.3CVE-2026-66394EPSS 0.3%

    SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags w…

  46. 10.0CVE-2026-16812KEVEPSS 1.8%

    VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integri…

  47. 9.1CVE-2025-50455ExploitEPSS 1.1%

    SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgni…

  48. 5.9CVE-2026-66475EPSS 0.2%

    Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce &#8211; Checkout Manager <= 3.0.5 versions.

  49. 6.5CVE-2026-66448EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.

  50. 6.5CVE-2026-66445EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.