cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 180

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 5.1CVE-2026-65762EPSS 0.4%

    Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability.

  2. 8.7CVE-2026-47743EPSS 0.4%

    Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel expos…

  3. 10.0CVE-2026-47668ExploitEPSS 3.9%

    DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. T…

  4. 5.8CVE-2026-44210EPSS 0.6%

    Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inje…

  5. 9.3CVE-2026-65761ExploitEPSS 1.0%

    Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including c…

  6. 5.1CVE-2026-65697EPSS 0.3%

    Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostn…

  7. 5.1CVE-2026-48539EPSS 0.2%

    GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /…

  8. 5.1CVE-2026-48538EPSS 0.2%

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers to inject arbitrary web script or HTML via the configured folders parameter to …

  9. 5.1CVE-2026-48537EPSS 0.2%

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to …

  10. 5.1CVE-2026-48536EPSS 0.2%

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /…

  11. 5.1CVE-2026-48535EPSS 0.2%

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to…

  12. 5.1CVE-2026-48534EPSS 0.2%

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServer…

  13. 5.1CVE-2026-48532EPSS 0.2%

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /…

  14. 5.1CVE-2026-48531EPSS 0.2%

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/Rete…

  15. 5.1CVE-2026-48530EPSS 0.2%

    GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parame…

  16. 5.3CVE-2026-65914EPSS 0.3%

    DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloa…

  17. 5.1CVE-2026-65912EPSS 0.3%

    DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag com…

  18. 5.1CVE-2026-65911EPSS 0.3%

    In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the sa…

  19. 5.1CVE-2026-65901EPSS 0.3%

    DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observabl…

  20. 5.1CVE-2026-65900EPSS 0.3%

    DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) insi…

  21. 5.1CVE-2026-65898EPSS 0.2%

    DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally a…

  22. 1.9CVE-2026-16735EPSS 1.1%

    A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile l…

  23. 1.9CVE-2026-16733EPSS 1.1%

    A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os com…

  24. 9.1CVE-2026-65907EPSS 0.7%

    In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible

  25. 10.0CVE-2026-65906EPSS 0.7%

    In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible

  26. 2.9CVE-2026-15037EPSS 0.4%

    Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML m…

  27. 8.7CVE-2026-65608EPSS 1.1%

    Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only…

  28. 9.4CVE-2026-65606EPSS 0.8%

    SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the…

  29. 9.4CVE-2026-65605EPSS 0.8%

    SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when…

  30. 5.9CVE-2026-65550EPSS 0.2%

    Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.

  31. 5.9CVE-2026-65538EPSS 0.2%

    Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.

  32. 5.9CVE-2026-65534EPSS 0.2%

    Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.

  33. 6.5CVE-2026-65533EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.

  34. 7.6CVE-2026-65532EPSS 0.4%

    Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.

  35. 6.5CVE-2026-65528EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.

  36. 6.5CVE-2026-65527EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.

  37. 8.5CVE-2026-65526EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1.

  38. 6.5CVE-2026-65522EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

  39. 6.5CVE-2026-65519EPSS 0.2%

    Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.

  40. 6.5CVE-2026-65518EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.

  41. 6.5CVE-2026-65514EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.

  42. 7.1CVE-2026-65511EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

  43. 7.1CVE-2026-65510EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.

  44. 6.5CVE-2026-65503EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

  45. 7.1CVE-2026-65494EPSS 0.3%

    Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.

  46. 7.1CVE-2026-65492EPSS 0.3%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affects Dokan Pro: from n/a before 5.0.7.

  47. 5.9CVE-2026-65483EPSS 0.2%

    Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.

  48. 6.5CVE-2026-65482EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows DOM-Based XSS.This issue affects LA-Studio Element Kit for Elem…

  49. 7.5CVE-2026-65481EPSS 0.4%

    Contributor Local File Inclusion in Vino <= 1.9 versions.

  50. 6.5CVE-2026-65480EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1.