cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 181

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 7.5CVE-2026-65477EPSS 0.4%

    Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.

  2. 6.5CVE-2026-65475EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.

  3. 6.5CVE-2026-65473EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

  4. 6.5CVE-2026-65470EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.

  5. 6.5CVE-2026-65465EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.

  6. 7.6CVE-2026-65462EPSS 0.4%

    Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.

  7. 8.5CVE-2026-65454EPSS 0.4%

    Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.

  8. 8.5CVE-2026-65451EPSS 0.4%

    Contributor SQL Injection in MapSVG <= 8.14.0 versions.

  9. 8.5CVE-2026-65450EPSS 0.4%

    Contributor SQL Injection in MapSVG <= 8.14.0 versions.

  10. 6.5CVE-2026-65449EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.

  11. 9.8CVE-2026-64815EPSS 0.5%

    In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

  12. 6.1CVE-2026-64810EPSS 0.3%

    In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking

  13. 7.8CVE-2026-64803EPSS 0.2%

    In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK

  14. 7.8CVE-2026-64802EPSS 0.2%

    In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration

  15. 9.3CVE-2026-61950EPSS 0.4%

    Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.

  16. 9.3CVE-2026-61949EPSS 0.4%

    Unauthenticated SQL Injection in Bookly <= 27.7 versions.

  17. 9.3CVE-2026-61948EPSS 0.4%

    Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.

  18. 7.1CVE-2026-61947EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.

  19. 7.1CVE-2026-61944EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.

  20. 9.9CVE-2026-59543EPSS 0.8%

    Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.

  21. 9.3CVE-2026-59526EPSS 0.4%

    Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.

  22. 9.3CVE-2026-59525EPSS 0.4%

    Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.

  23. 7.1CVE-2026-59517EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.

  24. 9.3CVE-2026-59514EPSS 0.4%

    Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions.

  25. 6.5CVE-2026-59513EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.

  26. 7.1CVE-2026-59512EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.

  27. 7.1CVE-2026-57809EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.

  28. 7.1CVE-2026-57769EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.

  29. 7.1CVE-2026-57767EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.

  30. 7.1CVE-2026-57735EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.

  31. 7.1CVE-2026-57704EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.

  32. 7.1CVE-2026-57701EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.

  33. 7.1CVE-2026-57699EPSS 0.3%

    Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.

  34. 7.1CVE-2026-57428EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions.

  35. 7.1CVE-2026-57427EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.

  36. 7.1CVE-2026-57397EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.

  37. 6.5CVE-2026-57384EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions.

  38. 7.1CVE-2026-57374EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions.

  39. 6.5CVE-2026-57373EPSS 0.2%

    Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions.

  40. 7.1CVE-2026-57370EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions.

  41. 6.5CVE-2026-27403EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3.

  42. 8.5CVE-2026-25405EPSS 0.4%

    Contributor SQL Injection in eRoom <= 1.7.1 versions.

  43. 5.9CVE-2026-24628EPSS 0.2%

    Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.

  44. 8.5CVE-2026-24552EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3.

  45. 5.9CVE-2025-68081EPSS 0.2%

    Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.

  46. 6.1CVE-2026-65756EPSS 0.3%

    Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript.

  47. 6.5CVE-2026-15906EPSS 0.5%

    The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied par…

  48. 6.4CVE-2026-15794EPSS 0.3%

    The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping.…

  49. 6.5CVE-2026-15761EPSS 0.5%

    The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied para…

  50. 4.4CVE-2026-15647EPSS 0.3%

    The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. Thi…