cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 31

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 5.5CVE-2026-112139EPSS 0.3%

    A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. …

  2. 6.5CVE-2026-85314EPSS 0.5%

    Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing thr…

  3. 4.8CVE-2026-85312EPSS 0.5%

    Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which…

  4. 6.5CVE-2026-85249EPSS 0.7%

    Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted documen…

  5. 8.8CVE-2026-83531EPSS 0.9%

    Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel. This issue affects Apache C…

  6. 9.8CVE-2026-71253EPSS 0.4%

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Joh…

  7. 5.4CVE-2026-64944EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without pass…

  8. 4.8CVE-2026-112184EPSS 0.4%

    MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encod…

  9. 4.8CVE-2026-112183EPSS 0.3%

    MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribu…

  10. 2.1CVE-2026-112102EPSS 0.3%

    A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument cond…

  11. 2.0CVE-2026-112100EPSS 0.2%

    A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of the file deeppavlov/models/preprocessors/multitask_preprocessor.py. This manipulation of the argument preprocesso…

  12. 6.5CVE-2026-111407EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2.

  13. 9.9CVE-2026-110887EPSS 0.4%

    Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.

  14. 7.1CVE-2026-110379EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.

  15. 6.5CVE-2026-108780EPSS 0.2%

    Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are rec…

  16. 5.3CVE-2026-108776EPSS 0.3%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue aff…

  17. 8.8CVE-2026-13695EPSS 0.2%

    SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerabil…

  18. 2.1CVE-2026-112098EPSS 0.3%

    A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack…

  19. 5.1CVE-2026-112097EPSS 0.2%

    A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactions_handler.php?action=save_sale of the component Sales Management Handler. The manipulation of the argu…

  20. 2.0CVE-2026-112096EPSS 0.2%

    A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactions_handler.php?action=save_purchase of the component Purchase Records Handler. The manipulation of th…

  21. 2.0CVE-2026-112095EPSS 0.2%

    A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/products_handler.php?action=save of the component Product Management. Executing a manipulation of the argument Product_Id/Product_N…

  22. 2.1CVE-2026-112093EPSS 0.3%

    A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The impacted element is an unknown function of the file feedback.php. The manipulation of the argument msg leads…

  23. 2.1CVE-2026-112092EPSS 0.3%

    A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is the function echo of the file doctorregistration.php of the component Doctor Registration. Execut…

  24. 2.1CVE-2026-112090EPSS 0.3%

    A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This issue affects the function mysqli_real_escape_string of the file payment/pay.php. The ma…

  25. 3.8CVE-2026-91831EPSS 0.2%

    The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e…

  26. 7.2CVE-2026-76740EPSS 0.5%

    A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.

  27. 6.8CVE-2026-74921EPSS 0.2%

    The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributo…

  28. 2.0CVE-2026-112089EPSS 0.2%

    A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This vulnerability affects the function mysqli_query of the file employees/dele…

  29. 2.1CVE-2026-112088EPSS 0.3%

    A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This affects the function mysqli_query of the file farmers/add.php. Executing a manipulatio…

  30. 2.1CVE-2026-112087EPSS 0.2%

    A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing of the file confirm.php. This manipulation of the argument cancel causes sql injection. The attack may be initiated …

  31. 3.7CVE-2026-110034EPSS 0.2%

    The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a c…

  32. 4.3CVE-2026-76739EPSS 0.2%

    A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server could be remotely exploited to list and modify RMC filesystem.

  33. 2.1CVE-2026-112086EPSS 0.3%

    A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results in…

  34. 2.1CVE-2026-112081EPSS 0.3%

    A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument c…

  35. 6.9CVE-2026-108121EPSS 0.3%

    Brian Mariani from DigitalCanion SA has discovered a  vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration direc…

  36. 6.8CVE-2026-106933EPSS 0.3%

    The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upl…

  37. 2.1CVE-2026-112080EPSS 0.4%

    A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. The impacted element is the function get_class_from_dynamic_module of the file examples/chat_gradio_no_merge.py of the component Adapte…

  38. 2.1CVE-2026-112079EPSS 0.3%

    A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deseriali…

  39. 2.1CVE-2026-112078EPSS 0.2%

    A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection. The at…

  40. 2.1CVE-2026-112075EPSS 0.3%

    A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type…

  41. 7.0CVE-2026-111440EPSS 0.2%

    在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 J…

  42. 2.0CVE-2026-112042EPSS 0.2%

    A security flaw has been discovered in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This issue affects the function dmBaseLinkTag::text of the file dmCorePlugin/lib/view/html/link/dmBaseLinkTag.php of the component dmW…

  43. 1.9CVE-2026-112039EPSS 0.2%

    A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrat…

  44. 1.9CVE-2026-112038EPSS 0.2%

    A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service.…

  45. 9.8CVE-2026-108983EPSS 0.4%

    A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .

  46. 2.0CVE-2026-112032EPSS 0.2%

    A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit …

  47. 2.0CVE-2026-112031EPSS 0.3%

    A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the a…

  48. 5.1CVE-2026-112111EPSS 0.4%

    The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquote…

  49. 9.1CVE-2024-4457EPSS 0.4%

    The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected s…

  50. 2.1CVE-2026-111992EPSS 0.2%

    A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This issue affects the function Exam::startExam of the file exam.php of the component Exam Module. The manipulation of…