OWASP A05:2025 Injection vulnerabilities, newest first, page 37
Filter
The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.
Its weaknesses: 37
CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917
- 2.8CVE-2026-79835EPSS 0.09%
A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server.
- 7.4CVE-2026-79834EPSS 0.6%
A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.
- 7.1CVE-2026-108498EPSS 0.1%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.
- 9.3CVE-2026-108497EPSS 0.2%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.
- 7.1CVE-2026-108491EPSS 0.1%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.
- 8.2CVE-2026-79829EPSS 0.3%
A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.
- 6.3CVE-2026-47790EPSS 0.3%
A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in …
- 9.3CVE-2026-47786EPSS 1.1%
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following ver…
- 8.6CVE-2026-41545EPSS 0.4%
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have alr…
- 4.8CVE-2026-39991EPSS 0.3%
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability i…
- 6.9CVE-2026-34007EPSS 1.4%
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following versio…
- 7.1CVE-2026-26245EPSS 0.4%
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability …
- 7.1CVE-2026-26244EPSS 0.4%
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability …
- 6.9CVE-2026-76182EPSS 0.3%
In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are re…
- 8.7CVE-2026-63314EPSS 0.2%
WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks. This issue was fixed …
- 8.8CVE-2026-81534EPSS 0.5%
The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This is due to insufficient authorization and input sanitization in the send_test_mail() functi…
- 8.2CVE-2026-79821EPSS 0.2%
A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down.
- 7.1CVE-2026-74920EPSS 0.1%
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripti…
- 6.2CVE-2026-22896EPSS 0.4%
A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed …
- 4.4CVE-2026-110934EPSS 0.1%
Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa.
- 7.2CVE-2026-88043EPSS 0.2%
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possibl…
- 6.5CVE-2026-86803EPSS 0.2%
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value bef…
- 6.4CVE-2026-78087EPSS 0.2%
The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it po…
- 6.4CVE-2026-78001EPSS 0.2%
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insuff…
- 7.2CVE-2026-18586EPSS 0.2%
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization an…
- 6.1CVE-2026-18557EPSS 0.2%
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization a…
- 7.2CVE-2026-18548EPSS 0.3%
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and o…
- 6.4CVE-2026-17001EPSS 0.2%
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and o…
- 6.1CVE-2026-15180EPSS 0.2%
The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. T…
- 7.5CVE-2026-15090EPSS 0.4%
The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient pre…
- 6.4CVE-2026-14572EPSS 0.2%
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitizat…
- 8.6CVE-2026-93484EPSS 0.3%
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary…
- 9.8CVE-2026-110911EPSS 0.3%
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string…
- 8.8CVE-2026-110908EPSS 6.1%
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a fil…
- 8.7CVE-2026-77931EPSS 1.0%
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, an…
- 7.6CVE-2026-76661EPSS 0.2%
A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.
- 8.7CVE-2026-76660EPSS 0.1%
A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.
- 6.9CVE-2026-110870EPSS 0.3%
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a…
- 8.7CVE-2026-110859EPSS 0.4%
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default br…
- 9.2CVE-2026-110858EPSS 0.5%
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload…
- 7.2CVE-2026-110849EPSS 0.2%
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run scri…
- 7.0CVE-2026-110847EPSS 0.4%
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as m…
- 7.0CVE-2026-110840EPSS 0.3%
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow bin…
- 6.3CVE-2026-110835EPSS 0.3%
FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host he…
- 4.8CVE-2026-69194EPSS 0.2%
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise returns the stored branding.footerHtml value through the unauthenticated public site configuration API withou…
- 6.9CVE-2026-110670EPSS 0.3%
A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can…
- 7.2CVE-2026-100232EPSS 1.2%
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could pot…
- 6.1CVE-2026-0320EPSS 0.8%
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have a…
- 1.1CVE-2026-0316EPSS 0.3%
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. The security risk posed by this i…
- 6.1CVE-2026-0313EPSS 0.8%
A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.