cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 45

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 8.7CVE-2026-89196EPSS 0.3%

    A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authentica…

  2. 7.7CVE-2026-78557EPSS 0.3%

    A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front…

  3. 5.3CVE-2026-63357EPSS 0.2%

    Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the funct…

  4. 5.3CVE-2026-63356EPSS 0.2%

    Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who ho…

  5. 5.3CVE-2026-63355EPSS 0.2%

    Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This could allow an attacker to social engineer an authorized user who holds the fu…

  6. 9.4CVE-2026-63354EPSS 0.3%

    Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the func…

  7. 9.4CVE-2026-63353EPSS 0.3%

    Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read di…

  8. 5.3CVE-2026-63352EPSS 0.2%

    Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function righ…

  9. 5.3CVE-2026-63351EPSS 0.2%

    Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized …

  10. 9.4CVE-2026-63350EPSS 0.3%

    Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a speciall…

  11. 5.1CVE-2026-96535EPSS 0.2%

    Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image …

  12. 6.5CVE-2026-109697EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4.

  13. 6.5CVE-2026-109691EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For El…

  14. 7.6CVE-2026-109687EPSS 0.2%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.

  15. 5.5CVE-2026-109115EPSS 0.3%

    A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a …

  16. 9.3CVE-2026-109110EPSS 2.0%

    A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit…

  17. 6.5CVE-2026-108495EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7.

  18. 6.5CVE-2026-108490EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: fro…

  19. 6.5CVE-2026-108488EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for E…

  20. 6.5CVE-2026-108487EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak Books Gallery wp-books-gallery allows Stored XSS.This issue affects Books Gallery: from n/a through 4.8.4.

  21. 7.6CVE-2026-108179EPSS 0.2%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PluginUs.Net WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through 1.1.1.

  22. 6.5CVE-2026-105881EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.

  23. 5.4CVE-2026-67165EPSS 0.2%

    HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow…

  24. 4.9CVE-2026-15399EPSS 0.4%

    The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of suffic…

  25. 4.9CVE-2026-14308EPSS 0.4%

    Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.

  26. 8.6CVE-2026-109108EPSS 1.7%

    A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be perform…

  27. 8.8CVE-2026-103418EPSS 0.3%

    Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. …

  28. 7.2CVE-2026-102562EPSS 0.2%

    The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanit…

  29. 7.2CVE-2026-102007EPSS 0.2%

    The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_…

  30. 8.5CVE-2026-75826EPSS 0.9%

    Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 b…

  31. 6.8CVE-2026-89269EPSS 0.3%

    The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes …

  32. 6.5CVE-2026-54870EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a thr…

  33. 6.5CVE-2026-54869EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1.

  34. 6.5CVE-2026-54868EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7.

  35. 6.5CVE-2026-54867EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Griden Responsive Slider responsive-slider allows Stored XSS.This issue affects Responsive Slider: from n/a through 0.1.9.

  36. 5.5CVE-2026-108970EPSS 0.3%

    A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Per…

  37. 5.5CVE-2026-108968EPSS 0.3%

    A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php. This manipulation of the argument ID causes sql injection. Remote ex…

  38. 5.5CVE-2026-108967EPSS 0.3%

    A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.php. The manipulation of the argument credit results in sql injection. The attack …

  39. 5.5CVE-2026-108966EPSS 0.3%

    A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attac…

  40. 5.5CVE-2026-108965EPSS 0.3%

    A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection.…

  41. 5.5CVE-2026-108964EPSS 0.3%

    A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack…

  42. 5.3CVE-2026-108962EPSS 0.3%

    A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file2dict of the file local_groundingdino/util/slconfig.py of the compone…

  43. 5.3CVE-2026-108961EPSS 0.2%

    A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference/models/text_detection/processors.py of the component Preprocessor. This manipul…

  44. 2.1CVE-2026-108959EPSS 0.2%

    A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /addtransacdetail.php. The manipulation of the argument ID leads to sql injection. The attack is possi…

  45. 2.1CVE-2026-108958EPSS 0.3%

    A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HDF5 Loading. Executing a manipulation of the argument model_config can lead to de…

  46. 2.1CVE-2026-108957EPSS 0.3%

    A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function _load_text_config of the file tinyllava/model/configuration_tinyllava.py of the compone…

  47. 7.3CVE-2026-96893EPSS 0.6%

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted con…

  48. 8.7CVE-2026-92883EPSS 0.5%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaSc…

  49. 5.5CVE-2026-108956EPSS 0.3%

    A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Update Handler. Such ma…

  50. 1.9CVE-2026-108947EPSS 0.2%

    A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Executing a manipulation of the argument src_ckpt can lead to deserialization. The att…