cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 46

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 6.1CVE-2026-89117EPSS 0.2%

    SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading…

  2. 5.9CVE-2026-89116EPSS 0.2%

    The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizar…

  3. 8.8CVE-2026-89113EPSS 0.4%

    SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL co…

  4. 9.9CVE-2026-89107EPSS 0.5%

    SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privile…

  5. 5.4CVE-2026-76976EPSS 0.1%

    Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If t…

  6. 6.1CVE-2026-76975EPSS 0.2%

    Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-cont…

  7. 6.5CVE-2026-76972EPSS 0.2%

    Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displ…

  8. 4.8CVE-2026-108945EPSS 0.1%

    A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. Performing a…

  9. 2.4CVE-2026-108944EPSS 0.1%

    A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. Affected by this vulnerability is the function get_obj_from_str of the file src/utils/model_utils.py of the component Config-Drive…

  10. 1.9CVE-2026-108943EPSS 0.2%

    A weakness has been identified in ModelTC LightX2V up to 0.5.0. Affected is the function AutoTokenizer.from_pretrained of the file lightx2v/models/runners/cosmos3/cosmos3_runner.py of the component Tokenizer. This manipulation of the argum…

  11. 5.1CVE-2026-108942EPSS 0.2%

    A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function create_html_for_item of the file modules/ui_extra_networks.py of the component Extra Networks Card…

  12. 9.9CVE-2026-96119EPSS 0.5%

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

  13. 5.4CVE-2026-93886EPSS 0.2%

    IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

  14. 2.4CVE-2026-108941EPSS 0.1%

    A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parse_cfg_args of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfg_args leads to code inje…

  15. 8.8CVE-2026-82108EPSS 0.5%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  16. 8.8CVE-2026-82096EPSS 0.4%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  17. 5.4CVE-2026-75063EPSS 0.2%

    IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.

  18. 5.4CVE-2026-18541EPSS 0.1%

    IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading…

  19. 7.1CVE-2026-109674EPSS 0.3%

    Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints…

  20. 8.5CVE-2026-109673EPSS 0.2%

    Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticat…

  21. 8.5CVE-2026-109671EPSS 0.2%

    Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the f…

  22. 5.1CVE-2026-109670EPSS 0.2%

    Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script …

  23. 7.1CVE-2026-109663EPSS 0.3%

    Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to m…

  24. 5.3CVE-2026-109662EPSS 0.2%

    Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation…

  25. 5.1CVE-2026-109657EPSS 0.2%

    Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the s…

  26. 8.5CVE-2026-109653EPSS 0.2%

    Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into an HTML attribute context without escaping. A low-privilege user can store a malicious payl…

  27. 7.1CVE-2026-109649EPSS 0.3%

    Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted…

  28. 7.1CVE-2026-109648EPSS 0.3%

    Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queri…

  29. 7.1CVE-2026-109647EPSS 0.3%

    Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to mani…

  30. 7.1CVE-2026-109646EPSS 0.3%

    Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints…

  31. 7.1CVE-2026-109639EPSS 0.3%

    Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can sen…

  32. 7.1CVE-2026-109638EPSS 0.3%

    Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulat…

  33. 6.9CVE-2026-109634EPSS 0.3%

    Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high privileges can send specially crafted requests to these end…

  34. 8.6CVE-2026-109633EPSS 0.2%

    Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a public-facing booking page is stored without neutralization. Unauthenticated attackers can subm…

  35. 7.1CVE-2026-109631EPSS 0.3%

    Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can …

  36. 7.1CVE-2026-109626EPSS 0.3%

    Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQ…

  37. 8.5CVE-2026-109612EPSS 0.2%

    Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can…

  38. 7.1CVE-2026-109609EPSS 0.3%

    Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints…

  39. 8.7CVE-2026-109608EPSS 0.3%

    Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted reques…

  40. 8.5CVE-2026-109604EPSS 0.2%

    Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such record…

  41. 5.1CVE-2026-109602EPSS 0.2%

    Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter va…

  42. 5.1CVE-2026-109597EPSS 0.2%

    Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by supplying crafted explicit heading IDs. Attackers can break out of the unescaped href attribute i…

  43. 9.2CVE-2026-109573EPSS 0.3%

    phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers…

  44. 1.9CVE-2026-108936EPSS 0.2%

    A security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formQoS of the component QoS Page. The manipulation leads to cross site scripting. It is possible to initiate the attack …

  45. 1.9CVE-2026-108935EPSS 0.3%

    A weakness has been identified in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formPortFw of the component Port Forwarding Page. Executing a manipulation can lead to cross site scripting. …

  46. 8.6CVE-2025-71432EPSS 0.3%

    Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote att…

  47. 6.3CVE-2025-71431EPSS 0.2%

    Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax th…

  48. 5.1CVE-2025-71430EPSS 0.2%

    Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name …

  49. 5.3CVE-2024-58391EPSS 0.3%

    Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when vis…

  50. 5.9CVE-2023-54409EPSS 0.2%

    Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by htm…