cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 51

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 8.1CVE-2026-62065EPSS 0.3%

    Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.

  2. 7.1CVE-2026-62064EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.

  3. 7.1CVE-2026-62037EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

  4. 7.1CVE-2026-62034EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

  5. 9.8CVE-2026-62032EPSS 0.3%

    Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.

  6. 9.3CVE-2026-62031EPSS 0.3%

    Unauthenticated SQL Injection in uListing <= 2.2.0 versions.

  7. 7.1CVE-2026-62027EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.

  8. 8.1CVE-2026-62020EPSS 0.3%

    Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

  9. 7.1CVE-2026-57742EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.

  10. 8.1CVE-2026-48194EPSS 0.3%

    Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.

  11. 8.1CVE-2026-48193EPSS 0.3%

    Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.

  12. 7.6CVE-2026-45440EPSS 0.3%

    Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.

  13. 8.1CVE-2026-42777EPSS 0.3%

    Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.

  14. 8.1CVE-2026-42724EPSS 0.3%

    Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.

  15. 7.6CVE-2026-42722EPSS 0.3%

    Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.

  16. 7.6CVE-2026-42717EPSS 0.3%

    Administrator SQL Injection in Leyka <= 3.32.3 versions.

  17. 7.1CVE-2026-42715EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

  18. 8.5CVE-2026-42712EPSS 0.3%

    Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

  19. 7.1CVE-2026-42711EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

  20. 7.1CVE-2026-42709EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.

  21. 8.1CVE-2026-42704EPSS 0.3%

    Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.

  22. 7.1CVE-2026-42702EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

  23. 7.1CVE-2026-42699EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

  24. 7.1CVE-2026-42697EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & …

  25. 10.0CVE-2026-42696EPSS 0.4%

    Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration &amp; Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Ba…

  26. 7.1CVE-2026-42693EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jannah allows Reflected XSS.This issue affects Jannah: from n/a before 7.6.8.

  27. 8.5CVE-2026-42633EPSS 0.3%

    Subscriber SQL Injection in Events Manager <= 7.4.6 versions.

  28. 7.1CVE-2026-42632EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

  29. 7.1CVE-2026-42631EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.

  30. 7.1CVE-2026-40803EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.

  31. 9.3CVE-2026-40800EPSS 0.4%

    Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

  32. 8.1CVE-2026-39802EPSS 0.4%

    Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.

  33. 7.1CVE-2026-39800EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.

  34. 7.1CVE-2026-39799EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.

  35. 7.1CVE-2026-57806EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketp…

  36. 9.3CVE-2026-108598EPSS 0.9%

    Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integr…

  37. 7.3CVE-2026-108593EPSS 0.3%

    9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. At…

  38. 7.1CVE-2026-94160EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for La…

  39. 9.3CVE-2026-105889EPSS 0.2%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.

  40. 7.5CVE-2026-103071EPSS 0.2%

    Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerc…

  41. 9.3CVE-2026-108551EPSS 0.4%

    openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Att…

  42. 7.7CVE-2026-108546EPSS 0.8%

    Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet…

  43. 7.1CVE-2026-97264EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Reflected XSS.This issue affects WPAdverts: from n/a through 2.3.4.

  44. 7.1CVE-2026-97263EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affects WPAdverts: from n/a through 2.3.4.

  45. 7.7CVE-2026-108161EPSS 1.1%

    FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename…

  46. 7.1CVE-2026-102388EPSS 0.1%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.

  47. 5.4CVE-2026-106139EPSS 0.1%

    In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared t…

  48. 5.4CVE-2026-106138EPSS 0.1%

    In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared toolt…

  49. 6.4CVE-2026-4791EPSS 0.2%

    The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitizati…

  50. 7.2CVE-2026-107657EPSS 0.2%

    The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and inc…