cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 60

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 7.7CVE-2026-105841EPSS 0.9%

    lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, pr…

  2. 5.4CVE-2026-105789EPSS 0.7%

    Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute_command tool in ufo/client/mcp/http_servers/linux_mcp_server.py treats sort and uniq as read-only commands while…

  3. 8.8CVE-2026-105788EPSS 1.1%

    Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py pass the authenticated caller-contro…

  4. 5.3CVE-2025-15591EPSS 0.3%

    Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page.

  5. 9.2CVE-2026-82531EPSS 0.8%

    Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data c…

  6. 5.5CVE-2026-105919EPSS 0.3%

    A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint…

  7. 3.5CVE-2026-56596EPSS 0.2%

    HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application …

  8. 5.5CVE-2026-105918EPSS 0.3%

    A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the a…

  9. 7.1CVE-2026-94675EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.

  10. 7.8CVE-2026-4889EPSS 0.3%

    SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection…

  11. 7.1CVE-2026-42636EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.

  12. 7.1CVE-2026-42635EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.

  13. 7.1CVE-2026-42634EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.

  14. 7.1CVE-2026-42418EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5.

  15. 9.3CVE-2026-42417EPSS 0.3%

    Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.

  16. 8.5CVE-2026-42416EPSS 0.3%

    Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.

  17. 9.3CVE-2026-42415EPSS 0.2%

    Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.

  18. 8.5CVE-2026-42414EPSS 0.3%

    Subscriber SQL Injection in ListingPro <= 2.9.12 versions.

  19. 9.3CVE-2026-41555EPSS 0.2%

    Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.

  20. 7.1CVE-2026-40807EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.6 versions.

  21. 7.1CVE-2026-40806EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.

  22. 9.3CVE-2026-39795EPSS 0.3%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in brewlabs SendPress Newsletters sendpress allows Blind SQL Injection.This issue affects SendPress Newsletters: from n/a through 1.26.1.20.

  23. 7.1CVE-2026-39790EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7.

  24. 6.5CVE-2026-39788EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.

  25. 9.3CVE-2026-39785EPSS 0.2%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.…

  26. 7.1CVE-2026-39784EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.

  27. 7.1CVE-2026-39781EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1.

  28. 7.1CVE-2026-39780EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.

  29. 7.1CVE-2026-39778EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor &amp; Themes <= 2.1.2 versions.

  30. 8.0CVE-2026-39776EPSS 0.3%

    Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.

  31. 8.5CVE-2026-39771EPSS 0.3%

    Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.

  32. 7.1CVE-2026-39766EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

  33. 9.3CVE-2026-39764EPSS 0.3%

    Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments &amp; Services <= 1.0.19 versions.

  34. 7.1CVE-2026-39758EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.

  35. 7.1CVE-2026-39750EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.

  36. 7.1CVE-2026-39748EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.

  37. 8.5CVE-2026-39747EPSS 0.3%

    Subscriber SQL Injection in Woffice <= 5.4.35 versions.

  38. 9.3CVE-2026-39746EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booknetic Booknetic booknetic allows Blind SQL Injection.This issue affects Booknetic: from n/a before 5.10.3.

  39. 7.1CVE-2026-39745EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.

  40. 7.1CVE-2026-39731EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.

  41. 6.5CVE-2026-39727EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.

  42. 7.1CVE-2026-39726EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.

  43. 7.1CVE-2026-39724EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.

  44. 7.1CVE-2026-39722EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

  45. 7.1CVE-2026-39720EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

  46. 7.1CVE-2026-32581EPSS 0.3%

    Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.

  47. 7.5CVE-2026-32580EPSS 0.3%

    Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.

  48. 7.1CVE-2026-32577EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.

  49. 7.1CVE-2026-32575EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.

  50. 7.1CVE-2026-32574EPSS 0.2%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.