cve.bz

OWASP A05:2025 Injection vulnerabilities, newest first, page 82

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A05:2025 at MITRE.

Its weaknesses: 37

CWE-20, CWE-74, CWE-76, CWE-77, CWE-78, CWE-79, CWE-80, CWE-83, CWE-86, CWE-88, CWE-89, CWE-90, CWE-91, CWE-93, CWE-94, CWE-95, CWE-96, CWE-97, CWE-98, CWE-99, CWE-103, CWE-104, CWE-112, CWE-113, CWE-114, CWE-115, CWE-116, CWE-129, CWE-159, CWE-470, CWE-493, CWE-500, CWE-564, CWE-610, CWE-643, CWE-644, CWE-917

  1. 5.1CVE-2026-17503EPSS 0.1%

    IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker wi…

  2. 5.1CVE-2026-17413EPSS 0.1%

    IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the RTAS firmware-to-OS interface. An attacker with administrator…

  3. 5.5CVE-2026-97182EPSS 0.4%

    A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component S…

  4. 5.1CVE-2026-4637EPSS 0.6%

    Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is made for a non-existent resource ending in \".htm\", the web interface returns an HTTP 403 \"…

  5. 6.4CVE-2026-15731EPSS 0.2%

    The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output es…

  6. 9.8CVE-2026-12227ExploitEPSS 2.8%

    The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include …

  7. 8.8CVE-2026-78311EPSS 0.2%

    SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

  8. 8.8CVE-2026-78309EPSS 0.3%

    SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

  9. 7.3CVE-2026-82077EPSS 0.8%

    An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying…

  10. 3.8CVE-2026-11744EPSS 0.2%

    An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web …

  11. 6.8CVE-2026-89005EPSS 0.2%

    The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored…

  12. 6.8CVE-2026-89002EPSS 0.2%

    The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scri…

  13. 3.5CVE-2026-84151EPSS 0.2%

    The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input ele…

  14. 7.5CVE-2026-14780EPSS 0.3%

    A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the m…

  15. 2.0CVE-2026-96810EPSS 0.2%

    A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd53244989fd664bbb2b3d4edbfdbf1. This issue affects the function Save of the file base-admin-master\src\main\java\cn\huanzi\qch\baseadmin\common\controller\CommonContro…

  16. 5.5CVE-2026-96803EPSS 0.3%

    A vulnerability was identified in java110 MicroCommunity up to 2.0. Affected is the function QueryServiceSMOImpl.fallBack of the file BusinessApi.java of the component fallBack API Endpoint. Such manipulation of the argument fallBackSql le…

  17. 2.1CVE-2026-96777EPSS 0.2%

    A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoi…

  18. 5.5CVE-2026-96751EPSS 0.3%

    A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/add_project.php. Such manipulation of the argument conn_settings lea…

  19. 2.1CVE-2026-96739EPSS 0.3%

    A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the component KindEditor Upload Interface. This manipulation of the argument imgFile causes cross site…

  20. 8.6CVE-2026-82370EPSS 0.6%

    Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could all…

  21. 5.5CVE-2026-96604EPSS 0.4%

    A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql inj…

  22. 5.5CVE-2026-96602EPSS 0.4%

    A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The …

  23. 5.5CVE-2026-96601EPSS 0.4%

    A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack c…

  24. 8.8CVE-2026-81537EPSS 1.7%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection.

  25. 8.6CVE-2026-82369EPSS 0.4%

    Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permiss…

  26. 8.8CVE-2026-80425EPSS 0.8%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  27. 8.8CVE-2026-80412EPSS 0.8%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation.

  28. 8.8CVE-2026-80379EPSS 0.8%

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  29. 9.8CVE-2026-6721EPSS 1.2%

    IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution on the underlying system. Successful exploitation …

  30. 7.3CVE-2026-66077EPSS 0.2%

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... %> does NOT HTML-escape. connection.ejs:135 renders <%= connection.ssl_details.peer_cert_su…

  31. 7.6CVE-2026-96826EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6.

  32. 9.4CVE-2026-87900EPSS 0.7%

    Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

  33. 9.4CVE-2026-87898EPSS 1.1%

    OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

  34. 7.2CVE-2026-85475EPSS 0.8%

    A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LO…

  35. 6.6CVE-2026-84724EPSS 0.3%

    An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defin…

  36. 8.7CVE-2026-84683EPSS 0.3%

    A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal esca…

  37. 8.4CVE-2026-82409EPSS 0.3%

    Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request with…

  38. 7.0CVE-2026-82407EPSS 0.5%

    Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, o…

  39. 9.3CVE-2026-95601EPSS 0.3%

    Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.

  40. 7.6CVE-2026-95593EPSS 0.4%

    Editor SQL Injection in Ultimeter <= 3.0.8 versions.

  41. 7.1CVE-2026-95590EPSS 0.3%

    Subscriber SQL Injection in Tainacan <= 1.2.0 versions.

  42. 6.5CVE-2026-95586EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.

  43. 6.5CVE-2026-95530EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.

  44. 7.1CVE-2026-95529EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.

  45. 7.1CVE-2026-95528EPSS 0.3%

    Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.

  46. 7.6CVE-2026-95522EPSS 0.4%

    Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.

  47. 7.1CVE-2026-95515EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

  48. 6.5CVE-2026-94682EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.

  49. 6.5CVE-2026-94680EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

  50. 6.5CVE-2026-94671EPSS 0.2%

    Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.