Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2024-57521 |
critical | 10.0 | 0.0068 | 2025-12-23 | SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrar | |
CVE-2026-105781 |
critical | 10.0 | 0.0052 | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a | |
CVE-2026-3325 |
critical | 10.0 | 0.0027 | 2026-04-29 | SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_ | |
CVE-2026-8054 |
critical | 10.0 | 0.0158 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish | |
CVE-2026-48330 |
critical | 10.0 | 0.0104 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a | |
CVE-2026-79848 |
critical | 10.0 | 0.0070 | 2026-10-22 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to | |
CVE-2026-79849 |
critical | 10.0 | 0.0070 | 2026-10-22 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to | |
CVE-2026-55572 |
critical | 10.0 | 0.0052 | 2026-10-14 | e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and | |
CVE-2026-105489 |
critical | 9.9 | 0.0048 | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a | |
CVE-2026-68782 |
critical | 9.9 | 0.0099 | 2026-08-20 | Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Da | |
CVE-2026-68789 |
critical | 9.9 | 0.0099 | 2026-08-20 | Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Da | |
CVE-2026-27681 |
critical | 9.9 | 0.0050 | 2026-04-14 | Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business | |
CVE-2026-52785 |
critical | 9.9 | 0.0038 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there | |
CVE-2026-50747 |
critical | 9.9 | 0.0049 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit a series of authentica | |
CVE-2026-63232 |
critical | 9.9 | 0.0053 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated att | |
CVE-2026-63233 |
critical | 9.9 | 0.0053 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated att | |
CVE-2026-63234 |
critical | 9.9 | 0.0053 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated att | |
CVE-2026-58046 |
critical | 9.9 | 0.0057 | 2026-07-30 | Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user t | |
CVE-2026-69083 |
critical | 9.9 | 0.0047 | 2026-08-03 | SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetConten | |
CVE-2026-69084 |
critical | 9.9 | 0.0157 | 2026-08-03 | SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-su | |
CVE-2026-69085 |
critical | 9.9 | 0.0139 | 2026-08-03 | SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint | |
CVE-2026-48326 |
critical | 9.9 | 0.0097 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a | |
CVE-2023-0758 |
critical | 9.8 | 0.0061 | 2023-02-09 | A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects | |
CVE-2023-1357 |
critical | 9.8 | 0.0055 | 2023-03-12 | A vulnerability, which was classified as critical, has been found in SourceCodester Simple Bakery Sh | |
CVE-2024-44065 |
critical | 9.8 | 0.0038 | 2025-12-26 | Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php/logbooka | |
CVE-2023-46453 |
critical | 9.8 | 0.0090 | 2026-05-08 | Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative c | |
CVE-2026-10757 |
critical | 9.8 | 0.0044 | 2026-10-26 | There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows an | |
CVE-2020-21012 |
critical | 9.8 | 0.0350 | 2021-10-01 | Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection | |
CVE-2023-25207 |
critical | 9.8 | 0.0089 | 2023-03-13 | PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php. | |
CVE-2023-30191 |
critical | 9.8 | 0.0076 | 2023-05-17 | PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontContro | |
CVE-2025-65358 |
critical | 9.8 | 0.0041 | 2025-12-02 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the | |
CVE-2026-29198 |
critical | 9.8 | 0.0042 | 2026-04-23 | In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injec | |
CVE-2025-50229 |
critical | 9.8 | 0.0036 | 2026-04-23 | Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module. | |
CVE-2026-45060 |
critical | 9.8 | 0.0044 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/p | |
CVE-2026-48114 |
critical | 9.8 | 0.0037 | 2026-06-15 | Metacat is data repository software that helps researchers preserve, share, and discover data. Versi | |
CVE-2026-9711 |
critical | 9.8 | 0.0054 | 2026-06-30 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to S | |
CVE-2026-13766 |
critical | 9.8 | 0.0055 | 2026-06-30 | DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. | |
CVE-2026-8402 |
critical | 9.8 | 0.0047 | 2026-06-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-52186 |
critical | 9.8 | 0.0069 | 2026-07-01 | SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to e | |
CVE-2026-4321 |
critical | 9.8 | 0.0047 | 2026-07-03 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-8307 |
critical | 9.8 | 0.0047 | 2026-07-08 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-9074 |
critical | 9.8 | 0.0051 | 2026-07-08 | IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated | |
CVE-2026-5955 |
critical | 9.8 | 0.0047 | 2026-07-09 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-2397 |
critical | 9.8 | 0.0048 | 2026-07-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-5801 |
critical | 9.8 | 0.0058 | 2026-07-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-51821 |
critical | 9.8 | 0.0069 | 2026-07-13 | SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacke | |
CVE-2026-62390 |
critical | 9.8 | 0.0069 | 2026-07-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-8297 |
critical | 9.8 | 0.0047 | 2026-07-17 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-57308 |
critical | 9.8 | 0.0083 | 2026-07-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-1617 |
critical | 9.8 | 0.0047 | 2026-07-21 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i |