CWE-20 · Improper Input Validation (page 15)
Page 15 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13319 | High | 8.8 | 2025-11-17 | An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted… |
CVE-2025-10460 | | 2025-11-17 | A SQL Injection vulnerability on an endpoint in BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, allows an unautho… | |
CVE-2025-64747 | Medium | 5.5 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting (XSS) vulnerability exists in versions prior to… |
CVE-2024-47866 | High | 7.5 | 2025-11-12 | Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object… |
CVE-2024-45301 | Medium | 5.3 | 2025-11-12 | Mintty is a terminal emulator for Cygwin, MSYS, and WSL. In versions 2.3.6 through 3.7.4, several escape sequences can cause the mintty process to access a fil… |
CVE-2025-62222 | High | 8.8 | 2025-11-11 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacke… |
CVE-2025-33000 | High | 8.8 | 2025-11-11 | Improper input validation for some Intel QuickAssist Technology before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. Sys… |
CVE-2025-31948 | Low | 3.3 | 2025-11-11 | Improper input validation for some Intel(R) oneAPI Math Kernel Library before version 2025.2 within Ring 3: User Applications may allow a denial of service. Un… |
CVE-2025-30509 | Low | 3.8 | 2025-11-11 | Improper input validation for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allow an escalation of privi… |
CVE-2025-25216 | Low | 3.3 | 2025-11-11 | Improper input validation in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may allow a denial of service… |
CVE-2025-24847 | Medium | 4.5 | 2025-11-11 | Improper input validation for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosur… |
CVE-2025-24512 | Medium | 5.6 | 2025-11-11 | Improper input validation for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of… |
CVE-2025-24299 | High | 8.8 | 2025-11-11 | Improper input validation for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privile… |
CVE-2025-20056 | Medium | 4.4 | 2025-11-11 | Improper input validation for some Intel VTune Profiler before version 2025.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileg… |
CVE-2025-12944 | High | 8.8 | 2025-11-11 | Improper input validation in NETGEAR DGN2200v4 (N300 Wireless ADSL2+ Modem Router) allows attackers with direct network access to the device to potentially exe… |
CVE-2025-12942 | High | 7.5 | 2025-11-11 | Improper Input Validation vulnerability in NETGEAR R6260 and NETGEAR R6850 allows unauthenticated attackers connected to LAN with ability to perform MiTM attac… |
CVE-2025-63397 | Medium | 6.5 | 2025-11-10 | Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence to the native code during broadcasting/… |
CVE-2025-12908 | Medium | 5.4 | 2025-11-08 | Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform domain spoofing… |
CVE-2025-12907 | High | 8.8 | 2025-11-08 | Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user act… |
CVE-2025-63785 | Medium | 6.1 | 2025-11-07 | A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerability occurs because… |
CVE-2025-63783 | High | 7.6 | 2025-11-07 | A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web ap… |
CVE-2025-48985 | Low | 3.7 | 2025-11-07 | A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitel… |
CVE-2025-64176 | Medium | 5.3 | 2025-11-06 | ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish… |
CVE-2025-61084 | High | 7.1 | 2025-11-05 | MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA. An attacker can cra… |
CVE-2025-59596 | Medium | 6.5 | 2025-11-04 | CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addressed in version 14.12. If a local net… |
CVE-2025-59595 | High | 7.5 | 2025-11-04 | CVE-2025-59595 is an internally discovered denial of service vulnerability in versions of Secure Access prior to 14.12. An attacker can send a specially craf… |
CVE-2025-62507 | High | 8.8 | 2025-11-04 | Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigg… |
CVE-2025-54327 | Medium | 6.5 | 2025-11-04 | An issue was discovered in VTS in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1380, W920, W930, W1000. Improper input validation in the… |
CVE-2025-43472 | High | 7.8 | 2025-11-04 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app m… |
CVE-2025-43458 | Medium | 4.3 | 2025-11-04 | This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS T… |
CVE-2025-43430 | Medium | 4.3 | 2025-11-04 | This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS… |
CVE-2025-43427 | Medium | 4.3 | 2025-11-04 | This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS… |
CVE-2025-43401 | High | 7.5 | 2025-11-04 | A denial-of-service issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. A remote… |
CVE-2025-43365 | Low | 2.8 | 2025-11-04 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26 and iPadOS 26. An unprivile… |
CVE-2025-43348 | Medium | 5.5 | 2025-11-04 | A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may bypass Gat… |
CVE-2025-64385 | | 2025-10-31 | The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manu… | |
CVE-2025-61235 | Critical | 9.1 | 2025-10-28 | An issue was discovered in Dataphone A920 v2025.07.161103. A custom packet based on public documentation can be crafted, where some fields can contain arbitrar… |
CVE-2025-12305 | Medium | 6.3 | 2025-10-27 | A vulnerability was found in quequnlong shiyi-blog up to 1.2.1. This impacts an unknown function of the file src/main/java/com/mojian/controller/SysJobControll… |
CVE-2025-27224 | Critical | 9.8 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. However, the application doesn't properly sanitize the inp… |
CVE-2025-12285 | Critical | 9.8 | 2025-10-26 | Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12284 | Medium | 6.1 | 2025-10-26 | Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12278 | Medium | 6.5 | 2025-10-26 | Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12275 | Critical | 9.8 | 2025-10-26 | Mail Configuration File Manipulation + Command Execution.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-11497 | Medium | 4.3 | 2025-10-25 | The Advanced Database Cleaner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.6. This is due to miss… |
CVE-2025-60938 | High | 7.5 | 2025-10-24 | Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the ta… |
CVE-2025-11958 | Medium | 4.1 | 2025-10-22 | An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a… |
CVE-2025-62525 | High | 7.9 | 2025-10-22 | OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory usin… |
CVE-2025-12001 | Medium | 6.1 | 2025-10-20 | Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-26781 | High | 7.5 | 2025-10-20 | An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 9110… |
CVE-2025-11938 | Medium | 5.6 | 2025-10-19 | A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of t… |
CVE-2025-8414 | | 2025-10-17 | Due to improper input validation, a buffer overflow vulnerability is present in Zigbee EZSP Host Applications. If the buffer overflows, stack corruption is p… | |
CVE-2025-60537 | Medium | 6.5 | 2025-10-14 | Improper input validation in the component /kafka/ui/serdes/CustomSerdeLoader.java of kafka-ui v0.6.0 to v0.7.2 allows attackers to execute arbitrary code via… |
CVE-2025-59250 | High | 8.1 | 2025-10-14 | Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-59248 | High | 7.5 | 2025-10-14 | Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-59228 | High | 8.8 | 2025-10-14 | Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-59207 | High | 7.8 | 2025-10-14 | Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-59198 | Medium | 5.0 | 2025-10-14 | Improper input validation in Microsoft Windows Search Component allows an authorized attacker to deny service locally. |
CVE-2025-59190 | Medium | 5.5 | 2025-10-14 | Improper input validation in Microsoft Windows Search Component allows an unauthorized attacker to deny service locally. |
CVE-2025-59187 | High | 7.8 | 2025-10-14 | Improper input validation in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-58716 | High | 8.8 | 2025-10-14 | Improper input validation in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. |
CVE-2025-55692 | High | 7.8 | 2025-10-14 | Improper input validation in Windows Error Reporting allows an authorized attacker to elevate privileges locally. |
CVE-2025-55679 | Medium | 5.1 | 2025-10-14 | Improper input validation in Windows Kernel allows an unauthorized attacker to disclose information locally. |
CVE-2025-9066 | | 2025-10-14 | A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certain SOAP requests can be abused to perfor… | |
CVE-2011-20001 | High | 7.5 | 2025-10-14 | A vulnerability has been identified in SIMATIC S7-1200 CPU V1 family (incl. SIPLUS variants) (All versions < V2.0.3), SIMATIC S7-1200 CPU V2 family (incl. SIPL… |
CVE-2025-31995 | Low | 3.5 | 2025-10-13 | HCL Unica MaxAI Workbench is vulnerable to improper input validation. This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command… |
CVE-2025-62162 | High | 7.5 | 2025-10-10 | cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL exp… |
CVE-2025-61920 | High | 7.5 | 2025-10-10 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT head… |
CVE-2025-27040 | Medium | 6.5 | 2025-10-09 | Information disclosure may occur while processing the hypervisor log. |
CVE-2025-61768 | | 2025-10-06 | KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF (Server-Side Request Forgery) vulnerability exists in the Medi… | |
CVE-2025-11346 | Medium | 6.3 | 2025-10-06 | A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler. Such manipulation… |
CVE-2025-11345 | Medium | 5.5 | 2025-10-06 | A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This manipulation causes… |
CVE-2025-11273 | Medium | 6.3 | 2025-10-04 | A vulnerability was found in LaChatterie Verger up to 1.2.10. This impacts the function redirectToAuthorization of the file /src/main/services/mcp/oauth/provid… |
CVE-2025-60787 | High | 7.2 | 2025-10-03 | MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to… |
CVE-2025-34226 | | 2025-10-03 | OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epoch_time field supplied during program uploads is not valida… | |
CVE-2025-61583 | Medium | 4.3 | 2025-10-01 | TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A reflected cross-site scripting vulnerability has been identified in versions 2.2.1 an… |
CVE-2025-61582 | High | 7.5 | 2025-10-01 | TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A Denial of Dervice vulnerability has been identified in versions 2.2.1 and earlier. Th… |
CVE-2025-59537 | High | 7.5 | 2025-10-01 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1… |
CVE-2025-11226 | | 2025-10-01 | ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attac… | |
CVE-2025-11195 | Low | 3.3 | 2025-09-30 | Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in th… |
CVE-2025-59952 | | 2025-09-30 | MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio… | |
CVE-2025-59940 | Medium | 6.5 | 2025-09-29 | mkdocs-include-markdown-plugin is an Mkdocs Markdown includer plugin. In versions 7.1.7 and below, there is a vulnerability where unvalidated input can collide… |
CVE-2025-11135 | High | 7.3 | 2025-09-29 | A vulnerability was detected in pmTicket Project-Management-Software up to 2ef379da2075f4761a2c9029cf91d073474e7486. The affected element is the function loadL… |
CVE-2025-10975 | Medium | 6.3 | 2025-09-25 | A vulnerability was found in GuanxingLu vlarl up to 31abc0baf53ef8f5db666a1c882e1ea64def2997. This vulnerability affects the function experiments.robot.bridge… |
CVE-2025-10974 | Medium | 6.3 | 2025-09-25 | A vulnerability has been found in giantspatula SewKinect up to 7fd963ceb3385af3706af02b8a128a13399dffb1. This affects the function pickle.loads of the file /ca… |
CVE-2025-10965 | Medium | 6.3 | 2025-09-25 | A security vulnerability has been detected in LazyAGI LazyLLM up to 0.6.1. Affected by this issue is the function lazyllm_call of the file lazyllm/components/d… |
CVE-2025-40836 | Critical | 9.8 | 2025-09-25 | Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute commands with escalated pr… |
CVE-2025-10950 | Medium | 6.3 | 2025-09-25 | A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected is the function log_handler of the file ml_logger/s… |
CVE-2025-52907 | High | 8.8 | 2025-09-24 | Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This issue affects X6000R: through V9.4.0cu.1360_B202412… |
CVE-2025-47314 | High | 7.8 | 2025-09-24 | Memory corruption while processing data sent by FE driver. |
CVE-2025-52905 | High | 7.5 | 2025-09-23 | Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R: through V9.4.0cu.1360_B20241207. |
CVE-2025-59535 | Medium | 6.5 | 2025-09-22 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be… |
CVE-2025-59532 | | 2025-09-22 | Codex CLI is a coding agent from OpenAI that runs locally. In versions 0.2.0 to 0.38.0, due to a bug in the sandbox configuration logic, Codex CLI could treat… | |
CVE-2025-10771 | Medium | 6.3 | 2025-09-21 | A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the c… |
CVE-2025-10770 | Medium | 6.3 | 2025-09-21 | A vulnerability was found in jeecgboot JimuReport up to 2.1.2. This impacts an unknown function of the file /drag/onlDragDataSource/testConnection of the compo… |
CVE-2025-10769 | Medium | 6.3 | 2025-09-21 | A vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. S… |
CVE-2025-10768 | Medium | 6.3 | 2025-09-21 | A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Dri… |
CVE-2025-57644 | Critical | 9.1 | 2025-09-19 | Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbit… |
CVE-2025-57528 | High | 7.7 | 2025-09-19 | An issue was discovered in Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01 allowing attackers to cause a denial of service via the funcname, funcpara1, funcpara… |
CVE-2025-58114 | Medium | 4.8 | 2025-09-19 | Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).This issue affects… |
CVE-2025-10630 | Medium | 4.3 | 2025-09-19 | Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix a… |