CWE-20 · Improper Input Validation (page 17)
Page 17 of 100 — CVEs classified under CWE-20, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8571 | Medium | 4.8 | 2025-08-05 | Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitiz… |
CVE-2025-7674 | | 2025-08-05 | Improper Input Validation vulnerability in Roche Diagnostics navify Monitoring allows an attacker to manipulate input data, which may lead to a denial of servi… | |
CVE-2025-27212 | Critical | 9.8 | 2025-08-04 | An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management networ… |
CVE-2025-27211 | High | 7.5 | 2025-08-04 | An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch… |
CVE-2024-52279 | Medium | 5.3 | 2025-08-03 | Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input. This issu… |
CVE-2025-54564 | High | 7.8 | 2025-08-01 | uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution as the nobody user. |
CVE-2011-10008 | | 2025-07-31 | A stack-based buffer overflow vulnerability exists in MPlayer Lite r33064 due to improper bounds checking when handling M3U playlist files containing long http… | |
CVE-2025-30480 | Medium | 6.5 | 2025-07-30 | Dell PowerProtect Data Manager, versions prior to 19.19, contain(s) an Improper Input Validation vulnerability in PowerProtect Data Manager. A low privileged a… |
CVE-2025-50578 | Critical | 9.8 | 2025-07-30 | LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer`. An un… |
CVE-2025-4424 | Medium | 6.0 | 2025-07-30 | The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for… |
CVE-2025-43253 | Critical | 9.8 | 2025-07-30 | This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. A malicious app may be able to launch… |
CVE-2025-43234 | Critical | 9.8 | 2025-07-30 | Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6… |
CVE-2025-43223 | High | 7.5 | 2025-07-30 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, mac… |
CVE-2025-43195 | Medium | 5.5 | 2025-07-30 | An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6, macOS… |
CVE-2025-31281 | Critical | 9.1 | 2025-07-30 | An input validation issue was addressed with improved memory handling. This issue is fixed in iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS… |
CVE-2025-50492 | High | 7.5 | 2025-07-28 | Improper session invalidation in the component /edms/change-password.php of PHPGurukul e-Diary Management System v1 allows attackers to execute a session hijac… |
CVE-2025-50489 | High | 7.5 | 2025-07-28 | Improper session invalidation in the component /srms/change-password.php of PHPGurukul Student Result Management System v2.0 allows attackers to execute a sess… |
CVE-2025-50494 | High | 7.5 | 2025-07-28 | Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Car Washing Management System v1.0 allows attackers to execute a sessi… |
CVE-2025-50493 | High | 7.5 | 2025-07-28 | Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management System v1 allows attackers to execute a… |
CVE-2025-50490 | High | 7.5 | 2025-07-28 | Improper session invalidation in the component /elms/emp-changepassword.php of PHPGurukul Student Result Management System v2.0 allows attackers to execute a s… |
CVE-2025-8266 | Medium | 6.3 | 2025-07-28 | A vulnerability has been found in yanyutao0402 ChanCMS up to 3.1.2 and classified as critical. Affected by this vulnerability is the function getArticle of the… |
CVE-2025-8227 | Medium | 6.3 | 2025-07-27 | A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-8097 | Medium | 5.3 | 2025-07-26 | The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation… |
CVE-2025-54385 | Critical | 9.8 | 2025-07-26 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions… |
CVE-2014-125119 | | 2025-07-25 | A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Dir… | |
CVE-2014-125117 | Critical | 9.8 | 2025-07-25 | A stack-based buffer overflow vulnerability in the my_cgi.cgi component of certain D-Link devices, including the DSP-W215 version 1.02, can be exploited via a… |
CVE-2014-125114 | | 2025-07-25 | A stack-based buffer overflow vulnerability exists in i-Ftp version 2.20 due to improper handling of the Time attribute within Schedule.xml. By placing a speci… | |
CVE-2025-54365 | High | 7.5 | 2025-07-23 | fastapi-guard is a security library for FastAPI that provides middleware to control IPs, log requests, detect penetration attempts and more. In version 3.0.1… |
CVE-2025-47281 | High | 7.7 | 2025-07-23 | Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists d… |
CVE-2025-6585 | High | 8.1 | 2025-07-22 | The WP JobHunt plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.2 via the cs_remove_profile_callb… |
CVE-2025-54134 | Medium | 6.5 | 2025-07-21 | HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when… |
CVE-2025-50151 | High | 8.8 | 2025-07-21 | File access paths in configuration files uploaded by users with administrator access are not validated. This issue affects Apache Jena version up to 5.4.0. U… |
CVE-2025-7876 | Medium | 6.3 | 2025-07-20 | A vulnerability classified as critical was found in Metasoft 美特软件 MetaCRM up to 6.4.2. This vulnerability affects the function AnalyzeParam of the file downloa… |
CVE-2025-34132 | | 2025-07-16 | A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 via the Server field in the NT… | |
CVE-2025-34129 | | 2025-07-16 | A command injection vulnerability exists in LILIN Digital Video Recorder (DVR) devices prior to firmware version 2.0b60_20200207 due to insufficient sanitizati… | |
CVE-2025-34124 | | 2025-07-16 | A buffer overflow vulnerability exists in Heroes of Might and Magic III Complete 4.0.0.0, HD Mod 3.808 build 9, and Demo 1.0.0.0 via malicious .h3m map files t… | |
CVE-2025-34123 | | 2025-07-16 | A stack-based buffer overflow vulnerability exists in VideoCharge Studio 2.12.3.685 when processing a specially crafted .VSC configuration file. The issue occu… | |
CVE-2025-34118 | | 2025-07-16 | A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticate… | |
CVE-2025-34300 | | 2025-07-16 | A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web app… | |
CVE-2025-6558 | High | 8.8 | 2025-07-15 | Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox… |
CVE-2025-34116 | | 2025-07-15 | A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI interface. An authenticated attacker can… | |
CVE-2025-34115 | | 2025-07-15 | An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A us… | |
CVE-2025-34113 | | 2025-07-15 | An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the `viewmode` GET parameter in `t… | |
CVE-2025-34111 | Critical | 9.8 | 2025-07-15 | An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connecto… |
CVE-2025-34108 | | 2025-07-15 | A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. An attacker can send a specially crafted… | |
CVE-2025-34105 | | 2025-07-15 | A stack-based buffer overflow vulnerability exists in the built-in web interface of DiskBoss Enterprise versions 7.4.28, 7.5.12, and 8.2.14. The vulnerability… | |
CVE-2025-47182 | Medium | 5.6 | 2025-07-11 | Improper input validation in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally. |
CVE-2025-5992 | | 2025-07-11 | When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for example, this can happen when passing… | |
CVE-2025-53471 | Medium | 5.1 | 2025-07-11 | Emerson ValveLink products receive input or data, but does not validate or incorrectly validates that the input has the properties that are required to proce… |
CVE-2025-34102 | | 2025-07-10 | A remote code execution vulnerability exists in CryptoLog (PHP version, discontinued since 2009) due to a chained exploitation of SQL injection and command inj… | |
CVE-2025-34101 | | 2025-07-10 | An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action API endpoint exposed… | |
CVE-2025-34100 | | 2025-07-10 | An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File Upl… | |
CVE-2025-34099 | | 2025-07-10 | An unauthenticated command injection vulnerability exists in VICIdial versions 2.9 RC1 through 2.13 RC1, within the vicidial_sales_viewer.php component when pa… | |
CVE-2024-42516 | High | 7.5 | 2025-07-10 | HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or pro… |
CVE-2025-6377 | High | 7.8 | 2025-07-09 | A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries… |
CVE-2025-6376 | High | 7.8 | 2025-07-09 | A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries… |
CVE-2025-53652 | High | 8.2 | 2025-07-09 | Jenkins Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered c… |
CVE-2025-44526 | Medium | 6.5 | 2025-07-09 | Realtek RTL8762EKF-EVB RTL8762E SDK V1.4.0 was discovered to utilize insufficient permission checks on critical fields within Bluetooth Low Energy (BLE) data p… |
CVE-2025-7378 | | 2025-07-09 | An improper Input Validation vulnerability allows injecting arbitrary values of the NAS configuration file in ASUSTOR ADM. This could potentially lead to syste… | |
CVE-2025-7216 | High | 7.3 | 2025-07-09 | A vulnerability, which was classified as critical, was found in lty628 Aidigu up to 1.8.2. This affects the function checkUserCookie of the file /application/c… |
CVE-2025-49719 | High | 7.5 | 2025-07-08 | Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network. |
CVE-2025-47982 | High | 7.8 | 2025-07-08 | Improper input validation in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-40593 | Medium | 6.5 | 2025-07-08 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0). The affected application allows to control the device by storing arbitrary files… |
CVE-2025-24005 | High | 7.8 | 2025-07-08 | A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation. |
CVE-2025-24002 | Medium | 5.3 | 2025-07-08 | An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporar… |
CVE-2025-26780 | High | 7.5 | 2025-07-07 | An issue was discovered in L2 in Samsung Mobile Processor and Modem Exynos 2400 and Modem 5400. The lack of a length check leads to a Denial of Service via a m… |
CVE-2025-3777 | Low | 3.5 | 2025-07-07 | Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability aris… |
CVE-2025-7099 | Medium | 5.6 | 2025-07-07 | A vulnerability has been found in BoyunCMS up to 1.21 on PHP7 and classified as critical. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-7060 | Medium | 4.1 | 2025-07-04 | A vulnerability was found in Monitorr up to 1.7.6m. It has been classified as problematic. This affects an unknown part of the file assets/config/_installation… |
CVE-2025-53502 | Medium | 6.5 | 2025-07-03 | Improper Input Validation vulnerability in Wikimedia Foundation Mediawiki - FeaturedFeeds Extension allows Cross-Site Scripting (XSS).This issue affects Mediaw… |
CVE-2025-6563 | | 2025-07-03 | A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protoco… | |
CVE-2025-52891 | Medium | 6.5 | 2025-07-02 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML… |
CVE-2025-34072 | | 2025-07-02 | A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. When an AI agent usi… | |
CVE-2025-27023 | Medium | 6.5 | 2025-07-02 | Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users to read all OS files via crafted CLI… |
CVE-2025-34060 | | 2025-07-01 | A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image… | |
CVE-2025-34056 | | 2025-07-01 | An OS command injection vulnerability exists in AVTECH IP camera, DVR, and NVR devices via the PwdGrp.cgi endpoint, which handles user and group management ope… | |
CVE-2025-34055 | | 2025-07-01 | An OS command injection vulnerability exists in AVTECH DVR, NVR, and IP camera devices within the adcommand.cgi endpoint, which interfaces with the ActionD dae… | |
CVE-2025-53076 | Critical | 9.8 | 2025-06-30 | Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLottie: V0.2. |
CVE-2025-53075 | Critical | 9.8 | 2025-06-30 | Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2. |
CVE-2025-5878 | High | 7.3 | 2025-06-29 | A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection… |
CVE-2023-28911 | Medium | 6.5 | 2025-06-28 | A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which c… |
CVE-2025-34047 | | 2025-06-26 | A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the unde… | |
CVE-2025-34043 | | 2025-06-26 | A remote command injection vulnerability exists in Vacron Network Video Recorder (NVR) devices v1.4 due to improper input sanitization in the board.cgi script… | |
CVE-2025-6709 | High | 7.5 | 2025-06-26 | The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentic… |
CVE-2025-6703 | Medium | 6.5 | 2025-06-26 | Improper Input Validation vulnerability in Mozilla neqo leads to an unexploitable crash..This issue affects neqo: from 0.4.24 through 0.13.2. |
CVE-2025-6444 | Medium | 5.9 | 2025-06-25 | ServiceStack GetErrorResponse Improper Input Validation NTLM Relay Vulnerability. This vulnerability allows remote attackers to relay NTLM credentials on affec… |
CVE-2025-52894 | High | 7.5 | 2025-06-25 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0… |
CVE-2025-52569 | | 2025-06-25 | GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 5.9.1 lack input validation of input validation for user-provided value… | |
CVE-2025-50178 | | 2025-06-25 | GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 0.4.3 lack input validation for user provided values in certain functio… | |
CVE-2025-52568 | | 2025-06-24 | NeKernal is a free and open-source operating system stack. Prior to version 0.0.3, there are several memory safety issues that can lead to memory corruption, d… | |
CVE-2025-6547 | | 2025-06-23 | Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2. | |
CVE-2025-6545 | | 2025-06-23 | Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-… | |
CVE-2025-4563 | Low | 2.7 | 2025-06-23 | A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicRes… |
CVE-2025-34021 | | 2025-06-20 | A server-side request forgery (SSRF) vulnerability exists in multiple Selea Targa IP OCR-ANPR camera models, including iZero, Targa 512, Targa 504, Targa Sempl… | |
CVE-2025-6279 | Medium | 5.5 | 2025-06-19 | A vulnerability, which was classified as critical, has been found in Upsonic up to 0.55.6. This issue affects the function cloudpickle.loads of the file /tools… |
CVE-2025-29646 | High | 7.1 | 2025-06-18 | An issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of Service via a crafted PFCP SessionEstablishmentRequest packet with r… |
CVE-2025-6240 | | 2025-06-18 | Improper Input Validation vulnerability in Profisee on Windows (filesystem modules) allows Path Traversal after authentication to the Profisee system.This issu… | |
CVE-2025-1088 | Low | 2.7 | 2025-06-18 | In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerabilit… |
CVE-2025-49081 | Medium | 4.9 | 2025-06-12 | There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55. Attackers with syst… |
CVE-2024-55567 | High | 7.5 | 2025-06-12 | Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62.01, and 5.7 before… |