CWE-75

36 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 11High 16Medium 8Low 1Not scored 0

CVEs per yearBy the year they were published

CVE-2024-58362
SurrealDB before 1.5.5 Query Injection via RPC API
surrealdb · surrealdb
High8.7
CVE-2026-54771
Langroid: handle_message() executes user-supplied tool JSON without sender verification
langroid · langroid
High8.1
CVE-2026-31908
Apache APISIX: forward auth plugin allows header injection
Apache Software Foundation · Apache APISIX
Critical9.1
CVE-2026-29042
Nuclio Shell Runtime Command Injection Leading to Privilege Escalation
nuclio · nuclio
High8.9
CVE-2026-27120
Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster
vapor · leaf-kit
Medium6.1
CVE-2024-27708
Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src…
Product not named
Critical9.6
CVE-2025-61911
python-ldap has sanitization bypass in ldap.filter.escape_filter_chars
python-ldap · python-ldap
Medium5.5
CVE-2025-50213
Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator
Apache Software Foundation · Apache Airflow Providers Snowflake
Critical9.8
CVE-2024-9940
Calculated Fields Form <= 5.2.45 - HTML Injection
codepeople · Calculated Fields Form
Medium5.3
CVE-2024-37779
WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script functionality.
Product not named
High8.8