CWE-93

283 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 27High 77Medium 161Low 17Not scored 1

CVEs per yearBy the year they were published

CVE-2025-61884
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14.…
Oracle Corporation · Oracle Configurator
ExploitedHigh7.5

CVE-2026-57154
OPNsense: Configuration line injection via multiple GUI text fields
opnsense · core
High8.1
CVE-2026-121432
AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist
AzuraCast · AzuraCast
Medium5.1
CVE-2026-13575
HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI
http-session
Not scored
CVE-2026-119560
OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
opnsense · core
Medium6.0
CVE-2026-119424
OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
opnsense · core
Medium6.1
CVE-2026-119417
CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport
cakephp · cakephp
Medium6.3
CVE-2026-119415
CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type
cakephp · cakephp
Medium6.3
CVE-2026-115303
Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping
Unknown · Contact Form by Supsystic
Low3.7
CVE-2026-118372
LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
OpenBSD · LibreSSL
Medium6.3
CVE-2026-118371
LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line
OpenBSD · LibreSSL
Medium6.3