# CWE-116. Every Advisory and CVE whose sources give the weakness CWE-116, newest first. ## Records, newest first (an older page) - [HTML Injection in Logo Software's Logo Cloud](https://agentprime.io/advisories/CVE-2025-0607.md) `CVE-2025-0607` · CVE record: Logo Software Inc. Logo Cloud · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2025 · Tags: CWE-116 - [get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass](https://agentprime.io/advisories/GHSA-qc2q-qhf3-235m.md) `GHSA-qc2q-qhf3-235m`, `CVE-2025-59936` · npm `get-jwks`: affected `<11.0.2`, fixed in `11.0.2` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2025 · Tags: CWE-116 - [Potential XSS in Extension:BlueSpiceWhoIsOnline](https://agentprime.io/advisories/CVE-2025-57880.md) `CVE-2025-57880` · CVE record: Hallo Welt! GmbH BlueSpice · CVSS 5.9 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-116 - [Potential XSS in Extension:BlueSpiceAvatars](https://agentprime.io/advisories/CVE-2025-48007.md) `CVE-2025-48007` · CVE record: Hallo Welt! GmbH BlueSpice · CVSS 5.9 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-116 - [Potential XSS in Extension:AtMentions](https://agentprime.io/advisories/CVE-2025-46703.md) `CVE-2025-46703` · CVE record: Hallo Welt! GmbH BlueSpice · CVSS 5.9 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-116 - [HTML Injection in Patika Global Technologies' HumanSuite](https://agentprime.io/advisories/CVE-2025-8276.md) `CVE-2025-8276` · CVE record: Patika Global Technologies HumanSuite · CVSS 4.3 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: Other injection, Cross-site scripting (XSS), CWE-116 - [XWiki Remote Macros vulnerable to remote code execution using the confluence paste code macro](https://agentprime.io/advisories/CVE-2025-55730.md) `CVE-2025-55730` · CVE record: xwikisas xwiki-pro-macros · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-116 - [XWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macro](https://agentprime.io/advisories/CVE-2025-55729.md) `CVE-2025-55729` · CVE record: xwikisas xwiki-pro-macros · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-116 - [Element Plus Link component (el-link) implements insufficient input validation for the href attribute](https://agentprime.io/advisories/GHSA-5m5x-9j46-h678.md) `GHSA-5m5x-9j46-h678`, `CVE-2025-57665` · npm `element-plus`: affected `<=2.11.0`, no fixed version yet · CVSS 6.4 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: Cross-site scripting (XSS), Open redirect, CWE-20, CWE-116 - [A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL.](https://agentprime.io/advisories/CVE-2025-56266.md) `CVE-2025-56266` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2025 · Tags: Other injection, HTTP request smuggling, CWE-116 - [Improper output encoding in Google Android](https://agentprime.io/advisories/CVE-2025-0083.md) `CVE-2025-0083` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: CWE-116 - [Duplicate Advisory: Multiple issues involving quote API in shlex](https://agentprime.io/advisories/GHSA-286m-6pg9-v42v.md) `GHSA-286m-6pg9-v42v` · crates.io `shlex`: affected `<1.3.0`, fixed in `1.3.0` · CVSS 3.2 Low · Withdrawn · Not analysed yet · Published 28 Jul 2025 · Tags: CWE-116 - [ETQ Reliance CG < SE.2025.1 Reflected XSS in \`SQLConverterServlet\`](https://agentprime.io/advisories/CVE-2025-34141.md) `CVE-2025-34141` · CVE record: ETQ Reliance CG (legacy) · CVSS 5.1 Medium · Not analysed yet · Published 22 Jul 2025 · Tags: Cross-site scripting (XSS), CWE-116 - [Incorrect parsing of URLs could have allowed embedding of youtube.com](https://agentprime.io/advisories/CVE-2025-6429.md) `CVE-2025-6429` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 24 Jun 2025 · Tags: CWE-116 - [WilderForge vulnerable to code Injection via GitHub Actions Workflows](https://agentprime.io/advisories/CVE-2025-49013.md) `CVE-2025-49013` · CVE record: WilderForge WilderForge · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2025 · Tags: Code injection, CWE-116 - [Discourse vulnerable to HTML injection when inviting to topic via email](https://agentprime.io/advisories/CVE-2025-48062.md) `CVE-2025-48062` · CVE record: discourse discourse · CVSS 7.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: Cross-site scripting (XSS), CWE-116 - [IBM Security Guardium information disclosure](https://agentprime.io/advisories/CVE-2025-25029.md) `CVE-2025-25029` · CVE record: IBM Security Guardium · CVSS 4.9 Medium · Not analysed yet · Published 28 May 2025 · Tags: CWE-116 - [Devtools' preview ignored CSP headers](https://agentprime.io/advisories/CVE-2025-5271.md) `CVE-2025-5271` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 27 May 2025 · Tags: CWE-116 - [Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.](https://agentprime.io/advisories/CVE-2021-25262.md) `CVE-2021-25262` · CVE record: Yandex Browser · CVSS 6.9 Medium · Not analysed yet · Published 21 May 2025 · Tags: CWE-116 - [Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.](https://agentprime.io/advisories/CVE-2021-25254.md) `CVE-2021-25254` · CVE record: Yandex Browser Lite · CVSS 8.2 High · Not analysed yet · Published 21 May 2025 · Tags: CWE-116 - [PX Backup Improper Sanitization Vulnerability](https://agentprime.io/advisories/CVE-2025-1308.md) `CVE-2025-1308` · CVE record: Pure Storage PX Backup · CVSS 8.4 High · Not analysed yet · Published 19 May 2025 · Tags: CWE-116 - [Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow](https://agentprime.io/advisories/GHSA-2qrj-g9hq-chph.md) `GHSA-2qrj-g9hq-chph`, `CVE-2025-47280` · NuGet `Umbraco.Forms` and 1 more: affected `>=7.0.0, <13.4.2 || >=14.0.0, <15.1.2`, fixed in `13.4.2`, `15.1.2` · CVSS 2.3 Low · Not analysed yet · Published 13 May 2025 · Tags: CWE-116 - [Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by adding a special character to the request.](https://agentprime.io/advisories/CVE-2024-56524.md) `CVE-2024-56524` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2025 · Tags: CWE-116 - [Misskey CSS Style Injection Vulnerability In \`MkUrlPreview\`](https://agentprime.io/advisories/CVE-2025-46340.md) `CVE-2025-46340` · CVE record: misskey-dev misskey · CVSS 7.2 High · Not analysed yet · Published 5 May 2025 · Tags: CWE-20, CWE-116 - [Improper output encoding in Bosch Rexroth AG ctrlX OS - Solutions](https://agentprime.io/advisories/CVE-2025-24338.md) `CVE-2025-24338` · CVE record: Bosch Rexroth AG ctrlX OS - Solutions · CVSS 7.1 High · Not analysed yet · Published 30 Apr 2025 · Tags: CWE-116 - [YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution](https://agentprime.io/advisories/GHSA-88xg-v53p-fpvf.md) `GHSA-88xg-v53p-fpvf`, `CVE-2025-46347`, `PKSA-h1d2-xytb-hr36` · Packagist `yeswiki/yeswiki`: affected `<4.5.4`, fixed in `4.5.4` · CVSS 5.8 Medium · Not analysed yet · Published 29 Apr 2025 · Tags: CWE-116 - [org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type](https://agentprime.io/advisories/GHSA-mvgm-3rw2-7j4r.md) `GHSA-mvgm-3rw2-7j4r`, `CVE-2025-32974` · Maven `org.xwiki.platform:xwiki-platform-security-requiredrights-default`: affected `>=15.9-rc-1, <15.10.8 || >=16.0.0-rc-1, <16.2.0`, fixed in `15.10.8`, `16.2.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Apr 2025 · Tags: Privilege escalation, CWE-116 - [Potential local code execution in "copy as cURL" command](https://agentprime.io/advisories/CVE-2025-4084.md) `CVE-2025-4084` · CVE record: Mozilla Firefox and 1 more · CVSS 5.7 Medium · Not analysed yet · Published 29 Apr 2025 · Tags: CWE-116 - [Apache Tomcat Rewrite rule bypass](https://agentprime.io/advisories/GHSA-ff77-26x5-69cr.md) `GHSA-ff77-26x5-69cr`, `BIT-tomcat-2025-31651`, `CVE-2025-31651` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=9.0.76, <9.0.104 || >=10.1.10, <10.1.40 || >=11.0.0-M2, <11.0.6 || >=8.5.0, <=8.5.100`, fixed in `9.0.104`, `10.1.40`, `11.0.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Apr 2025 · Tags: CWE-116, CWE-150 - [Improper output encoding in Dell PowerProtect Data Manager](https://agentprime.io/advisories/CVE-2025-23377.md) `CVE-2025-23377` · CVE record: Dell PowerProtect Data Manager · CVSS 4.2 Medium · Not analysed yet · Published 28 Apr 2025 · Tags: CWE-116 - [XSSes and potential RCE in Special:VersionCompare](https://agentprime.io/advisories/CVE-2025-32078.md) `CVE-2025-32078` · CVE record: The Wikimedia Foundation Mediawiki - Version Compare Extension · CVSS 6.9 Medium · Not analysed yet · Published 11 Apr 2025 · Tags: CWE-116 - [HTML injection in feed output from i18n message](https://agentprime.io/advisories/CVE-2025-32072.md) `CVE-2025-32072` · CVE record: The Wikimedia Foundation Mediawiki Core - Feed Utils · CVSS 6.9 Medium · Not analysed yet · Published 11 Apr 2025 · Tags: CWE-116 - [XSSes in Extension:ConfirmAccount](https://agentprime.io/advisories/CVE-2025-32074.md) `CVE-2025-32074` · CVE record: The Wikimedia Foundation Mediawiki - Confirm Account Extension · CVSS 5.4 Medium · Not analysed yet · Published 11 Apr 2025 · Tags: CWE-116 - [Junos OS: Processing of a specific BGP update causes the SRRD process to crash](https://agentprime.io/advisories/CVE-2025-30657.md) `CVE-2025-30657` · CVE record: Juniper Networks Junos OS · CVSS 6.9 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: CWE-116 - [Django TomSelect incomplete escaping of dangerous characters in widget attributes](https://agentprime.io/advisories/GHSA-785h-76cm-cpmf.md) `GHSA-785h-76cm-cpmf` · PyPI `django-tomselect`: affected `<2025.3.3`, fixed in `2025.3.3` · CVSS 4.0, no score published · Not analysed yet · Published 26 Mar 2025 · Tags: Cross-site scripting (XSS), CWE-116 - [Improper output encoding in Intevation OpenSlides](https://agentprime.io/advisories/CVE-2025-30345.md) `CVE-2025-30345` · CVE record: Intevation OpenSlides · CVSS 3.5 Low · Not analysed yet · Published 21 Mar 2025 · Tags: CWE-116 - [Improper output encoding in Synology DiskStation Manager (DSM) and others](https://agentprime.io/advisories/CVE-2024-50629.md) `CVE-2024-50629` · CVE record: Synology DiskStation Manager (DSM) and 1 more · CVSS 5.3 Medium · EPSS 0.35 · Not analysed yet · Published 19 Mar 2025 · Tags: CWE-116 - [Improper output encoding in Synology DiskStation Manager (DSM) and others](https://agentprime.io/advisories/CVE-2024-10441.md) `CVE-2024-10441` · CVE record: Synology DiskStation Manager (DSM) and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2025 · Tags: CWE-116 - [Mishandling of comma during folding and unicode-encoding of email headers](https://agentprime.io/advisories/CVE-2025-1795.md) `CVE-2025-1795` · CVE record: Python Software Foundation CPython · CVSS 2.3 Low · Not analysed yet · Published 28 Feb 2025 · Tags: CWE-116 - [DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace](https://agentprime.io/advisories/GHSA-hw62-58pr-7wc5.md) `GHSA-hw62-58pr-7wc5`, `CVE-2025-27108` · npm `dom-expressions`: affected `<0.39.5`, fixed in `0.39.5` · CVSS 7.3 High · Not analysed yet · Published 25 Feb 2025 · Tags: Cross-site scripting (XSS), CWE-116 - [Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)](https://agentprime.io/advisories/GHSA-3qxh-p7jc-5xh6.md) `GHSA-3qxh-p7jc-5xh6`, `CVE-2025-27109` · npm `solid-js`: affected `<1.9.4`, fixed in `1.9.4` · CVSS 7.3 High · Not analysed yet · Published 25 Feb 2025 · Tags: Cross-site scripting (XSS), CWE-116 - [Coolify Vulnerable to Reflected XSS on Tag Search](https://agentprime.io/advisories/CVE-2025-24025.md) `CVE-2025-24025` · CVE record: coollabsio coolify · CVSS 1.3 Low · Not analysed yet · Published 24 Jan 2025 · Tags: CWE-116 - [MathLive's Lack of Escaping of HTML allows for XSS](https://agentprime.io/advisories/GHSA-qwj6-q94f-8425.md) `GHSA-qwj6-q94f-8425`, `CVE-2025-29049` · npm `mathlive`: affected `<0.104.0`, fixed in `0.104.0` · CVSS 6.3 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: Cross-site scripting (XSS), CWE-116 - [WordPress Poll Maker Plugin < 5.5.5 - HTML Injection vulnerability](https://agentprime.io/advisories/CVE-2024-56277.md) `CVE-2024-56277` · CVE record: Ays Pro Poll Maker · CVSS 5.3 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: CWE-116 - [KaTeX \htmlData does not validate attribute names](https://agentprime.io/advisories/GHSA-cg87-wmx4-v546.md) `GHSA-cg87-wmx4-v546`, `CVE-2025-23207` · npm `katex`: affected `>=0.12.0, <0.16.21`, fixed in `0.16.21` · CVSS 6.3 Medium · Not analysed yet · Published 17 Jan 2025 · Tags: Cross-site scripting (XSS), CWE-116 - [The sideband payload is passed unfiltered to the terminal in git](https://agentprime.io/advisories/CVE-2024-52005.md) `CVE-2024-52005` · CVE record: git git · CVSS 7.5 High · Not analysed yet · Published 15 Jan 2025 · Tags: CWE-116, CWE-150 - [Git does not sanitize URLs when asking for credentials interactively](https://agentprime.io/advisories/CVE-2024-50349.md) `CVE-2024-50349` · CVE record: git git · CVSS 2.1 Low · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-116, CWE-147, CWE-150 - [Newline confusion in credential helpers can lead to credential exfiltration in git](https://agentprime.io/advisories/CVE-2024-52006.md) `CVE-2024-52006` · CVE record: git git · CVSS 2.1 Low · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-116, CWE-147, CWE-150 - [Koji Cross-site Scripting](https://agentprime.io/advisories/GHSA-g2vg-8hfg-79vj.md) `GHSA-g2vg-8hfg-79vj`, `CVE-2024-9427`, `PYSEC-2026-1501` · PyPI `koji`: affected `<1.33.2 || >=1.34.0, <1.34.3 || >=1.35.0, <1.35.1`, fixed in `1.33.2`, `1.34.3`, `1.35.1` · CVSS 5.4 Medium · Not analysed yet · Published 24 Dec 2024 · Tags: CWE-116 - [XWiki Platform has an SQL injection in getdocuments.vm with sort parameter](https://agentprime.io/advisories/GHSA-wh34-m772-5398.md) `GHSA-wh34-m772-5398`, `CVE-2024-55663` · Maven `org.xwiki.platform:xwiki-platform-distribution-war`: affected `>=6.3-milestone-2, <13.10.5 || >=14.0-rc-1, <14.3-rc-1`, fixed in `13.10.5`, `14.3-rc-1` · CVSS 8.6 High · Not analysed yet · Published 12 Dec 2024 · Tags: CWE-116 - [Apache Subversion: mod_dav_svn denial-of-service via control characters in paths](https://agentprime.io/advisories/CVE-2024-46901.md) `CVE-2024-46901` · CVE record: Apache Software Foundation Apache Subversion · CVSS 3.1 Low · Not analysed yet · Published 9 Dec 2024 · Tags: CWE-20, CWE-116 - [A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized users could access sensitive information due to improper access control valida…](https://agentprime.io/advisories/CVE-2024-46547.md) `CVE-2024-46547` · CVE record · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2024 · Tags: CWE-116 - [Improper output encoding in Google Android](https://agentprime.io/advisories/CVE-2018-9433.md) `CVE-2018-9433` · CVE record: Google Android · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Nov 2024 · Tags: CWE-116 - [Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability](https://agentprime.io/advisories/GHSA-5c4w-8hhh-3c3h.md) `GHSA-5c4w-8hhh-3c3h`, `BIT-consul-2024-10006`, `CVE-2024-10006`, `GO-2024-3241` · Go `github.com/hashicorp/consul`: affected `>=1.9.0, <1.20.1`, fixed in `1.20.1` · CVSS 8.3 High · Not analysed yet · Published 31 Oct 2024 · Tags: CWE-116, CWE-644 - [A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a CRLF injection attack d…](https://agentprime.io/advisories/CVE-2024-47224.md) `CVE-2024-47224` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2024 · Tags: CWE-116 - [A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to enumerate the existence and length of any file in the file…](https://agentprime.io/advisories/CVE-2024-40088.md) `CVE-2024-40088` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2024 · Tags: Cross-site scripting (XSS), CWE-116 - [Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view](https://agentprime.io/advisories/CVE-2024-9348.md) `CVE-2024-9348` · CVE record: Docker Docker Desktop · CVSS 8.9 High · Not analysed yet · Published 16 Oct 2024 · Tags: CWE-20, CWE-116 - [Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure](https://agentprime.io/advisories/CVE-2024-45219.md) `CVE-2024-45219` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.5 High · Not analysed yet · Published 16 Oct 2024 · Tags: CWE-20, CWE-116 - [An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can hav…](https://agentprime.io/advisories/CVE-2023-45359.md) `CVE-2023-45359` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 9 Oct 2024 · Tags: CWE-116 - [CSS sanitizer used incorrectly, and is easily bypassed](https://agentprime.io/advisories/CVE-2024-47845.md) `CVE-2024-47845` · CVE record: The Wikimedia Foundation Mediawiki - CSS Extension · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2024 · Tags: CWE-116 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .