Advisories · Weakness
CWE-707.
Every Advisory and CVE whose sources give the weakness CWE-707, newest first.
- CVSS 8.8 High
Improper Neutralization in Splunk SOAR
- Splunk SOAR
- CWE-707
- CVSS 9.9 CriticalCritical · CVSS 9+
Security Hardening in Splunk Enterprise - October 2026
- Splunk Enterprise
- CWE-707
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper Neutralization in Splunk Enterprise
- Splunk Enterprise
- CWE-707
- CVSS 9.8 CriticalCritical · CVSS 9+
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization Vulnerabilities
- Cisco Application Policy Infrastructure Controller (APIC)
- CWE-707
- CVSS 8.8 High
Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Neutralization Vulnerabilities
- Cisco NX-OS Software
- Cisco NX-OS System Software in ACI Mode
- CWE-707
- CVSS 6.9 Medium
halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization
- Halo
- CWE-20
- CWE-707
- CVSS 9.9 CriticalCritical · CVSS 9+
Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Neutralization Vulnerabilities
- Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
- Cisco Secure Firewall Management Center (FMC)
- CWE-707
- CVSS 5.1 Medium
a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection
- a2ui
- Other injection
- CWE-707
- CVSS 9.8 CriticalCritical · CVSS 9+
Cisco Secure Email Gateway Security Hardening Release
- Cisco Secure Email
- Cisco Secure Email and Web Manager
- CWE-707
- CVSS 8.8 High
Cisco IOS XR Software Security Hardening Release: September 2026
- Cisco IOS XR Software
- CWE-707
- CVSS 2.3 Low
GreyDGL PentestGPT Web-Page Crawling injection
- GreyDGL PentestGPT
- Other injection
- CWE-707
- CVSS 9.3 CriticalCritical · CVSS 9+
GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection
- GL-iNet GL-MT3000
- Other injection
- CWE-707
- CVSS 8.6 High
Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption
- WSO2 Universal Gateway
- WSO2 Traffic Manager
- CWE-707
- CVSS 6.9 Medium
erzhongxmu JeeWMS JimuReport test-connection Endpoint testConnection injection
- erzhongxmu JeeWMS
- Other injection
- CWE-707
- CVSS 5.3 Medium
ahujasid blender-mcp server.py open injection
- ahujasid blender-mcp
- Other injection
- CWE-707
- CVSS 5.3 Medium
hermes-agent has an Injection issue
- Other injection
- CWE-707
<0.15.0 · fixed in 0.15.0
GHSA-33qv-c5qm-799v · CVE-2026-10223 - CVSS 6.9 Medium
hermes-agent has an Injection issue
- Other injection
- CWE-707
<=0.19.0 · no fixed version yet
GHSA-xq8w-9jvx-gm3v · CVE-2026-10221 - CVSS 6.3 Medium
hermes-agent has an Injection issue
- Other injection
- CWE-707
<0.18.0 · fixed in 0.18.0
GHSA-mv8x-fg99-32mf · CVE-2026-10222 - CVSS 6.9 Medium
NousResearch hermes-agent skills_tool.py skill_view injection
- NousResearch hermes-agent
- Other injection
- CWE-707
- CVSS 5.3 Medium
AstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injection
- AstrBot
- Other injection
- CWE-707
- CVSS 6.9 Medium
hermes-agent has an Injection issue
- Other injection
- CWE-707
<0.15.0 · fixed in 0.15.0
GHSA-pgp4-xr4j-h5cg · CVE-2026-9366 - CVSS 6.9 Medium
hermes-agent has an Injection issue
- Other injection
- CWE-707
<0.15.0 · fixed in 0.15.0
GHSA-238w-f66p-w349 · CVE-2026-9353 - CVSS 6.9 Medium
KLiK SocialMediaWebsite HTTP POST Request Parameter injection
- KLiK SocialMediaWebsite
- Other injection
- CWE-707
- CVSS 5.3 Medium
KLiK SocialMediaWebsite HTTP GET Request Parameter injection
- KLiK SocialMediaWebsite
- Other injection
- CWE-707
- CVSS 5.3 Medium
Dynamic-Datasource has an Injection vulnerability
- Other injection
- CWE-707
<=4.5.0 · no fixed version yet
GHSA-6rmm-pg23-5f8q · CVE-2026-7045 - CVSS 5.3 Medium
Envoy Query Parameter header_mutation.cc params.add injection
- Envoy
- Other injection
- CWE-707
- CVSS 5.3 Medium
Langflow vulnerable to injection
- Other injection
- CWE-707
<=1.8.3 · no fixed version yet
GHSA-v66p-f7x3-4794 · CVE-2026-6599 - CVSS 5.3 Medium
Campcodes Complete POS Management and Inventory System Environment Variable SettingsController.php injection
- Campcodes Complete POS Management and Inventory System
- Other injection
- CWE-707
- CVSS 6.9 Medium
PromtEngineer localGPT LLM Prompt server.py _route_using_overviews injection
- PromtEngineer localGPT
- Other injection
- CWE-707
- CVSS 5.3 Medium
Foundation Agents MetaGPT DataInterpreter write_analysis_code.py injection
- Foundation Agents MetaGPT
- Other injection
- CWE-707
- CVSS 5.3 Medium
vanna-ai vanna legacy exec injection
- vanna
- Other injection
- CWE-707
- CVSS 5.3 Medium
bagofwords1 bagofwords code_execution.py generate_df injection
- bagofwords
- Other injection
- CWE-707
- CVSS 5.3 Medium
CodeGenieApp serverless-express Users Endpoint dynamodb.ts injection
- CodeGenieApp serverless-express
- Other injection
- CWE-707
- CVSS 5.3 Medium
opencc JFlow WF_CCForm.java Calculate injection
- opencc JFlow
- Other injection
- CWE-707
- CVSS 5.3 Medium
Dromara UJCMS ImportDataController import-channel importChanel injection
- Dromara UJCMS
- Other injection
- CWE-707
- CVSS 5.3 Medium
snail-job is vulnerable to Code Injection through QLExpressEngine.doEval function
- Other injection
- CWE-707
<1.7.0-beta1 · fixed in 1.7.0-beta1
GHSA-3f8c-8h8v-p54h · CVE-2025-14674 - CVSS 3.5 Low
Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin
- nextcloud security-advisories
- CWE-707
- CVSS 5.3 Medium
Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection
- Dromara dataCompare
- Other injection
- CWE-707
- CVSS 2.4 Low
Intel(R) Neural Compressor software: Improper neutralization for some Intel(R) Neural Compressor software before version v3.4…
- Intel(R) Neural Compressor software
- CWE-707
- CVSS 5.3 Medium
Kilo Code Prompt ClineProvider.ts ClineProvider injection
- Kilo Code
- Other injection
- CWE-707
- CVSS 4.8 Medium
mrvautin expressCart Edit Product edit injection
- mrvautin expressCart
- Other injection
- CWE-707
- CVSS 6.9 Medium
Edge Orchestrator software: Improper neutralization for some Edge Orchestrator software before version 24.11.1 for…
- Edge Orchestrator software
- CWE-707
- CVSS 4.8 Medium
sarrionandia tournatrack Jinja2 Template check_id.py injection
- sarrionandia tournatrack
- Other injection
- CWE-707
- CVSS 4.8 Medium
thautwarm vscode-diana Jinja2 Template Gen.py injection
- thautwarm vscode-diana
- Other injection
- CWE-707
- CVSS 7.0 HighCritical · KEV, CVSS 7+ and EPSSKEV · ransomware
Microsoft Management Console Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1507
- Microsoft Windows 10 Version 1607
- CWE-707
- CVSS 5.1 Medium
ShopXO Template ThemeAdminService.php injection
- ShopXO
- Other injection
- CWE-707
- CVSS 6.9 Medium
Telstra Smart Modem Gen 2 HTTP Header injection
- Telstra Smart Modem Gen 2
- Other injection
- CWE-707
- CVSS 9.2 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
- D-Link DNS-320
- D-Link DNS-320LW
- Other injection
- Command injection
- CVSS 9.2 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
- D-Link DNS-320
- D-Link DNS-320LW
- Other injection
- Command injection
- CVSS 6.9 Medium
1000 Projects Bookstore Management System book_detail.php sql injection
- 1000 Projects Bookstore Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
1000 Projects Bookstore Management System search.php sql injection
- 1000 Projects Bookstore Management System
- Other injection
- SQL injection
- CVSS 5.1 Medium
romadebrian WEB-Sekolah Backend Proses_Edit_Akun.php cross site scripting
- romadebrian WEB-Sekolah
- Other injection
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
romadebrian WEB-Sekolah Mail Proses_Kirim.php sql injection
- romadebrian WEB-Sekolah
- Other injection
- SQL injection
- CVSS 5.1 Medium
romadebrian WEB-Sekolah Backend akun_edit.php cross site scripting
- romadebrian WEB-Sekolah
- Other injection
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
code-projects E-Health Care System app_request.php sql injection
- code-projects E-Health Care System
- Other injection
- SQL injection
- CVSS 5.3 Medium
code-projects E-Health Care System chat.php sql injection
- code-projects E-Health Care System
- Other injection
- SQL injection
- CVSS 5.3 Medium
code-projects E-Health Care System req_detail.php sql injection
- code-projects E-Health Care System
- Other injection
- SQL injection
- CVSS 5.1 Medium
PHPGurukul Hospital Management System search.php cross site scripting
- PHPGurukul Hospital Management System
- Other injection
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
PHPGurukul Hospital Management System betweendates-detailsreports.php cross site scripting
- PHPGurukul Hospital Management System
- Other injection
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
code-projects University Event Management System doedit.php sql injection
- code-projects University Event Management System
- Other injection
- SQL injection