Advisories · Weakness
CWE-99.
Every Advisory and CVE whose sources give the weakness CWE-99, newest first.
- CVSS 8.1 High
Apache OFBiz: Dispatch arbitrary internal services on SFA component
- Apache Software Foundation Apache OFBiz
- CWE-99
- CVSS 4.3 Medium
Multiple vulnerabilities that affects IBM Db2 Genius Hub
- IBM Db2 Genius Hub
- CWE-99
- CVSS 5.8 Medium
Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header…
- Roundcube Webmail
- CWE-99
- CVSS 5.0 Medium
Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header…
- Roundcube Webmail
- CWE-99
- CVSS 4.0 Medium
Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header…
- Roundcube Webmail
- CWE-99
- CVSS 8.5 High
Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header…
- Roundcube Webmail
- CWE-99
- CVSS 8.5 High
Akamai Guardicore Platform Agent: Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly…
- Akamai Guardicore Platform Agent
- CWE-99
- CVSS 3.4 Low
Wizards of the Coast Magic: The Gathering Arena: Magic: The Gathering Arena (Windows/Steam client…
- Wizards of the Coast Magic: The Gathering Arena
- CWE-99
- CVSS 2.5 Low
OpenBSD OpenSSH: In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username…
- OpenBSD OpenSSH
- CWE-99
- CVSS 5.3 Medium
dotnet eShop Ordering API OrdersApi.cs GetOrderAsync resource injection
- dotnet eShop
- CWE-99
- CVSS 5.3 Medium
Krayin laravel-crm attachment-download Endpoint acl.php resource injection
- Krayin laravel-crm
- CWE-99
- CVSS 8.7 High
Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug
- Denial of service
- Broken access control
<0.18.1 · fixed in 0.18.1
GHSA-5f42-97gr-vfhq · CVE-2026-85724 - CVSS 5.3 Medium
Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection
- Omega Solution HRM OS
- CWE-99
- CVSS 3.1 Low
Improper Control of Resource Identifiers ('Resource Injection') in GitLab
- GitLab
- CWE-99
- CVSS 5.3 Medium
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver
- MongoDB C Driver
- CWE-99
- CVSS 7.1 High
Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver
- MongoDB GO Driver
- CWE-99
- CVSS 7.2 High
Microsoft Exchange Server Elevation of Privilege Vulnerability
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 14
- CWE-99
- CVSS 5.3 Medium
macrozheng mall Portal Endpoint create resource injection
- macrozheng mall
- CWE-99
- CVSS 2.3 Low
AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injection
- AIDC-AI ComfyUI-Copilot
- CWE-99
- CVSS 5.3 Medium
medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injection
- medkey
- CWE-99
- CVSS 5.3 Medium
SourceCodester Human Resource Management Employee View detailview.php resource injection
- SourceCodester Human Resource Management
- CWE-99
- CVSS 5.1 Medium
code-projects Online Hospital Management System viewdoctortimings.php resource injection
- code-projects Online Hospital Management System
- CWE-99
- CVSS 5.3 Medium
OUSL-GROUP-BrinaryBrains School Student Management System Parents.php marks resource injection
- OUSL-GROUP-BrinaryBrains School Student Management System
- CWE-99
- CVSS 5.3 Medium
yashpokharna2555 StudentManagementSystem courseDel.php resource injection
- yashpokharna2555 StudentManagementSystem
- CWE-99
- CVSS 6.8 Medium
Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding.
- Open-Xchange GmbH OX Dovecot Pro
- CWE-99
- CVSS 6.3 Medium
xxl-job has a Resource Injection issue
- CWE-99
<3.4.0 · fixed in 3.4.0
GHSA-gw2x-mfwr-h46p · CVE-2026-7303 - CVSS 6.9 Medium
Newgen OmniDocs WebApiRequestRedirection resource injection
- Newgen OmniDocs
- CWE-99
- CVSS 5.3 Medium
BichitroGan ISP Billing Software Endpoint users-view resource injection
- BichitroGan ISP Billing Software
- CWE-99
- CVSS 6.9 Medium
Shy2593666979 AgentChat User Endpoint user.py update_user_info resource injection
- Shy2593666979 AgentChat
- CWE-99
- CVSS 6.3 Medium
EverShop is vulnerable to Unauthorized Order Information Access (IDOR)
- Broken access control
- CWE-99
<=2.1.0 · no fixed version yet
GHSA-c73g-mx2w-cc93 · CVE-2025-12919 - CVSS 2.3 Low
Skuul School Management System has an Insecure Direct Object Reference (IDOR) Vulnerability in View Fee Invoice
- Broken access control
- CWE-99
<=2.6.4 · no fixed version yet
GHSA-fqq7-h225-8w6h · CVE-2025-12918 - CVSS 5.3 Medium
LearnHouse Student Assignment Submission sub_file resource injection
- LearnHouse
- CWE-99
- CVSS 7.3 High
Poly Lens Desktop Application – Privilege Escalation
- HP, Inc. Poly Lens
- CWE-99
- CVSS 6.9 Medium
E4 Sistemas Mercatus ERP id resource injection
- E4 Sistemas Mercatus ERP
- CWE-99
- CVSS 5.3 Medium
xxl-job Jobs Handler remove function allows improper control of resource identifiers via ID parameter
- Broken access control
- CWE-99
<3.2.0 · fixed in 3.2.0
GHSA-gjx6-h8hm-c9rq · CVE-2025-9264 - CVSS 5.3 Medium
xxl-job Vulnerable to Resource Injection and Authorization Bypass Through User-Controlled Key
- Broken access control
- CWE-99
<3.2.0 · fixed in 3.2.0
GHSA-6rq7-m52p-8pqg · CVE-2025-9263 - CVSS 5.3 Medium
LitmusChaos Litmus resource injection
- Litmus
- CWE-99
- CVSS 2.3 Low
xxyopen/201206030 novel-plus File FileController.java remove resource injection
- xxyopen novel-plus
- 201206030 novel-plus
- CWE-99
- CVSS 8.9 High
Admin Authorized Port (iptables) manipulation (open/close/disable ports)
- ABB ASPECT-Enterprise
- ABB NEXUS Series
- CWE-99
- CVSS 5.3 Medium
CodeCanyon RISE Ultimate Project Manager Profile Picture save_profile_image resource injection
- CodeCanyon RISE Ultimate Project Manager
- CWE-99
- CVSS 9.1 CriticalCritical · CVSS 9+
Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')
- Hitachi Vantara Pentaho Data Integration & Analytics
- CWE-99
- CVSS 5.3 Medium
FCJ Venture Builder appclientefiel HTTP GET Request ObterPedido resource injection
- FCJ Venture Builder appclientefiel
- CWE-99
- CVSS 5.3 Medium
Control iD RH iD PDF Document companyId resource injection
- Control iD RH iD
- CWE-99
- CVSS 5.3 Medium
Benner Connecta EditarLogado resource injection
- Benner Connecta
- CWE-99
- CVSS 5.3 Medium
Benner ModernaNet GetImageMedico resource injection
- Benner ModernaNet
- CWE-99
- CVSS 5.3 Medium
Harpia DiagSystem atualatendimento_jpeg.php resource injection
- Harpia DiagSystem
- CWE-99
- CVSS 8.8 High
Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')
- Hitachi Vantara Pentaho Data Integration & Analytics
- Hitachi Vantara Pentaho Business Analytics Server
- CWE-99
- CVSS 9.1 CriticalCritical · CVSS 9+
eng KNOWAGE: DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before…
- eng KNOWAGE
- CWE-99
- CVSS 2.3 Low
CampCodes School Management Software Attachment resource injection
- CampCodes School Management Software
- CWE-99
- CVSS 7.2 High
Ffmpeg: dash playlist ssrf vulnerability in ffmpeg
- CWE-99
- CVSS 5.3 Medium
Ffmpeg: hls xbin demuxer dos amplification in ffmpeg
- Code injection
- CWE-99
- CVSS 4.7 Medium
Ffmpeg: hls unsafe file extension bypass in ffmpeg
- Code injection
- CWE-99
- CVSS 5.3 Medium
Ffmpeg: improper handling of input format in tty demuxer of ffmpeg
- CWE-99
- CVSS 6.3 Medium
Abstrium Pydio Cells Resource Injection vulnerability in github.com/pydio/cells
- CWE-99
* · no fixed version yet
GHSA-j327-c69h-4gh8 · CVE-2023-2980 - CVSS 6.9 Medium
projectsend process.php get_preview resource injection
- projectsend
- CWE-99
- CVSS 5.3 Medium
SimpleMachines SMF User Alert Read Status index.php resource injection
- SimpleMachines SMF
- CWE-99
- CVSS 5.3 Medium
SimpleMachines SMF Delete User index.php resource injection
- SimpleMachines SMF
- CWE-99
- CVSS 2.7 Low
Improper Control of Resource Identifiers ('Resource Injection') in GitLab
- GitLab
- CWE-99
- CVSS 5.3 Medium
Campcodes Online Laundry Management System HTTP Request Parameter manage_user.php resource injection
- Campcodes Online Laundry Management System
- CWE-99
- CVSS 6.3 Medium
PHPGurukul Doctor Appointment Management System view-appointment-detail.php resource injection
- PHPGurukul Doctor Appointment Management System
- CWE-99