Skip to content
BackEsc
Sign in

CWE-99 · weakness in Injection and Smuggling

Improper Control of Resource Identifiers

74 CVEs

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

likely to be exploited
1

Every one of the 74 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. An unauthenticated remote us…CVE-2019-6545ICS-CERT · 14% likely

    ICS-CERT

  2. Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User inte…CVE-2021-22879Nextcloud Desktop Client · 5.0% likely
  3. A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server c…CVE-2016-8615The Curl Project · CVSS 5.3 · 4.7% likely

    The Curl Project

  4. Service Hostname Discovery Exploitation in phpCASCVE-2022-39369apereo · CVSS 8 · 2.4% likely

    Apereo

  5. An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility,…CVE-2017-5159Phoenix Contact mGuard 8.4.0 · 2.4% likely
  6. SourceCodester Train Scheduler App resource injectionCVE-2022-3774SourceCodester · CVSS 5.4 · 1.5% likely

    SourceCodester

  7. curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.CVE-2020-8177https://github.com/curl/curl · CVSS 7.8 · 1.3% likely
  8. Cisco Unified Intelligence Center Remote File Injection VulnerabilityCVE-2019-1860Cisco · CVSS 5.9 · 1.3% likely

    Cisco

  9. Opencast uses unsafe identifiersCVE-2020-5230opencast · CVSS 7.7 · 1.2% likely

    Opencast

  10. Abstrium Pydio Cells User Creation resource injectionCVE-2023-2980Abstrium · CVSS 6.3 · 1.1% likely
  11. Microsoft Exchange Server Elevation of Privilege VulnerabilityCVE-2026-62910Microsoft · CVSS 7.2 · 1.0% likely

    Microsoft

  12. Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')CVE-2025-0756Hitachi Vantara · CVSS 9.1 · 1.0% likely

    Hitachi Vantara

  13. SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the server with some querie…CVE-2022-27670SAP SE · 1.0% likely

    SAP

  14. Campcodes Online Laundry Management System HTTP Request Parameter manage_user.php resource injectionCVE-2024-4817Campcodes · CVSS 6.3 · 0.9% likely

    Campcodes

  15. PHPGurukul Doctor Appointment Management System view-appointment-detail.php resource injectionCVE-2024-4294PHPGurukul · CVSS 6.3 · 0.9% likely

    PHPGurukul

  16. projectsend process.php get_preview resource injectionCVE-2024-7658Projectsend · CVSS 5.3 · 0.8% likely

    ProjectSend

  17. School Club Application System resource injectionCVE-2022-1287School Club Application System · CVSS 6.5 · 0.7% likely
  18. DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name.CVE-2024-57971eng · CVSS 9.1 · 0.7% likely
  19. Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')CVE-2024-5706Hitachi Vantara · CVSS 8.8 · 0.7% likely

    Hitachi Vantara

  20. Benner ModernaNet GetImageMedico resource injectionCVE-2025-1642Benner · CVSS 4.3 · 0.7% likely

    Benner

  21. Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')CVE-2023-3517Hitachi Vantara · CVSS 8.5 · 0.6% likely

    Hitachi Vantara

  22. Multiple vulnerabilities that affects IBM Db2 Genius HubCVE-2026-110283IBM · CVSS 4.3 · 0.5% likely

    IBM

  23. LitmusChaos Litmus resource injectionCVE-2025-8793LitmusChaos · CVSS 4.3 · 0.5% likely

    LitmusChaos

  24. Ffmpeg: improper handling of input format in tty demuxer of ffmpegCVE-2023-6602Ffmpeg · CVSS 5.3 · 0.5% likely

    FFmpeg

  25. CampCodes School Management Software Attachment resource injectionCVE-2025-0625CampCodes · CVSS 3.1 · 0.5% likely

    Campcodes

  26. EverShop Order Order.resolvers.js resource injectionCVE-2025-12919Evershop · CVSS 3.7 · 0.5% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in