CWE-138 · Injection and Smuggling
Improper Neutralization of Special Elements
15CVEs
SortMost likely exploited
15 CVEs with CWE-138 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-42117Exim Improper Neutralization of Special Elements Remote Code Execution VulnerabilityExim · Exim · CVSS 8.1 · 2024-05-03 | 8.1 | 6.7% | 2024-05-03 |
| CVE-2016-0750The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by inject…Red Hat · Infinispan · CVSS 4.2 · 2018-09-11 | 4.2 | 2.4% | 2018-09-11 |
| CVE-2026-32178.NET Spoofing VulnerabilityMicrosoft · .NET 10.0 · CVSS 7.5 · 2026-04-14 | 7.5 | 2.4% | 2026-04-14 |
| CVE-2022-0024PAN-OS: Improper Neutralization Vulnerability Leads to Unintended Program Execution During Configuration CommitPalo Alto Networks · PAN-OS · CVSS 7.2 · 2022-05-11 | 7.2 | 1.6% | 2022-05-11 |
| CVE-2026-26129M365 Copilot Information Disclosure VulnerabilityMicrosoft · Microsoft 365 Copilot's Business Chat · CVSS 7.5 · 2026-05-07 | 7.5 | 1.1% | 2026-05-07 |
| CVE-2022-2429Ultimate SMS Notifications for WooCommerce <= 1.4.1 - CSV Injectionhomescript · Ultimate SMS Notifications for WooCommerce · CVSS 6.5 · 2022-09-06 | 6.5 | 0.9% | 2022-09-06 |
| CVE-2023-24531Output of "go env" does not sanitize values in cmd/goGo toolchain · cmd/go · CVSS 9.8 · 2024-07-02 | 9.8 | 0.8% | 2024-07-02 |
| CVE-2024-38133Windows Kernel Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7.8 · 2024-08-13 | 7.8 | 0.7% | 2024-08-13 |
| CVE-2026-55841Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original messageGraylog2 · graylog2-server · CVSS 7.5 · 2026-08-28 | 7.5 | 0.6% | 2026-08-28 |
| CVE-2025-5878ESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special elementESAPI · esapi-java-legacy · CVSS 7.3 · 2025-06-29 | 7.3 | 0.5% | 2025-06-29 |
| CVE-2026-20009Cisco Secure Firewall Adaptive Security Appliance SSH Partial Private Key Authentication Bypass VulnerabilityCisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software · CVSS 5.3 · 2026-03-04 | 5.3 | 0.4% | 2026-03-04 |
| CVE-2026-62971OWASP CRS: XML Attribute Value Bypasscoreruleset · coreruleset · CVSS 7.2 · 2026-11-11 | 7.2 | 0.4% | 2026-11-11 |
| CVE-2023-22288Email HTML InjectionTribe29 · Checkmk · CVSS 6.8 · 2023-03-20 | 6.8 | 0.4% | 2023-03-20 |
| CVE-2023-7012Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app to potentially perfo…Google · Chrome · CVSS 7.5 · 2024-07-16 | 7.5 | 0.3% | 2024-07-16 |
| CVE-2025-48939tarteaucitron.js vulnerable to DOM Clobbering via document.currentScriptAmauriC · tarteaucitron.js · CVSS 4.2 · 2025-07-03 | 4.2 | 0.2% | 2025-07-03 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.