CWE-149 · Injection and Smuggling
Improper Neutralization of Quoting Syntax
6CVEs
SortMost likely exploited
6 CVEs with CWE-149 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-1094PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validationPostgreSQL · CVSS 8.1 · 2025-02-13 | 8.1 | 90% | 2025-02-13 |
| CVE-2023-36479Jetty vulnerable to errant command quoting in CGI Servleteclipse · jetty.project · CVSS 3.5 · 2023-09-15 | 3.5 | 1.2% | 2023-09-15 |
| CVE-2018-25135Anviz AIM CrossChex Standard 4.3.6.0 CSV Injection via User ImportAnviz Biometric Technology Co., Ltd. · Anviz AIM CrossChex Standard · CVSS 9.8 · 2025-12-24 | 9.8 | 0.7% | 2025-12-24 |
| CVE-2026-42511Remote code execution via malicious DHCP optionsFreeBSD · FreeBSD · CVSS 8.1 · 2026-04-30 | 8.1 | 0.4% | 2026-04-30 |
| CVE-2026-119301Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandasAWS · aws-sdk-pandas · CVSS 7.9 · 2026-11-02 | 7.9 | 0.3% | 2026-11-02 |
| CVE-2025-43878F5OS-A/C CLI vulnerabilityF5 · F5OS - Appliance · CVSS 6 · 2025-05-07 | 6.0 | 0.2% | 2025-05-07 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.