CWE-155 · Injection and Smuggling
Improper Neutralization of Wildcards or Matching Symbols
17CVEs
SortMost likely exploited
17 CVEs with CWE-155 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-1772Information DisclosureOTRS AG · ((OTRS)) Community Edition · CVSS 6.5 · 2020-03-27 | 6.5 | 1.6% | 2020-03-27 |
| CVE-2022-21646Lookup operations do not take into account wildcards in SpiceDBauthzed · spicedb · CVSS 8.1 · 2022-01-11 | 8.1 | 1.3% | 2022-01-11 |
| CVE-2019-3802Additional information exposure with Spring Data JPA example matcherSpring · Spring Data JPA · CVSS 3.5 · 2019-06-03 | 3.5 | 1.2% | 2019-06-03 |
| CVE-2025-27515Laravel has a File Validation Bypasslaravel · framework · CVSS 6.9 · 2025-03-05 | 6.9 | 0.7% | 2025-03-05 |
| CVE-2024-0055Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file globbing which could lead to a resourc…Axis Communications AB · AXIS OS · CVSS 6.5 · 2024-03-19 | 6.5 | 0.6% | 2024-03-19 |
| CVE-2026-87016Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteopen-webui · open-webui · CVSS 8.1 · 2026-09-09 | 8.1 | 0.6% | 2026-09-09 |
| CVE-2024-0054Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs local_list.cgi, create_overlay.cgi and irissetup.cgi was vulnerable for file globbing which c…Axis Communications AB · AXIS OS · CVSS 6.5 · 2024-03-19 | 6.5 | 0.6% | 2024-03-19 |
| CVE-2025-4232GlobalProtect: Authenticated Code Injection Through Wildcard on macOSPalo Alto Networks · GlobalProtect App · CVSS 8.5 · 2025-06-12 | 8.5 | 0.5% | 2025-06-12 |
| CVE-2025-0106Expedition: Wildcard Expansion VulnerabilityPalo Alto Networks · Cloud NGFW · CVSS 6.9 · 2025-01-11 | 6.9 | 0.5% | 2025-01-11 |
| CVE-2024-6509Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which could lead to resource exhaustion of the Ax…Axis Communications AB · AXIS OS · CVSS 6.5 · 2024-09-10 | 6.5 | 0.4% | 2024-09-10 |
| CVE-2024-47791Ruijie Reyee OS Improper Neutralization of Wildcards or Matching SymbolsRuijie · Reyee OS · CVSS 7.5 · 2024-12-06 | 7.5 | 0.4% | 2024-12-06 |
| CVE-2025-24376The kubewarden-controller AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resourceskubewarden · kubewarden-controller · CVSS 6.5 · 2025-01-30 | 6.5 | 0.3% | 2025-01-30 |
| CVE-2025-11757Improper Neutralization of Wildcards or Matching Symbols in CloudEdge Online Cameras and AppCloudEdge · CloudEdge App · CVSS 8.7 · 2025-10-21 | 8.7 | 0.3% | 2025-10-21 |
| CVE-2024-8688PAN-OS: Arbitrary File Read Vulnerability in the Command Line Interface (CLI)Palo Alto Networks · PAN-OS · CVSS 6.7 · 2024-09-11 | 6.7 | 0.2% | 2024-09-11 |
| CVE-2026-126311OpenBao before 2.6.5 and 2.7.2 Wildcard Principals in SSH Certificates via Identity Templatesopenbao · openbao · CVSS 5.8 · 2026-11-13 | 5.8 | 0.2% | 2026-11-13 |
| CVE-2026-49482ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle OverwriteMacWarrior · clipbucket-v5 · CVSS 4.3 · 2026-06-11 | 4.3 | 0.2% | 2026-06-11 |
| CVE-2025-0681New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching SymbolsNew Rock Technologies · OM500 IP-PBX · CVSS 6.2 · 2025-01-30 | 6.2 | 0.2% | 2025-01-30 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.