CWE-74 · Injection and Smuggling
Injection
1,090CVEs
13exploited
28with a public check
58likely (EPSS 10%+)
SortMost likely exploited
1,090 CVEs with CWE-74 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2013-2251In CISA KEVExploitedApache Struts 2 - DefaultActionMapper Prefixes OGNL Code ExecutionApache · Struts · CVSS 9.8 · 2013-07-18 | 9.8 | 100% | 2013-07-18 |
| CVE-2023-22527In CISA KEVExploitedAtlassian Confluence - Remote Code ExecutionAtlassian · Confluence Data Center · CVSS 10 · 2024-01-16 | 10.0 | 100% | 2024-01-16 |
| CVE-2019-2725In CISA KEVExploitedOracle WebLogic Server - Remote Command ExecutionOracle Corporation · Tape Library ACSLS · CVSS 7.5 · 2019-04-26 | 7.5 | 100% | 2019-04-26 |
| CVE-2022-35914In CISA KEVExploitedGLPI <=10.0.2 - Remote Command ExecutionTeclib · GLPI · CVSS 9.8 · 2022-09-19 | 9.8 | 100% | 2022-09-19 |
| CVE-2022-46169In CISA KEVExploitedCacti <=1.2.22 - Remote Command InjectionCacti · cacti · CVSS 9.8 · 2022-12-05 | 9.8 | 100% | 2022-12-05 |
| CVE-2019-17558In CISA KEVExploitedApache Solr <=8.3.1 - Remote Code ExecutionApache · Apache Solr · CVSS 7.5 · 2019-12-30 | 7.5 | 99% | 2019-12-30 |
| CVE-2022-43769In CISA KEVExploitedHitachi Pentaho Business Analytics Server - Remote Code ExecutionHitachi Vantara · Pentaho Business Analytics Server · CVSS 8.8 · 2023-04-03 | 8.8 | 98% | 2023-04-03 |
| CVE-2025-20281In CISA KEVExploitedCisco ISE - Remote Code ExecutionCisco · Cisco Identity Services Engine Software · CVSS 10 · 2025-06-25 | 10.0 | 98% | 2025-06-25 |
| CVE-2022-27924In CISA KEVExploitedZimbra Collaboration Suite - Memcached Command InjectionSynacor · Zimbra Collaboration Suite (ZCS) · CVSS 9.8 · 2022-04-20 | 9.8 | 94% | 2022-04-20 |
| CVE-2020-17496In CISA KEVExploitedvBulletin 5.5.4 - 5.6.2- Remote Command ExecutionvBulletin · vBulletin · CVSS 9.8 · 2020-08-12 | 9.8 | 87% | 2020-08-12 |
| CVE-2019-11581In CISA KEVExploitedAtlassian Jira Server-Side Template InjectionAtlassian · Jira Server and Data Center · CVSS 9.8 · 2019-08-09 | 9.8 | 85% | 2019-08-09 |
| CVE-2025-20337In CISA KEVExploitedCisco ISE API Unauthenticated Remote Code Execution VulnerabilityCisco · Cisco Identity Services Engine Software · CVSS 10 · 2025-07-16 | 10.0 | 74% | 2025-07-16 |
| CVE-2020-8468In CISA KEVExploitedTrend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an…Trend Micro · Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free Business S… · CVSS 8.8 · 2020-03-18 | 8.8 | 6.2% | 2020-03-18 |
| CVE-2021-41282CheckpfSense - Arbitrary File WritePfsense · Pfsense · 2022-03-01 | – | 87% | 2022-03-01 |
| CVE-2018-16763CheckFUEL CMS 1.4.1 - Remote Code ExecutionThedaylightstudio · Fuel Cms · 2018-09-09 | – | 83% | 2018-09-09 |
| CVE-2021-29156CheckLDAP Injection In OpenAMForgerock · Openam · 2021-03-25 | – | 77% | 2021-03-25 |
| CVE-2024-22319CheckIBM Operational Decision Manager - JNDI InjectionIBM · Operational Decision Manager · CVSS 8.1 · 2024-02-02 | 8.1 | 76% | 2024-02-02 |
| CVE-2018-1000130CheckJolokia Agent - JNDI Code InjectionJolokia · Webarchive Agent · 2018-03-14 | – | 74% | 2018-03-14 |
| CVE-2026-22200CheckosTicket - Arbitrary File ReadEnhancesoft · osTicket · CVSS 8.7 · 2026-01-12 | 8.7 | 74% | 2026-01-12 |
| CVE-2020-9757CheckCraft CMS < 3.3.0 - Server-Side Template InjectionCraftcms · Craft Cms · 2020-03-04 | – | 73% | 2020-03-04 |
| CVE-2023-22621CheckStrapi Versions <=4.5.5 - SSTI to Remote Code ExecutionStrapi · Strapi · CVSS 10 · 2023-04-19 | 10.0 | 71% | 2023-04-19 |
| CVE-2024-50340CheckSymfony Profiler - Remote Access via Injected Argumentssymfony · symfony · CVSS 7.3 · 2024-11-06 | 7.3 | 62% | 2024-11-06 |
| CVE-2022-31126CheckRoxy-WI - Remote Code Executionhap-wi · roxy-wi · CVSS 10 · 2022-07-06 | 10.0 | 53% | 2022-07-06 |
| CVE-2024-46986CheckCamaleon CMS < 2.8.1 Arbitrary File Write to RCEowen2345 · camaleon-cms · CVSS 10 · 2024-09-18 | 10.0 | 37% | 2024-09-18 |
| CVE-2020-15227CheckNette Framework - Remote Code Executionnette · application · CVSS 8.7 · 2020-10-01 | 8.7 | 34% | 2020-10-01 |
| CVE-2024-21645Checkpyload - Log Injectionpyload · pyload · CVSS 5.3 · 2024-01-08 | 5.3 | 25% | 2024-01-08 |
| CVE-2020-9376CheckD-Link DIR-610 Devices - Information DisclosureDlink · Dir-610 Firmware · 2020-07-09 | – | 18% | 2020-07-09 |
| CVE-2021-31249CheckCHIYU TCP/IP Converter - Carriage Return Line Feed InjectionChiyu-Tech · Bf-430 Firmware · 2021-06-04 | – | 18% | 2021-06-04 |
| CVE-2026-31816CheckBudibase - Authentication BypassBudibase · budibase · CVSS 9.1 · 2026-03-09 | 9.1 | 17% | 2026-03-09 |
| CVE-2021-27132CheckSercomm VD625 Smart Modems - CRLF InjectionSercomm · Agcombo Vd625 Firmware · 2021-02-27 | – | 16% | 2021-02-27 |
| CVE-2023-4450CheckJeecgBoot JimuReport - Template injectionjeecgboot · JimuReport · CVSS 6.3 · 2023-08-21 | 6.3 | 12% | 2023-08-21 |
| CVE-2021-21479CheckSCIMono <0.0.19 - Remote Code ExecutionSAP SE · SCIMono · CVSS 8.1 · 2021-02-09 | 8.1 | 10% | 2021-02-09 |
| CVE-2026-6279CheckAvada Builder (fusion-builder) <= 3.15.2 - Unauthenticated RCE via PHP Function Injectionthemefusion · Avada (Fusion) Builder · CVSS 9.8 · 2026-05-21 | 9.8 | 9.9% | 2026-05-21 |
| CVE-2022-21705CheckOctober CMS - Remote Code Executionoctobercms · october · CVSS 7.2 · 2022-02-23 | 7.2 | 8.6% | 2022-02-23 |
| CVE-2023-29827CheckEmbedded JavaScript(EJS) 3.1.6 - Template InjectionEjs · Ejs · CVSS 9.8 · 2023-05-04 | 9.8 | 5.6% | 2023-05-04 |
| CVE-2023-3380CheckWAVLINK WN579X3 - Remote Command ExecutionWavlink · WN579X3 · CVSS 4.7 · 2023-06-23 | 4.7 | 3.9% | 2023-06-23 |
| CVE-2024-49380CheckPlenti < v0.7.2 - OS Command Injectionplentico · plenti · CVSS 8.9 · 2024-10-25 | 8.9 | 2.7% | 2024-10-25 |
| CVE-2026-19092CheckTutor LMS < 4.0.6 - Unauthenticated Arbitrary PHP Function InvocationTutor LMS · CVSS 9.8 · 2026-08-27 | 9.8 | 2.6% | 2026-08-27 |
| CVE-2020-11441CheckphpMyAdmin 5.0.2 - CRLF InjectionPhpmyadmin · Phpmyadmin · 2020-03-31 | – | 2.4% | 2020-03-31 |
| CVE-2024-36420CheckFlowise 1.4.3 - Arbitrary File ReadFlowiseAI · Flowise · CVSS 7.5 · 2024-07-01 | 7.5 | 1.8% | 2024-07-01 |
| CVE-2022-35507CheckProxmox - CRLF InjectionProxmox · Proxmox Mail Gateway · CVSS 4.3 · 2022-12-04 | 4.3 | 1.5% | 2022-12-04 |
| CVE-2016-4010Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.Magento · Magento · 2017-01-23 | – | 93% | 2017-01-23 |
| CVE-2022-2992A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via…GitLab · GitLab · CVSS 9.9 · 2022-10-17 | 9.9 | 86% | 2022-10-17 |
| CVE-2013-3214vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.Vtiger · Vtiger Crm · 2020-01-28 | – | 85% | 2020-01-28 |
| CVE-2021-38294Shell Command Injection Vulnerability in Nimbus Thrift ServerApache Software Foundation · Apache Storm · 2021-10-25 | – | 84% | 2021-10-25 |
| CVE-2023-36469Code injection through NotificationRSSService in XWiki Platformxwiki · xwiki-platform · CVSS 10 · 2023-06-29 | 10.0 | 82% | 2023-06-29 |
| CVE-2012-1495install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter.Webcalendar Project · Webcalendar · 2020-01-27 | – | 80% | 2020-01-27 |
| CVE-2023-29525Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platformxwiki · xwiki-platform · CVSS 10 · 2023-04-18 | 10.0 | 78% | 2023-04-18 |
| CVE-2023-29524Code injection from account through XWiki.SchedulerJobSheet in xwiki-platformxwiki · xwiki-platform · CVSS 10 · 2023-04-18 | 10.0 | 76% | 2023-04-18 |
| CVE-2015-1592Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attac…Sixapart · Movable Type · 2015-02-19 | – | 75% | 2015-02-19 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.