CWE-99 · Injection and Smuggling
Improper Control of Resource Identifiers
74CVEs
0exploited
0with a public check
1likely (EPSS 10%+)
SortMost likely exploited
74 CVEs with CWE-99 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2019-6545AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. An unauthenticated remote us…ICS-CERT · AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Ed… · 2019-02-13 | – | 14% | 2019-02-13 |
| CVE-2021-22879Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User inte…Nextcloud · Nextcloud Desktop Client · 2021-04-14 | – | 5.0% | 2021-04-14 |
| CVE-2016-8615A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server c…The Curl Project · curl · CVSS 5.3 · 2018-08-01 | 5.3 | 4.7% | 2018-08-01 |
| CVE-2022-39369Service Hostname Discovery Exploitation in phpCASapereo · phpCAS · CVSS 8 · 2022-11-01 | 8.0 | 2.4% | 2022-11-01 |
| CVE-2017-5159An issue was discovered on Phoenix Contact mGuard devices that have been updated to Version 8.4.0. When updating an mGuard device to Version 8.4.0 via the update-upload facility,…Phoenixcontact · Phoenix Contact mGuard 8.4.0 · 2017-02-13 | – | 2.4% | 2017-02-13 |
| CVE-2022-3774SourceCodester Train Scheduler App resource injectionSourceCodester · Train Scheduler App · CVSS 5.4 · 2022-10-31 | 5.4 | 1.5% | 2022-10-31 |
| CVE-2020-8177curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.Haxx · https://github.com/curl/curl · CVSS 7.8 · 2020-12-14 | 7.8 | 1.3% | 2020-12-14 |
| CVE-2019-1860Cisco Unified Intelligence Center Remote File Injection VulnerabilityCisco · Cisco Unified Intelligence Center · CVSS 5.9 · 2019-05-16 | 5.9 | 1.3% | 2019-05-16 |
| CVE-2020-5230Opencast uses unsafe identifiersopencast · opencast · CVSS 7.7 · 2020-01-30 | 7.7 | 1.2% | 2020-01-30 |
| CVE-2023-2980Abstrium Pydio Cells User Creation resource injectionAbstrium · Pydio Cells · CVSS 6.3 · 2023-05-30 | 6.3 | 1.1% | 2023-05-30 |
| CVE-2026-62910Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft · Microsoft Exchange Server 2016 Cumulative Update 23 · CVSS 7.2 · 2026-08-11 | 7.2 | 1.0% | 2026-08-11 |
| CVE-2025-0756Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')Hitachi Vantara · Pentaho Data Integration & Analytics · CVSS 9.1 · 2025-04-16 | 9.1 | 1.0% | 2025-04-16 |
| CVE-2022-27670SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the server with some querie…SAP SE · SAP SQL Anywhere Server · 2022-04-12 | – | 1.0% | 2022-04-12 |
| CVE-2024-4817Campcodes Online Laundry Management System HTTP Request Parameter manage_user.php resource injectionCampcodes · Online Laundry Management System · CVSS 6.3 · 2024-05-13 | 6.3 | 0.9% | 2024-05-13 |
| CVE-2024-4294PHPGurukul Doctor Appointment Management System view-appointment-detail.php resource injectionPHPGurukul · Doctor Appointment Management System · CVSS 6.3 · 2024-04-27 | 6.3 | 0.9% | 2024-04-27 |
| CVE-2024-7658projectsend process.php get_preview resource injectionProjectsend · projectsend · CVSS 5.3 · 2024-08-11 | 5.3 | 0.8% | 2024-08-11 |
| CVE-2022-1287School Club Application System resource injectionSchool Club Application System Project · School Club Application System · CVSS 6.5 · 2022-04-09 | 6.5 | 0.7% | 2022-04-09 |
| CVE-2024-57971DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name.eng · KNOWAGE · CVSS 9.1 · 2025-02-16 | 9.1 | 0.7% | 2025-02-16 |
| CVE-2024-5706Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')Hitachi Vantara · Pentaho Data Integration & Analytics · CVSS 8.8 · 2025-02-19 | 8.8 | 0.7% | 2025-02-19 |
| CVE-2025-1642Benner ModernaNet GetImageMedico resource injectionBenner · ModernaNet · CVSS 4.3 · 2025-02-25 | 4.3 | 0.7% | 2025-02-25 |
| CVE-2023-3517Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')Hitachi Vantara · Pentaho Data Integration & Analytics · CVSS 8.5 · 2023-12-12 | 8.5 | 0.6% | 2023-12-12 |
| CVE-2026-110283Multiple vulnerabilities that affects IBM Db2 Genius HubIBM · Db2 Genius Hub · CVSS 4.3 · 2026-11-04 | 4.3 | 0.5% | 2026-11-04 |
| CVE-2025-8793LitmusChaos Litmus resource injectionLitmusChaos · Litmus · CVSS 4.3 · 2025-08-10 | 4.3 | 0.5% | 2025-08-10 |
| CVE-2023-6602Ffmpeg: improper handling of input format in tty demuxer of ffmpegFfmpeg · Ffmpeg · CVSS 5.3 · 2024-12-31 | 5.3 | 0.5% | 2024-12-31 |
| CVE-2025-0625CampCodes School Management Software Attachment resource injectionCampCodes · School Management Software · CVSS 3.1 · 2025-01-22 | 3.1 | 0.5% | 2025-01-22 |
| CVE-2025-12919EverShop Order Order.resolvers.js resource injectionEvershop · EverShop · CVSS 3.7 · 2025-11-09 | 3.7 | 0.5% | 2025-11-09 |
| CVE-2025-2410Admin Authorized Port (iptables) manipulation (open/close/disable ports)ABB · ASPECT-Enterprise · CVSS 9.1 · 2025-05-22 | 9.1 | 0.5% | 2025-05-22 |
| CVE-2025-3855CodeCanyon RISE Ultimate Project Manager Profile Picture save_profile_image resource injectionCodeCanyon · RISE Ultimate Project Manager · CVSS 4.3 · 2025-04-22 | 4.3 | 0.5% | 2025-04-22 |
| CVE-2024-7438SimpleMachines SMF User Alert Read Status index.php resource injectionSimpleMachines · SMF · CVSS 4.3 · 2024-08-03 | 4.3 | 0.5% | 2024-08-03 |
| CVE-2025-6534xxyopen/201206030 novel-plus File FileController.java remove resource injectionxxyopen · novel-plus · CVSS 4.2 · 2025-06-24 | 4.2 | 0.5% | 2025-06-24 |
| CVE-2023-6604Ffmpeg: hls xbin demuxer dos amplification in ffmpegFfmpeg · Ffmpeg · CVSS 5.3 · 2025-01-06 | 5.3 | 0.5% | 2025-01-06 |
| CVE-2025-1575Harpia DiagSystem atualatendimento_jpeg.php resource injectionHarpia · DiagSystem · CVSS 4.3 · 2025-02-23 | 4.3 | 0.5% | 2025-02-23 |
| CVE-2026-3693Shy2593666979 AgentChat User Endpoint user.py update_user_info resource injectionShy2593666979 · AgentChat · CVSS 7.3 · 2026-03-08 | 7.3 | 0.4% | 2026-03-08 |
| CVE-2024-7437SimpleMachines SMF Delete User index.php resource injectionSimpleMachines · SMF · CVSS 5.4 · 2024-08-03 | 5.4 | 0.4% | 2024-08-03 |
| CVE-2025-1645Benner Connecta EditarLogado resource injectionBenner · Connecta · CVSS 6.3 · 2025-02-25 | 6.3 | 0.4% | 2025-02-25 |
| CVE-2026-7303Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injectionXuxueli · xxl-job · CVSS 3.7 · 2026-04-28 | 3.7 | 0.4% | 2026-04-28 |
| CVE-2023-6601Ffmpeg: hls unsafe file extension bypass in ffmpegFfmpeg · Ffmpeg · CVSS 4.7 · 2025-01-06 | 4.7 | 0.4% | 2025-01-06 |
| CVE-2026-15186macrozheng mall Portal Endpoint create resource injectionmacrozheng · mall · CVSS 6.3 · 2026-07-09 | 6.3 | 0.4% | 2026-07-09 |
| CVE-2025-12270LearnHouse Student Assignment Submission sub_file resource injectionLearnhouse · LearnHouse · CVSS 4.3 · 2025-10-27 | 4.3 | 0.4% | 2025-10-27 |
| CVE-2025-12918yungifez Skuul School Management System View Fee Invoice fee-invoices resource injectionyungifez · Skuul School Management System · CVSS 3.1 · 2025-11-09 | 3.1 | 0.4% | 2025-11-09 |
| CVE-2026-71901Apache OFBiz: Dispatch arbitrary internal services on SFA componentApache Software Foundation · Apache OFBiz · CVSS 8.1 · 2026-11-05 | 8.1 | 0.4% | 2026-11-05 |
| CVE-2025-9619E4 Sistemas Mercatus ERP id resource injectionE4 Sistemas · Mercatus ERP · CVSS 5.3 · 2025-08-29 | 5.3 | 0.4% | 2025-08-29 |
| CVE-2026-114716Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken fro…Roundcube · Webmail · CVSS 8.5 · 2026-10-22 | 8.5 | 0.4% | 2026-10-22 |
| CVE-2025-9264Xuxueli xxl-job Jobs JobInfoController.java remove resource injectionXuxueli · xxl-job · CVSS 5.4 · 2025-08-20 | 5.4 | 0.4% | 2025-08-20 |
| CVE-2025-3405FCJ Venture Builder appclientefiel HTTP GET Request ObterPedido resource injectionFCJ Venture Builder · appclientefiel · CVSS 4.3 · 2025-04-08 | 4.3 | 0.4% | 2025-04-08 |
| CVE-2026-94149Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injectionOmega Solution · HRM OS · CVSS 4.3 · 2026-09-21 | 4.3 | 0.4% | 2026-09-21 |
| CVE-2023-6605Ffmpeg: dash playlist ssrf vulnerability in ffmpegFfmpeg · Ffmpeg · CVSS 7.2 · 2025-01-06 | 7.2 | 0.4% | 2025-01-06 |
| CVE-2026-114717Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwar…Roundcube · Webmail · CVSS 4 · 2026-10-22 | 4.0 | 0.4% | 2026-10-22 |
| CVE-2026-13493AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injectionAIDC-AI · ComfyUI-Copilot · CVSS 3.1 · 2026-06-28 | 3.1 | 0.4% | 2026-06-28 |
| CVE-2025-9263Xuxueli xxl-job JobLogController.java getJobsByGroup resource injectionXuxueli · xxl-job · CVSS 4.3 · 2025-08-20 | 4.3 | 0.4% | 2025-08-20 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.