Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
v.26.4.2314

Missing Update

This page lists 23765 vulnerabilities in this category.

Critical: 1566 High: 12713 Medium: 8693 Low: 789 Information: 4
Vulnerability Name
CVE
CWE
Severity
phpMyFAQ Improper Access Control Vulnerability (CVE-2023-2429)
CVE-2023-2429
CWE-284
Critical
Drupal Deserialization of Untrusted Data Vulnerability (CVE-2024-55637)
CVE-2024-55637
CWE-502
Critical
XWikiplatform Improper Encoding or Escaping of Output Vulnerability (CVE-2024-55663)
CVE-2024-55663
CWE-116
Critical
PHP Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2022-31631)
CVE-2022-31631
CWE-138
Critical
Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-59542)
CVE-2025-59542
CWE-707
Critical
Apache Tomcat Improper Neutralization of Escape, Meta, or Control Sequences Vulnerability (CVE-2025-55754)
CVE-2025-55754
CWE-150
Critical
LimeSurvey Deserialization of Untrusted Data Vulnerability (CVE-2025-56422)
CVE-2025-56422
CWE-502
Critical
GeoServer Improper Restriction of XML External Entity Reference Vulnerability (CVE-2025-58360)
CVE-2025-58360
CWE-611
Critical
WebLogic Missing Authentication for Critical Function Vulnerability (CVE-2026-35301)
CVE-2026-35301
CWE-306
Critical
WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2026-35300)
CVE-2026-35300
CWE-502
Critical
WebLogic Improper Access Control Vulnerability (CVE-2026-35298)
CVE-2026-35298
CWE-284
Critical
WebLogic Missing Authentication for Critical Function Vulnerability (CVE-2026-35292)
CVE-2026-35292
CWE-306
Critical
WebLogic Improper Access Control Vulnerability (CVE-2026-35263)
CVE-2026-35263
CWE-284
Critical
Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-59543)
CVE-2025-59543
CWE-707
Critical
Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-55289)
CVE-2025-55289
CWE-707
Critical
Joomla CVE-2026-35223 Vulnerability (CVE-2026-35223)
CVE-2026-35223
-
Critical
Django Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2025-59681)
CVE-2025-59681
CWE-138
Critical
Joomla Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-35222)
CVE-2026-35222
CWE-138
Critical
phpMyFAQ CVE-2025-59943 Vulnerability (CVE-2025-59943)
CVE-2025-59943
-
Critical
Joomla Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-35221)
CVE-2026-35221
CWE-138
Critical
OpenSSL Improper Validation of Integrity Check Value Vulnerability (CVE-2026-34182)
CVE-2026-34182
CWE-354
Critical
CubeCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-34018)
CVE-2026-34018
CWE-138
Critical
Handlebars Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2026-33937)
CVE-2026-33937
CWE-94
Critical
XWikiplatform Relative Path Traversal Vulnerability (CVE-2025-55747)
CVE-2025-55747
CWE-23
Critical
Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-55208)
CVE-2025-55208
CWE-707
Critical
Chamilo Files or Directories Accessible to External Parties Vulnerability (CVE-2026-33698)
CVE-2026-33698
CWE-552
Critical
AbanteCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2025-50972)
CVE-2025-50972
CWE-138
Critical
Apache HTTP Server Exposure of Resource to Wrong Sphere Vulnerability (CVE-2026-42535)
CVE-2026-42535
CWE-668
Critical
axios Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Vulnerability (CVE-2026-42264)
CVE-2026-42264
CWE-1321
Critical
axios Improperly Controlled Modification of Dynamically-Determined Object Attributes Vulnerability (CVE-2026-42044)
CVE-2026-42044
CWE-915
Critical
axios Permissive List of Allowed Inputs Vulnerability (CVE-2026-42043)
CVE-2026-42043
CWE-183
Critical
Chamilo Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') Vulnerability (CVE-2025-50187)
CVE-2025-50187
CWE-707
Critical
Chamilo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2025-50190)
CVE-2025-50190
CWE-138
Critical
Chamilo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2025-50192)
CVE-2025-50192
CWE-138
Critical
Chamilo Server-Side Request Forgery (SSRF) Vulnerability (CVE-2025-50199)
CVE-2025-50199
CWE-918
Critical
Apache Traffic Server Improper Access Control Vulnerability (CVE-2026-41920)
CVE-2026-41920
CWE-284
Critical
Next.js Deserialization of Untrusted Data Vulnerability (CVE-2025-55182)
CVE-2025-55182
CWE-502
Critical
Apache Tomcat Improper Input Validation Vulnerability (CVE-2026-41293)
CVE-2026-41293
CWE-20
Critical
Joomla Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2026-40383)
CVE-2026-40383
CWE-22
Critical
Chamilo Deserialization of Untrusted Data Vulnerability (CVE-2025-52998)
CVE-2025-52998
CWE-502
Critical
SharePoint Deserialization of Untrusted Data Vulnerability (CVE-2025-53770)
CVE-2025-53770
CWE-502
Critical
XWikiplatform Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-53835)
CVE-2025-53835
CWE-707
Critical
CrushFTP Server Unprotected Alternate Channel Vulnerability (CVE-2025-54309)
CVE-2025-54309
CWE-420
Critical
XWikiplatform Improper Input Validation Vulnerability (CVE-2025-54385)
CVE-2025-54385
CWE-20
Critical
Squid Out-of-bounds Write Vulnerability (CVE-2025-54574)
CVE-2025-54574
CWE-787
Critical
React Deserialization of Untrusted Data Vulnerability (CVE-2025-55182)
CVE-2025-55182
CWE-502
Critical
Chamilo Weak Password Recovery Mechanism for Forgotten Password Vulnerability (CVE-2026-33707)
CVE-2026-33707
CWE-640
Critical
EspoCRM Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2026-33656)
CVE-2026-33656
CWE-22
Critical
Apache Tomcat Improper Authorization Vulnerability (CVE-2026-43515)
CVE-2026-43515
CWE-285
Critical
Jboss EAP Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Vulnerability (CVE-2026-28367)
CVE-2026-28367
-
Critical
MOVEit Transfer Permissive Cross-domain Policy with Untrusted Domains Vulnerability (CVE-2026-15966)
CVE-2026-15966
CWE-942
Critical
MOVEit Transfer Insufficient Session Expiration Vulnerability (CVE-2026-15967)
CVE-2026-15967
CWE-613
Critical
PHP Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-17543)
CVE-2026-17543
CWE-138
Critical
PHP Out-of-bounds Write Vulnerability (CVE-2026-17544)
CVE-2026-17544
CWE-787
Critical
Chamilo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-28430)
CVE-2026-28430
CWE-138
Critical
OpenSSL Out-of-bounds Read Vulnerability (CVE-2026-28386)
CVE-2026-28386
CWE-125
Critical
Jboss EAP Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Vulnerability (CVE-2026-28369)
CVE-2026-28369
-
Critical
Jboss EAP Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Vulnerability (CVE-2026-28368)
CVE-2026-28368
-
Critical
Oracle HTTP Server Improper Access Control Vulnerability (CVE-2026-21962)
CVE-2026-21962
CWE-284
Critical
Apache HTTP Server Heap-based Buffer Overflow Vulnerability (CVE-2026-28780)
CVE-2026-28780
CWE-122
Critical
Grafana Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2026-27876)
CVE-2026-27876
CWE-94
Critical
Dolibarr Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2026-23500)
CVE-2026-23500
CWE-138
Critical
Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-27634)
CVE-2026-27634
CWE-138
Critical
Caddy Web Server Improper Input Validation Vulnerability (CVE-2026-27590)
CVE-2026-27590
CWE-20
Critical
Caddy Web Server Improper Handling of Case Sensitivity Vulnerability (CVE-2026-27588)
CVE-2026-27588
CWE-178
Critical
Caddy Web Server Improper Handling of Case Sensitivity Vulnerability (CVE-2026-27587)
CVE-2026-27587
CWE-178
Critical
Caddy Web Server Improper Handling of Exceptional Conditions Vulnerability (CVE-2026-27586)
CVE-2026-27586
CWE-755
Critical
SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-26105)
CVE-2026-26105
CWE-707
Critical
Craft CMS Improper Neutralization of Special Elements Used in a Template Engine Vulnerability (CVE-2026-28697)
CVE-2026-28697
CWE-138
Critical
Perl Integer Overflow or Wraparound Vulnerability (CVE-2026-13221)
CVE-2026-13221
CWE-190
Critical
Apache Traffic Server CVE-2026-33267 Vulnerability (CVE-2026-33267)
CVE-2026-33267
-
Critical
MediaWiki Improper Input Validation Vulnerability (CVE-2025-67484)
CVE-2025-67484
CWE-20
Critical
XWikiplatform Missing Authorization Vulnerability (CVE-2026-33229)
CVE-2026-33229
CWE-862
Critical
Ruby on Rails Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2026-33202)
CVE-2026-33202
CWE-138
Critical
Ruby on Rails Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2026-33195)
CVE-2026-33195
CWE-22
Critical