FUXA <= 1.1.12 - Unauthenticated SQL Injection

FUXA = 1.1.12 contains a SQL injection caused by unsanitized input in /api/signin, letting attackers execute arbitrary SQL commands, exploit requires sending crafted input to the endpoint. id: CVE-2023-31719 info: name: FUXA = 1.1.12 - Unauthenticated SQL Injection author: Securin severity:...

EUVD-2026-114892

Session fixation in Apache Wicket. org.apache.wicket.authroles.authentication.AuthenticatedWebSession is the authentication base class of Wicket's role-based security module, and its signInString, String method is the entry point through which an application authenticates a session. Renewing the...

CVE-2026-82840

Apache Wicket is vulnerable to Session Fixation due to the behavior of AuthenticatedWebSession#signIn(String, String). The session ID is only renewed during the first transition of the session's signed-in flag. Consequently, if a session is already signed in and undergoes re-authentication (e.g.,...

CVE-2026-82840 Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication

Session fixation in Apache Wicket. org.apache.wicket.authroles.authentication.AuthenticatedWebSession is the authentication base class of Wicket's role-based security module, and its signInString, String method is the entry point through which an application authenticates a session. Renewing the...

CVE-2026-12416-CVE-2026-12417

CVE-2026-12416-CVE-2026-12417 Unauthenticated Account Takeover via Weak Password Reset Validation via 'resetuserid' Parameter | Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'resetactivationcode' Leading to Account Takeover CVE-2026-12417 & CVE-2026-12416 — Mass...

CVE-2026-82840: Apache Software Foundation Apache Wicket: Session fixation in Apache Wicket

Session fixation in Apache Wicket. org.apache.wicket.authroles.authentication.AuthenticatedWebSession is the authentication base class of Wicket's role-based security module, and its signInString, String method is the entry point through which an application authenticates a session. Renewing the...

CVE-2023-31719

CVE-2023-31719 Its possible do inject SQL code into the JSON parameter "username" from the endpoint /api/signin via HTTP POST request "username":"test' OR 2891=LIKECHAR65,66,67,68,69,70,71,UPPERHEXRANDOMBLOB500000000/2-- ZJMj","password":"test" Name Affected product: FUXA Version affected: = 1.1....

CVE-2026-113325

A flaw was found in the SignIn component of Google Chrome on iOS. A remote attacker could exploit this memory corruption vulnerability by persuading a user to visit a specially crafted HTML page. Successful exploitation allows the attacker to read process memory inside the application sandbox,...

CVE-2026-113152

A flaw was found in chromium-browser. A remote attacker could trigger a memory corruption vulnerability in the SignIn component by enticing a user to visit a crafted HTML page. Successful exploitation may allow the attacker to execute arbitrary code inside the browser sandbox...

SUSE CVE-2026-113114

Incorrect authorization in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-113152

Confused deputy in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. Chromium security severity: Low...

SUSE CVE-2026-113325

Missing authorization in SignIn in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-105711

Memory corruption in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...

EUVD-2026-105687

Use after free in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-113114

A flaw was found in chromium-browser. The SignIn component is vulnerable to a use-after-free condition, where memory is accessed after it has been released. By enticing a user to visit a specially crafted HTML page, a remote attacker could exploit this vulnerability to execute arbitrary code with...

Linux Distros Unpatched Vulnerability : CVE-2026-113152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-113114

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-113325

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in SignIn in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a...

DEBIAN-CVE-2026-113325

Missing authorization in SignIn in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-113152

Confused deputy in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. Chromium security severity: Low...