81 matches found
CVE-2026-108089
UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...
CVE-2026-108086
UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted...
CVE-2026-108087
UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...
CVE-2026-108088
UNSUPPORTED WHEN ASSIGNED Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project ...
CVE-2026-108089
Apache Cocoon (all versions ) is vulnerable to an exposure of sensitive system information to an unauthorized control sphere. An unauthenticated user can gain access to diagnostic interfaces, which allows for triggering the cache, exposing verbose debug logging, and viewing profile information. B...
CVE-2026-108089 Apache Cocoon: Unauthenticated access to diagnostic interfaces
UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...
CVE-2026-108089 Apache Cocoon: Unauthenticated access to diagnostic interfaces
UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...
EUVD-2026-104914
UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...
CVE-2026-108089
UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...
CVE-2026-108088 Apache Cocoon: Cross-user cache poisoning
UNSUPPORTED WHEN ASSIGNED Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project ...
CVE-2026-108088
All versions of Apache Cocoon are affected by a Use of Cache Containing Sensitive Information vulnerability (CWE-524). In multi-user applications, cached values from one user could be served to other users, leading to the leakage of sensitive information. Because the project is retired , the main...
EUVD-2026-104913
UNSUPPORTED WHEN ASSIGNED Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project ...
CVE-2026-108088
UNSUPPORTED WHEN ASSIGNED Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project ...
CVE-2026-108088 Apache Cocoon: Cross-user cache poisoning
UNSUPPORTED WHEN ASSIGNED Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project ...
CVE-2026-108087
UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...
CVE-2026-108087 Apache Cocoon: SQL Injection
UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...
EUVD-2026-104912
UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...
CVE-2026-108087
The Apache Cocoon project (all versions) is susceptible to an SQL injection vulnerability due to missing input sanitation. This flaw allows for arbitrary SQL injection via the SQL processor or sql:/esql: logicsheets . Because the project is retired, the maintainer does not plan to release a fix. ...
CVE-2026-108087 Apache Cocoon: SQL Injection
UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...
CVE-2026-108086
The Apache Cocoon framework (all versions) is vulnerable to an XML Entity Expansion (XEE) issue due to improper restriction of recursive entity references in DTDs. This vulnerability specifically affects the fp: form processor , where it can lead to Server-Side Request Forgery (SSRF) , potentiall...