227 matches found
CVE-2025-5769
The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser. By exploiting th...
CVE-2025-5769 Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification
The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser. By exploiting th...
CVE-2025-5769
Multiple WSO2 products are affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the authentication endpoint. The root cause is a lack of proper output encoding for user-supplied input before it is rendered on the web page. An attacker can exploit this to inject malicious JavaScript...
EUVD-2025-211244
The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser. By exploiting th...
CVE-2025-45710
CVE-2025-45710 Read more details on: https://www.partywave.site about CVE-2024-54819 Setup a rebinder This is just an example with an available web service at the time of writing. go to https://lock.cmpxchg8b.com/rebinder.html select the 2 addresses to switch on A,B test the rebinding, randomly...
CVE-2025-65899
CVE-2025-65899: Kalmia CMS v0.2.0 - is vulnerable to Observable Response Discrepancy Vulnerability Overview CVE ID: CVE-2025-65899 Product: DifuseHQ Kalmia CMS Affected Version: 0.2.0 Vulnerability Type: Observable Response Discrepancy Privileges Required: None Impact Allows unauthenticated...
CVE-2026-44596
CVE-2026-44596 — YAMCS No Rate Limiting on Authentication Endpoint Summary The authentication endpoint POST /auth/token in yamcs-core lacks any form of rate limiting, account lockout, or failed attempt throttling. An unauthenticated remote attacker can perform unlimited password guessing attempts...
CVE-2022-29465
CVE-2022-29464 go run main.go 请输入目标地址, 如 https://127.0.0.1 https://127.0.0.1:9443 https://127.0.0.1:9443/authenticationendpoint/cmd.jsp?cmd=id...
CVE-2026-11854
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables...
CVE-2026-11854 Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables...
CVE-2026-11854
Multiple WSO2 products are vulnerable to Cross-Site Scripting (XSS) due to an authentication endpoint that reflects request data in error messages without sufficient sanitization or encoding. An attacker can inject malicious scripts to execute in a victim's browser, potentially allowing them to r...
CVE-2026-11854 Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables...
EUVD-2026-112399
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables...
PT-2026-129137
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables...
CVE-2026-11854: WSO2: The authentication endpoint generates an error message that includes reflected data directly from the request without…
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables...
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
Summary Authlib's RFC 9101 JAR extension passes the attacker-controlled requesturi authorization parameter straight to the getrequestobject fetch hook with no validation, at a pre-authentication endpoint. Authlib already defines the pre-registration allowlist for this requesturis client metadata...
CVE-2024-5139
The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect...
CVE-2024-5139 Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect...
EUVD-2024-55810
The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect...
CVE-2024-5139
Multiple WSO2 products are vulnerable to a Cross-Site Scripting (XSS) flaw in the Authentication Endpoint . The root cause is the acceptance of user-supplied input without sufficient encoding, which allows for the injection of malicious JavaScript payloads . Successful exploitation enables an att...