36586 matches found
Improper Security Configuration
Spring Framework is vulnerable to Improper Security Configuration. The vulnerability is due to response cookies being serialized without the SameSite attribute in WebFlux applications using the Jetty 12 Core reactive adapter...
CVE-2026-82186
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...
WordPress WPLP Cookie Consent plugin < 4.4.2 - Admin+ SQLi vulnerability
Admin+ SQLi vulnerability discovered by cyberkareem in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...
CVE-2026-82186 WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...
CVE-2026-82186 WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...
CVE-2026-82186
The WPLP Cookie Consent WordPress plugin (specifically versions before 4.4.2 ) is vulnerable to SQL injection due to improper validation of a pagination parameter (the 'offset' parameter) within a SQL query. This flaw allows users with administrator privileges to execute arbitrary SQL commands. S...
EUVD-2026-70909
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...
PT-2026-86162
Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User Model::getUserDataByLogin. The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie...
CVE-2026-82186: Improper Neutralization of Special Elements used in an SQL Command
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...
PT-2026-85420
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...
PT-2026-86181
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Stream Control Transmission Protocol SCTP implementation where the sctp unpack cookie function fails to perform cookie expiration checks if an association already...
PT-2026-91798
In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctp unpack cookie skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing...
CVE-2022-35497
In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...
EUVD-2022-56032
In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...
PT-2026-85665
In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...
PT-2026-86152
Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 Description The cache interceptor fails to handle the Set-Cookie response header, allowing it to be stored and re-served in shared cache mode. This occurs when a cacheab...
CVE-2026-84933: Exposure of Sensitive Information to an Unauthorized Actor
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...
CVE-2026-84933: Exposure of Sensitive Information to an Unauthorized Actor
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...
CVE-2022-35497: Improper Neutralization of Input During Web Page Generation
In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...