DNS Cache Poisoning

gVisor is vulnerable to predictable TCP/UDP source ports. The vulnerability is due to a flawed randomization mechanism in gVisor's TCP/UDP source port and header value generation, allowing attackers to predict these values...

CVE-2024-46982

Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router this does not affect the app router. When this crafted request is sent it could coerce Next....

CVE-2025-23023

Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to poison the anonymous cache for example, the cache may have a response with missing preloaded data. This issue only affects anonymous...

CVE-2024-55948 Anonymous cache poisoning via XHR requests in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the anonymous cache for example, the cache may have a response with missing preloaded data. This issue only affects anonymous visitors of the site. This problem...

CVE-2024-55948 Anonymous cache poisoning via XHR requests in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the anonymous cache for example, the cache may have a response with missing preloaded data. This issue only affects anonymous visitors of the site. This problem...

CVE-2024-55948 Anonymous cache poisoning via XHR requests in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the anonymous cache for example, the cache may have a response with missing preloaded data. This issue only affects anonymous visitors of the site. This problem...

CVE-2025-23023 Anonymous cache poisoning via request headers in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to poison the anonymous cache for example, the cache may have a response with missing preloaded data. This issue only affects anonymous...

CVE-2025-23023

CVE-2025-23023 affects Discourse where an attacker can craft a request with specific headers to poison the anonymous cache, potentially returning incomplete preloaded data for anonymous visitors. Multiple sources confirm the issue, and Red Hat and OSV entries mirror this description. The vendor h...

CVE-2025-23023 Anonymous cache poisoning via request headers in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to poison the anonymous cache for example, the cache may have a response with missing preloaded data. This issue only affects anonymous...

CVE-2025-23023 Anonymous cache poisoning via request headers in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to poison the anonymous cache for example, the cache may have a response with missing preloaded data. This issue only affects anonymous...

CVE-2025-23023: Origin Validation Error

Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to poison the anonymous cache for example, the cache may have a response with missing preloaded data. This issue only affects anonymous...

PT-2025-4771

Name of the Vulnerable Software and Affected Versions Discourse versions prior to the latest version Description Discourse is an open source platform for community discussion. In affected versions, an attacker can carefully craft a request with the right request headers to poison the anonymous...

CVE-2024-55948: Origin Validation Error

Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR request to poison the anonymous cache for example, the cache may have a response with missing preloaded data. This issue only affects anonymous visitors of the site. This problem...

PT-2025-3161 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version Description: Discourse is an open source platform for community discussion. In affected versions, an attacker can make a crafted XHR request to poison the anonymous cache, which may have a respon...

CVE-2025-23001

A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can manipulate the Host header in HTTP requests, which may lead to phishing attacks, reset password, or cache poisoning. NOTE: the Supplier's...

CVE-2025-23001

A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can manipulate the Host header in HTTP requests, which may lead to phishing attacks, reset password, or cache poisoning. NOTE: the Supplier's...

CVE-2025-23001

A Host header injection vulnerability exists in CTFd version 3.7.5 because the application fails to properly validate or sanitize the Host header. An attacker can manipulate this header in HTTP requests to potentially facilitate phishing attacks , password resets , or cache poisoning . To mitigat...

CTFd security vulnerabilities

CTFd is a Capture The Flag framework open-sourced by CTFd. A security vulnerability exists in CTFd version 3.7.5 that stems from a failure to properly validate or clean the Host header, which could lead to a phishing attack, password reset, or cache poisoning...

PT-2025-4762 · Ctfd · Ctfd

Name of the Vulnerable Software and Affected Versions: CTFd version 3.7.5 Description: A Host Header Injection issue exists due to the application's failure to properly validate or sanitize the Host header. This allows an attacker to manipulate the Host header in HTTP requests, potentially leadin...

CVE-2025-23001

A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can manipulate the Host header in HTTP requests, which may lead to phishing attacks, reset password, or cache poisoning. NOTE: the Supplier's...