10627 matches found
CVE-2026-113053
Use after free in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...
EUVD-2012-6613
SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and...
CVE-2012-20005
The SocialFit plugin for WordPress (versions through 1.2.2) is vulnerable to a reflected cross-site scripting (XSS) flaw due to the lack of sanitization on the msg parameter. Unauthenticated attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php using service=googleplus and m...
EUVD-2012-6611
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...
CVE-2012-20004 K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter
K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to...
CVE-2012-20003
The Custom Tables plugin for WordPress (versions before 3.4.6 ) is vulnerable to a reflected cross-site scripting (XSS) vulnerability. The root cause is the lack of sanitization on the 'key' parameter within the iframe.php component. An unauthenticated attacker can craft a GET request to /wp-cont...
CVE-2012-20003 Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...
CVE-2012-20004
The K-news plugin for WordPress (versions prior to 1.1.1 ) is vulnerable to a reflected cross-site scripting (XSS) flaw. The root cause is the failure to sanitize input supplied through the 'ff' parameter . Unauthenticated attackers can craft GET requests to /wp-content/plugins/knews/wysiwyg/font...
EUVD-2012-6612
K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to...
CVE-2024-41290
CVE-2024-41290 FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data Additional Information: FlatPress CMS version 1.3.1 insecurely stores authentication-related data, including usernames and hashed passwords, directly in client-side cookies. This practice...
Google Chrome Vulnerability: CVE-2026-113053
Use after free in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...
PT-2026-118750
Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 156.0.8078.47 Description A use after free issue exists in the Cookies component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A...
VulnCheck KEV: CVE-2012-20005
SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and...
VulnCheck KEV: CVE-2012-20003
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...
VulnCheck KEV: CVE-2012-20004
K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input through the 'ff' parameter. Attackers can craft GET requests to...
rabid
RABID RA pid B ig I P D ecoder What it is A CLI tool and library allowing to simply decode all kind of BigIP cookies. Features Support all 4 cookie formats CLI tool & library Hackable References Homepage / Documentation: https://orange-cyberdefense.github.io/rabid/ Author Made by Alexandre ZANNI...
CVE-2026-111749
A flaw was found in aiohttp. When processing HTTP cookies, a response from an untrusted subdomain can remove the Host-Only attribute from an existing parent-domain cookie. This vulnerability allows an attacker controlling a subdomain to bypass domain isolation protections, potentially exposing...
CVE-2026-111063
A flaw was found in aiohttp. The application fails to properly enforce the Secure attribute for shared cookies. A remote attacker could exploit this vulnerability to cause cookies intended solely for encrypted connections to be transmitted in plaintext, resulting in sensitive information...
CVE-2026-110008
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...
CVE-2026-110008: Cross-Site Request Forgery (CSRF)
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...