Astro SSR - Server-Side Request Forgery

Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources. id: CVE-2026-25545 info: name: Astro SSR - Server-Side Request Forgery author:...

cpanel-xss-177

xss - cpanelCVE-2023-29489 cPanel संस्करण 11.102.0.x 11.102.0.31 / 11.106.0.x 11.106.0.x / 11.108.0.x 11.108.0.13 / 11.109.9999.x 11.109.9999.116, Reflected Cross-Site Scripting से ग्रस्त है, जो cpsrvd के लिए त्रुटि पृष्ठ पर प्रदर्शित होने पर वेब कॉल ID पर विशेष रूप से तैयार किए गए अनुरोध के माध्...

CVE-2025-62168

CVE-2025-62168 — Squid प्रॉक्सी टोकन लीक PoC लेखक इस उपकरण के दुरुपयोग या क्षति के लिए कोई जिम्मेदारी नहीं लेता है। शोध केवल शैक्षिक और रक्षात्मक उद्देश्यों के लिए प्रदान किया जाता है। विवरण इस रिपॉजिटरी में CVE-2025-62168 के लिए एक प्रूफ-ऑफ-कॉन्सेप्ट PoC है, जो Squid प्रॉक्सी को प्रभावित करने वा...

GHSA-R5MF-4R5X-Q78F Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the...

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the...

CVE-2019-10092_Docker

CVE-2019-10092 Docker - Apache HTTP Server उपयोग $ docker-compose up Docker Hub से उपयोग $ docker run -p 5555:5555 motikan2010/cve-2019-10092 PoC Disclosures/CVE-2019-10092-Limited Cross-Site Scripting in modproxy Error Page-Apache httpd at master · DrunkenShells/Disclosures...

CVE-2019-10092

CVE-2019-10092: Apache HTTP Server में 'प्रॉक्सी त्रुटि' पृष्ठ के माध्यम से सीमित क्रॉस-साइट स्क्रिप्टिंग Apache HTTP Server 2.4.0-2.4.39 में, modproxy त्रुटि पृष्ठ को प्रभावित करने वाली एक सीमित क्रॉस-साइट स्क्रिप्टिंग समस्या की सूचना मिली थी। एक हमलावर त्रुटि पृष्ठ पर लिंक को दूषित कर सकता है औ...

CVE-2019-20372

CVE-2019-20372 यह रिपॉजिटरी केवल शैक्षिक उद्देश्यों के लिए है। /server असुरक्षित सर्वर चलाएँ ./server.sh /exploit.py शोषण स्क्रिप्ट चलाएँ python3 exploit.py महत्वपूर्ण! https://blkcipher.pl/assets/pdfs/2019-12-10-errorpagerequestsmuggling.pdf https://github.com/vuongnv3389-sec/CVE-2019-20372 यह...

CVE-2017-9822

CVE-2017-9822 DotNetNuke कुकी डिसीरियलाइज़ेशन रिमोट कोड एक्ज़ीक्यूशन RCE DotNetNuke DNN के संस्करण 5.0.0 से 9.3.0 तक डिसीरियलाइज़ेशन भेद्यता से प्रभावित हैं जो रिमोट कोड एक्ज़ीक्यूशन RCE की ओर ले जाती है। DotNetNuke गुमनाम उपयोगकर्ताओं के वैयक्तिकरण विकल्पों को संग्रहीत करने के लिए...

CVE-2023-29489

परिचय cPanel के कुछ संस्करणों में एक शोषणीय रिफ्लेक्टेड क्रॉस-साइट स्क्रिप्टिंग XSS कमजोरी पाई गई है, जिसे CVE-2023-29489 नामित किया गया है। यह कमजोरी हमलावरों को प्रमाणीकरण की आवश्यकता के बिना मनमाना JavaScript कोड निष्पादित करने की अनुमति देती है। XSS कमजोरी का शोषण तब भी हो सकता है जब cPanel...

CVE-2026-105114

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

EUVD-2026-92018

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

PT-2026-104575

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An issue exists where unauthenticated attackers can perform reflected cross-site scripting XSS by providing crafted parameters that are rendered without proper encoding on the OAuth2 authorization...

CVE-2026-105114: Improper Neutralization of Input During Web Page Generation

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

Rocky Linux 8 [CIQ] Security Update: xmlrpc-c / xmlrpc-c-c++ / xmlrpc-c-c++-debuginfo / xmlrpc-c-client / etc (crlsa-2026_64772)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202664772 advisory. xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component CVE-2026-15928 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: xmlrpc-c / xmlrpc-c-c++ / xmlrpc-c-c++-debuginfo / xmlrpc-c-client / etc (crlsa-2026_61316)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202661316 advisory. xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component CVE-2026-15928 Tenable has extracted the preceding description block directly from the CIQ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090055)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090055 advisory. In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the modproxy error page. An attacker could cause the link on the erro...