Astro SSR - Server-Side Request Forgery

Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources. id: CVE-2026-25545 info: name: Astro SSR - Server-Side Request Forgery author:...

cpanel-xss-177

xss - cpanelCVE-2023-29489 إصدارات cPanel 11.102.0.x 11.102.0.31 / 11.106.0.x 11.106.0.x / 11.108.0.x 11.108.0.13 / 11.109.9999.x 11.109.9999.116 معرضة لهجوم Cross-Site Scripting المنعكس عبر طلب مُعد خصيصًا لمعرف Panggilan web عند عرضه على صفحة الخطأ الخاصة بـ cpsrvd. طريقة التثبيت والتشغيل في...

CVE-2025-62168

CVE-2025-62168 — إثبات المفهوم PoC لتسريب رموز Squid Proxy لا يتحمل المؤلف أي مسؤولية عن سوء الاستخدام أو الأضرار الناجمة عن هذه الأداة. يُقدَّم البحث لأغراض تعليمية ودفاعية فقط. الوصف يحتوي هذا المستودع على إثبات مفهوم PoC للثغرة CVE-2025-62168 ، وهي خلل في كشف المعلومات يؤثر على Squid Proxy. في...

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the...

GHSA-R5MF-4R5X-Q78F Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the...

CVE-2019-10092_Docker

CVE-2019-10092 Docker - Apache HTTP Server الاستخدام $ docker-compose up الاستخدام من Docker Hub $ docker run -p 5555:5555 motikan2010/cve-2019-10092 PoC Disclosures/CVE-2019-10092-Limited Cross-Site Scripting in modproxy Error Page-Apache httpd at master · DrunkenShells/Disclosures...

CVE-2019-10092

CVE-2019-10092: برمجة نصية عبر المواقع محدودة من خلال صفحة "خطأ الوكيل" في خادم Apache HTTP في Apache HTTP Server 2.4.0-2.4.39، تم الإبلاغ عن مشكلة برمجة نصية عبر المواقع محدودة تؤثر على صفحة خطأ modproxy. يمكن للمهاجم التسبب في أن يكون الرابط على صفحة الخطأ مشوّهًا وأن يشير بدلاً من ذلك إلى صفحة...

CVE-2019-20372

CVE-2019-20372 هذا المستودع لأغراض تعليمية فقط. /server خادم ضعيف قم بتشغيل ./server.sh /exploit.py سكريبت الاستغلال قم بتشغيل python3 exploit.py مهم! https://blkcipher.pl/assets/pdfs/2019-12-10-errorpagerequestsmuggling.pdf https://github.com/vuongnv3389-sec/CVE-2019-20372 لماذا هذا المستودع؟ لأ...

CVE-2017-9822

CVE-2017-9822 إلغاء تسلسل ملفات تعريف الارتباط في DotNetNuke يؤدي إلى تنفيذ التعليمات البرمجية عن بُعد RCE تتأثر إصدارات DotNetNuke DNN بين 5.0.0 و9.3.0 بثغرة إلغاء تسلسل تؤدي إلى تنفيذ التعليمات البرمجية عن بُعد RCE. يستخدم DotNetNuke ملف تعريف الارتباط DNNPersonalization لتخزين خيارات التخصيص...

CVE-2023-29489

مقدمة تم اكتشاف ثغرة برمجية من نوع XSS Cross-Site Scripting قابلة للانعكاس في إصدارات معينة من cPanel وتم تعيينها CVE-2023-29489. تسمح هذه الثغرة للمهاجمين بتنفيذ كود JavaScript عشوائي دون الحاجة إلى مصادقة. يمكن استغلال ثغرة XSS حتى إذا لم تكن منافذ إدارة cPanel مكشوفة خارجيًا. كما أن المواقع عل...

CVE-2026-105114

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

EUVD-2026-92018

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114: Improper Neutralization of Input During Web Page Generation

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

PT-2026-104575

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An issue exists where unauthenticated attackers can perform reflected cross-site scripting XSS by providing crafted parameters that are rendered without proper encoding on the OAuth2 authorization...

Rocky Linux 9 [CIQ] Security Update: xmlrpc-c / xmlrpc-c-c++ / xmlrpc-c-c++-debuginfo / xmlrpc-c-client / etc (crlsa-2026_61316)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202661316 advisory. xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component CVE-2026-15928 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: xmlrpc-c / xmlrpc-c-c++ / xmlrpc-c-c++-debuginfo / xmlrpc-c-client / etc (crlsa-2026_64772)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202664772 advisory. xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component CVE-2026-15928 Tenable has extracted the preceding description block directly from the CIQ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090055)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090055 advisory. In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the modproxy error page. An attacker could cause the link on the erro...