rack: Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

A flaw was found in Rack where Rack::Multipart::Parser stores non-file form fields entirely in memory without size limits. An attacker can send a multipart/form-data request with an extremely large text field, causing the server to allocate large amounts of memory which leads to a denial of servi...

rack: Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

A flaw was found in Rack where Rack::Multipart::Parser stores non-file form fields entirely in memory without size limits. An attacker can send a multipart/form-data request with an extremely large text field, causing the server to allocate large amounts of memory which leads to a denial of servi...

CVE-2025-12045

CVE-2025-12045 — Orbit Fox Companion (WordPress) is vulnerable to authenticated Stored XSS via the category and tag name parameters in versions up to and including 3.0.2. Exploitation requires Author+ privileges; an attacker can inject scripts that execute when users view the injected page. The c...

rack: Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

A flaw was found in Rack where Rack::Multipart::Parser stores non-file form fields entirely in memory without size limits. An attacker can send a multipart/form-data request with an extremely large text field, causing the server to allocate large amounts of memory which leads to a denial of servi...

CVE-2025-43360

The issue was addressed with improved UI. This issue is fixed in iOS 26 and iPadOS 26. Password fields may be unintentionally revealed...

CVE-2025-43360

CVE-2025-43360 affects Apple iOS and iPadOS Authentication Services. The issue allowed a password field to be unintentionally revealed due to a UI-related vulnerability. Root cause and affected component are described in the public CVE; Apple fixed the issue in iOS 26 and iPadOS 26 with an improv...

CVE-2025-12604

A vulnerability has been found in itsourcecode Online Loan Management System 1.0. This affects an unknown part of the file /loadfields.php. The manipulation of the argument loanid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be...

motionEye vulnerable to RCE via unsanitized motion config parameter

Summary A command injection vulnerability in MotionEye allows attackers to achieve Remote Code Execution RCE by supplying malicious values in configuration fields exposed via the Web UI. Because MotionEye writes user-supplied values directly into Motion configuration files without sanitization,...

rack: Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

A flaw was found in Rack where Rack::Multipart::Parser stores non-file form fields entirely in memory without size limits. An attacker can send a multipart/form-data request with an extremely large text field, causing the server to allocate large amounts of memory which leads to a denial of servi...

rack: Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

A flaw was found in Rack where Rack::Multipart::Parser stores non-file form fields entirely in memory without size limits. An attacker can send a multipart/form-data request with an extremely large text field, causing the server to allocate large amounts of memory which leads to a denial of servi...

CVE-2025-12642

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: Bypass access control rules Inject unsafe input into backend logic that trusts reque...

UBUNTU-CVE-2025-12642

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: Bypass access control rules Inject unsafe input into backend logic that trusts reque...

CVE-2025-12642 HTTP Header Smuggling via Trailer Merge

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: Bypass access control rules Inject unsafe input into backend logic that trusts reque...

EUVD-2025-37446

A vulnerability has been found in itsourcecode Online Loan Management System 1.0. This affects an unknown part of the file /loadfields.php. The manipulation of the argument loanid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be...

PT-2025-44791

Name of the Vulnerable Software and Affected Versions lighttpd version 1.4.80 Description The software improperly merges trailer fields into headers following HTTP request parsing, which can be leveraged to carry out HTTP Header Smuggling attacks. Successful exploitation could allow an attacker t...

CVE-2025-12604

A vulnerability has been found in itsourcecode Online Loan Management System 1.0. This affects an unknown part of the file /loadfields.php. The manipulation of the argument loanid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be...

CVE-2025-12604 itsourcecode Online Loan Management System load_fields.php sql injection

A vulnerability has been found in itsourcecode Online Loan Management System 1.0. This affects an unknown part of the file /loadfields.php. The manipulation of the argument loanid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be...

itsourcecode Online Loan Management System SQL注入漏洞

itsourcecode Online Loan Management System is an online loan management system from itsourcecode open source. A SQL injection vulnerability exists in version 1.0 of itsourcecode Online Loan Management System, which stems from an incorrect manipulation of the parameter loanid in the file...

PT-2025-44738

Name of the Vulnerable Software and Affected Versions itsourcecode Online Loan Management System version 1.0 Description A flaw exists in itsourcecode Online Loan Management System that allows for SQL injection. This issue affects an unspecified part of the /load fields.php file. The loan id...

CVE-2025-53883

A Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x8664/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manag...