153 matches found
CVE-2026-103485
The Extensions for Leaflet Map plugin for WordPress (versions <= 5.4 ) is vulnerable to Unauthenticated Stored DOM-Based Cross-Site Scripting . The root cause is insufficient input sanitization and output escaping within the feature.properties[] parameter. An unauthenticated attacker can injec...
CVE-2026-103485 Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties' parameter in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2021-41277
CVE-2021-41277 Usage 1. show help info /CVE-2021-41277 ❯ go run main.go -h Usage of main: -f string File containing list of targets to verfity -o string File to write output to optional -s Show VulnInfo output -t int Number of concurrent goroutines for resolving default 10 -u string Target to...
CVE-2021-41277
CVE-2021-41277 Metabase GeoJSON map local file inclusion Version: x.40.0-x.40.4 Usage : chmod -x CVE-2021-41277.sh ./CVE-2021-41277.sh http://ip:port/ /etc/passwd References https://vulners.com/cve/CVE-2021-41277...
Metabase_Nmap_Script
MetabaseNmapScript It is a nmap script for metabase vulnerability CVE-2021-41277 USAGE -- nmap -Pn -n -p443 --script metabase.nse -- PORT STATE SERVICE -- 443/tcp open https -- | metabase: -- | VULNERABLE: -- | Metabase CVE-2021-41277 -- | State: VULNERABLE Exploitable -- | IDs:...
Metabase_CVE-2021-41277
MetabaseCVE-2021-41277 Description Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs...
CVE-2022-24853
CVE-2022-24853 Metabase NTLM Reflection / Relay Attack CVE-2022-24853 Blog Post about the finding: https://secure77.de/metabase-ntlm-relay-attack/ Github Security Advisory: https://github.com/metabase/metabase/security/advisories/GHSA-5cfq-582c-c38m POC...
CVE-2026-114643
The MongoDB C Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the serve...
CVE-2026-114643 Duplicate geometry fields via unvalidated GeoJSON extra members
The MongoDB C Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the serve...
CVE-2026-114643
The MongoDB C Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the serve...
CVE-2026-114643
The MongoDB C# Driver is vulnerable to a collision issue where it writes GeoJSON extra members without verifying if their names conflict with reserved members like type or coordinates. If an application allows user-supplied field names in these extra members, it can result in documents with dupli...
EUVD-2026-108303
The MongoDB C Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the serve...
CVE-2026-114643 Duplicate geometry fields via unvalidated GeoJSON extra members
The MongoDB C Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the serve...
Duplicate geometry fields via unvalidated GeoJSON extra members
The MongoDB C Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the serve...
PT-2026-121514
The MongoDB C Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the serve...
BIT-MYSQL-CLIENT-2026-107383 MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe allocation from each ring's numeric length before confirming that...
BIT-MARIADB-MIN-2026-107383 MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe allocation from each ring's numeric length before confirming that...
BIT-MARIADB-2026-107383 MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe allocation from each ring's numeric length before confirming that...
PT-2026-115904
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe allocation from each ring's numeric length before confirming that...
PT-2026-115892
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe allocation from each ring's numeric length before confirming that...