174 matches found
CVE-2026-15141: Origin Validation Error
The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an...
CVE-2026-9546: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in libcurl caused the HTTP Referer: header to persist even when explicitly cleared. While the documentation states that passing NULL to CURLOPTREFERER suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously...
CVE-2026-44833: URL Redirection to Untrusted Site
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1...
CVE-2026-48589: URL Redirection to Untrusted Site
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module...
CVE-2024-39125
Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header...
CVE-2019-12362
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...
CVE-2019-25228: Exposure of Sensitive System Information to an Unauthorized Control Sphere
An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with third-party domains. Sensitive virtual context information can be exposed to external domains through page builder interactions and...
CVE-2025-41384: Improper Neutralization of Input During Web Page Generation
Cross-Site Scripting XSS vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include an arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary doma...
CVE-2025-11238: Improper Neutralization of Input During Web Page Generation
The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP Referer header in versions less than, or equal to, 3.4.4 due to insufficient input sanitization and output escaping when the "Save source URL" option is enabled. This makes it possible for unauthenticated...
EUVD-2003-0453
Malware in sbrugna...
EUVD-2014-8217
Malware in sbrugna...
EUVD-2006-2792
Malware in sbrugna...
EUVD-2009-4751
Malware in sbrugna...
EUVD-2021-1322
Malware in sbrugna...
EUVD-2013-3434
Malware in sbrugna...
EUVD-2003-1176
Malware in sbrugna...
EUVD-2008-1246
Malware in sbrugna...
EUVD-2014-8142
Malware in sbrugna...