CVE-2026-15371: Improper Handling of URL Encoding (Hex Encoding)

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...

CVE-2022-27780: Improper Handling of URL Encoding (Hex Encoding)

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a different URL usingthe wrong host name when it is later retrieved.For example, a URL like http://example.com%2F127.0.0.1/, would be allowed bythe parser and get...

CVE-2018-3718: Improper Handling of URL Encoding (Hex Encoding)

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded...