Arjun

Arjun HTTP Parameter Discovery Suite What's Arjun? Arjun can find query parameters for URL endpoints. If you don't get what that means, it's okay, read along. Web applications use parameters or queries to accept user input, take the following example into consideration...

CVE-2019-7219

CVE-2019-7219 CVE-2019-7219 Zarafa Webapp Author: verifysecurity At least Webapp version 1.6-46049 till 2.0.1.47791 are affected. hxxps://127.0.0.1/webapp/?fccc0"5f43d=1...

CVE-2022-24342

CVE-2022-24342 JetBrains TeamCity - account takeover via CSRF in GitHub authentication PoC CVE-2022-24342 Requirements Usage How does it work? GitHub OAuth2: query parameters processing order CVE-2022-24342: HTTP requests flow Requirements JetBrains TeamCity If you run the exploit on the local...

CVE-2022-28346

CVE-2022-28346 PoC Impact: Potential SQL injection in QuerySet.annotate, aggregate, and extra. Installation poetry install python manage.py makemigrations python manage.py migrate python manage.py loaddata data.json python manage.py runserver PoC ?field=poc.title" FROM "pocblog" union SELECT...

Eclipse BIRT Viewer - Remote Code Execution

Eclipse BIRT versions 4.8.0 and earlier contain a JSP injection caused by query parameters, letting remote attackers create and access malicious JSP files in the viewer directory, exploit requires sending crafted query parameters. id: CVE-2021-34427 info: name: Eclipse BIRT Viewer - Remote Code...

CVE-2025-49132

Impact Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code, without being authenticated. With the ability to execute arbitrary code, this vulnerability can be exploited in an infinite number of ways. It could be used t...

CVE-2025-49132

Impact Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code, without being authenticated. With the ability to execute arbitrary code, this vulnerability can be exploited in an infinite number of ways. It could be used t...

CVE-2026-114621

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to l...

EUVD-2026-108991

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to l...

PT-2026-122100

baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to l...

CLSA-2026-1792688250 pcs: Fix of 4 CVEs

Fix CVE-2025-46727: limit number and bytesize of query parameters in bundled rubygem rack - Fix CVE-2025-61919: bound the read of urlencoded request bodies in bundled rubygem rack - Fix CVE-2025-61771: limit multipart data retained in memory in bundled rubygem rack - Fix CVE-2025-61772: limit the...

CLSA-2026-1772646645 butane: Fix of 2 CVEs

rebuild with newer golang version 1.22.9-1.el92.tuxcare.els6 to fix the following CVE - CVE-2025-61729: limit parsed URL query parameters to mitigate excessive memory consumption during form parsing...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending specially crafted HTTP requests containing specific array query parameters or form-encoded data. Because the request decoder fails to properly validate certain array schemas before...

CVE-2026-100353

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending specially crafted HTTP requests containing specific array query parameters or form-encoded data. Because the request decoder fails to properly validate certain array schemas before...

kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

Summary The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array schema omits the items keyword which is legal under JSON Schema 2020-12. That fix patched three decoder paths: the standalone parseArray function, the top-level array check in...

GHSA-VRCC-3CH7-HPPW kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter

Summary The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array schema omits the items keyword which is legal under JSON Schema 2020-12. That fix patched three decoder paths: the standalone parseArray function, the top-level array check in...

CVE-2026-100350

A flaw was found in kin-openapi. An unauthenticated remote attacker can trigger a Denial of Service DoS by sending requests containing a large number of query parameters to an affected endpoint. Due to redundant regular expression compilation within the parameter decoding loop, processing these...

Astra Linux – Vulnerability in Golang-1.23

ReverseProxy can forward queries containing parameters that are not visible to the Rewrite function. When used with a Rewrite function, or a Director function that parses query parameters, ReverseProxy sanitizes the forwarded request by removing parameters that are not parsed by url.ParseQuery...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the TryPathsHandler or TryFilesFilter process. An attacker can manipulate query parameters by crafting a request path containing reserve...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the TryPathsHandler or TryFilesFilter process. An attacker can manipulate query parameters by crafting a request path containing reserve...