qs: qs: Query parameter injection via unencoded empty array keys

A flaw was found in qs. When the library is configured to allow empty arrays during query string serialization, it fails to encode object keys that contain empty array values. A remote attacker who can provide untrusted input key names can exploit this flaw by supplying keys containing query...

CVE-2024-50340

CVE-2024-50340 POC Requirements The registerargcargv option must be enabled in the PHP configuration file php.ini. This setting loads command-line arguments and query params into $SERVER'argv'. https://www.php.net/manual/en/ini.core.phpini.register-argc-argv Explanation of Vulnerable Code This...

CVE-2026-55993

camel-atmosphere-websocket Header Injection Reproducer CVE-2026-55993 This project demonstrates a message-header injection in Apache Camel's camel-atmosphere-websocket component, tracked as CVE-2026-55993. The WebSocket consumer copies the connection's query parameters onto the Camel Exchange...

CVE-2026-118258

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand &, equals =, or semicolon ; query...

GHSA-3CMX-XJWW-583X i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

Summary The URL-segment check added for GHSA-q89c-q3h5-w34g blocks ?, , %, :, / and @ in lng, but not & or =, and the checked value is inserted into the URL without encoding. The README documents a multiload loadPath of the form /locales/resources.json?lng=de+en&ns=ns1+ns2. With a template like...

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

Summary The URL-segment check added for GHSA-q89c-q3h5-w34g blocks ?, , %, :, / and @ in lng, but not & or =, and the checked value is inserted into the URL without encoding. The README documents a multiload loadPath of the form /locales/resources.json?lng=de+en&ns=ns1+ns2. With a template like...

npm: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

npm: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts lng in the query string vulnerability discovered by ? in WordPress npm i18next-http-backend versions 4.0.4...

CVE-2026-118258

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand &, equals =, or semicolon ; query...

CVE-2026-118258 i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand &, equals =, or semicolon ; query...

CVE-2026-118258 i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand &, equals =, or semicolon ; query...

CVE-2026-118258

The i18next-http-backend library (a backend layer for i18next used in Node.js, browsers, and Deno) is vulnerable to query-parameter injection in versions prior to 4.0.4 . The root cause is that the interpolateUrl function inserts unencoded language (lng) and namespace (ns) values into loadPath or...

GHSA-44QR-RRJG-2CQQ ApostropheCMS: CAPTCHA response token not URL-encoded

Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request. Details - packages/form/lib/recaptcha.js:39 — recaptchaUri =...

ApostropheCMS: CAPTCHA response token not URL-encoded

Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request. Details - packages/form/lib/recaptcha.js:39 — recaptchaUri =...

PT-2026-120292

Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request. Details - packages/form/lib/recaptcha.js:39 — recaptchaUri =...

CVE-2026-76182

A flaw was found in Eclipse Jetty. When configured to forward requests to template Uniform Resource Identifiers URIs using TryPathsHandler or TryFilesFilter, path values are not properly encoded before substitution into query strings. A remote attacker can exploit this flaw by sending requests...

PT-2026-93794

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0 Description A query parameter injection issue exists in the connection URI formatting logic. The URI.String function in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values...

CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

EEF-CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Summary Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicin...

CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...