CVE-2025-0996

Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: High...

CVE-2024-57241

Dedecms 5.71sp1 and earlier is vulnerable to URL redirect. In the web application, a logic error does not judge the input GET request resulting in URL redirection...

CVE-2024-57241

CVE-2024-57241 applies to Dedecms 5.71sp1 and earlier. The vulnerability is a logic error in the web app that fails to properly judge incoming GET requests, resulting in URL redirection (URL redirect attack). Impact is limited to improper redirects as described; no exploitation details are provid...

CVE-2024-57965

CVE-2024-57965 is a vulnerability in axios (before 1.7.8) where isURLSameOrigin.js does not use a URL object to determine origin and may perform an unwanted setAttribute('href', href). IBM security bulletins align this CVE with IBM Db2 Big SQL on Cloud Pak for Data and related products, noting an...

BIT-PYTHON-MIN-2023-24329

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters...

PT-2025-11347

Vulnerability Report Name of the Vulnerable Software and Affected Versions PHP versions 8.1.0 through 8.1.31 PHP versions 8.2.0 through 8.2.27 PHP versions 8.3.0 through 8.3.18 PHP versions 8.4.0 through 8.4.4 PHP 7.4 Debian Description PHP is an HTML-embedded scripting language commonly used wit...

CVE-2024-56331

Uptime Kuma is an open source, self-hosted monitoring tool. An Improper URL Handling Vulnerability allows an attacker to access sensitive local files on the server by exploiting the file:/// protocol. This vulnerability is triggered via the "real-browser" request type, which takes a screenshot of...

CVE-2024-49753 Denied Host Validation Bypass in Zitadel Actions

Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost 127.0.0.1. The isHostBlocked...

CVE-2024-43905

creationtimestamp| type| source ---|---|--- 2024-08-26 13:42:58+00:00| seen| https://t.me/cvedetector/4127 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8...

CVE-2024-36527

puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server...

Improper Input Validation

moodle/moodle is vulnerable to Improper Input Validation. The vulnerability is due to the handling of URL parameters in the forum search functionality. An attacker can manipulate the search feature by injecting unexpected parameters, potentially leading to information disclosure or other unintend...

CVE-2024-22126

CVE-2024-22126 – SAP NetWeaver AS Java (User Admin) XSS : The User Admin application in SAP NetWeaver AS Java 7.50 insufficiently validates and improperly encodes incoming URL parameters before including them in the redirect URL, enabling Cross-Site Scripting. Impact: high confidentiality impact;...

CVE-2023-3733

Inappropriate implementation in WebApp Installs in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

WPCode < 2.0.13.1 - Reflected XSS

Description The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting PoC Make a logged in admin open https://example.com/wp-admin/admin.php?page=wpcode"=2...

CVE-2023-25731

Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox 110...

CVE-2023-2938

Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a remote attacker who had compromised the renderer process to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-32068 URL Redirection to Untrusted Site in XWiki

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability was partially fixed in the past for XWiki...

CVE-2022-4930 nuxsmin sysPass URL cross site scripting

A vulnerability classified as problematic was found in nuxsmin sysPass up to 3.2.4. Affected by this vulnerability is an unknown functionality of the component URL Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.2.5 is able to...

Prototype Pollution

firefox is vulnerable to Prototype Pollution. The vulnerability exists due to the URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code...

CVE-2023-24813 URI validation failure on SVG parsing. Bypass of CVE-2023-23924

Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute of image tags and respects xlink:href even if href is specified. However...