1587 matches found
CVE-2025-47278
CVE-2025-47278 affects Flask 3.1.0, where itsdangerous signing key handling constructs the key list in reverse, causing the last (oldest) key to be used for signing when key rotation is configured via SECRET_KEY_FALLBACKS. The result is signing sessions with stale keys, potentially hindering tran...
CVE-2025-47278
Flask is a web server gateway interface WSGI web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key. Signing is provided by the itsdangerous library. A list of keys can...
DS-Java 安全漏洞
DS-Java is a forum system built on SSH Struts2+Spring+Hibernate by sixteen individual developers. A security vulnerability exists in DS-Java version 1.0, which stems from vulnerability to cross-site request forgery attacks...
Intumit SmartRobot 代码问题漏洞
Intumit SmartRobot is a web development framework from Intumit, Inc. A code issue vulnerability exists in Intumit SmartRobot that stems from vulnerability to server-side request forgery attacks...
ASP.NET Core Authentication Bypass Privilege Escalation
The vulnerability of the ASP.NET Core software platform and the Microsoft Visual Studio development environment is related to the ability to bypass authentication. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...
CVE-2025-32027: Improper Neutralization of Input During Web Page Generation
Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher...
CVE-2025-31129
Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImplget module deserializes untrusted data. This vulnerability is fixed in 2.17.0 2.x and 3.7.0 3.x...
CVE-2025-31129 jooby-pac4j: deserialization of untrusted data
Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImplget module deserializes untrusted data. This vulnerability is fixed in 2.17.0 2.x and 3.7.0 3.x...
CVE-2025-31129
Summary: CVE-2025-31129 affects the Jooby pac4j integration. In io.jooby.internal.pac4j.SessionStoreImpl#get, values are deserialized from untrusted data (notably for payloads starting with “b64~”), which can enable code execution. The issue is fixed in Jooby releases 2.17.0 (2.x stream) and 3.7....
[SECURITY] Fedora 41 Update: python-django-4.2.20-1.fc41
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...
[SECURITY] Fedora 42 Update: python-django5-5.1.7-1.fc42
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...
Cross-site Scripting (XSS)
Overview laravel/framework is a PHP framework for web artisans. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper encoding of request parameters in the debug-mode error page. When the application runs with APPDEBUG=true and encounters an error, the...
aiolambda (>=0.2.0, <=0.3.0), alcazar-web-framework (0.0.2) +155 more potentially affected by CVE-2025-27516 via jinja2 (2.10.0)
jinja2 PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on jinja2 and may be impacted: - aiolambda =0.2.0, =1.10.3b1, =3.0.0b4, =0.1.0, =0.0.1, =0.2.0, =0.6.7.post3, =0.7.1, =0.1.1, =1.2.1, =0.0.2, =0.0.3 - burl 1.0.0 and more Source...
Spring Web multipart file rewrite
The vulnerability of the org.springframework.web.multipart package in the Spring Web framework is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to re-upload files stored in the web server’s directory from a...
Azure Linux 3.0 Security Update: python-tensorboard / reaper (CVE-2024-43796)
The version of python-tensorboard / reaper installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-43796 advisory. - Express.js minimalist web framework for node. In express 4.20.0, passing untrusted user...
CVE-2022-24857
django-mfa3 is a library that implements multi factor authentication for the django web framework. It achieves this by modifying the regular login view. Django however has a second login view for its admin area. This second login view was not modified, so the multi factor authentication can be...
CVE-2024-22199
This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious...
CVE-2025-24360
CVE-2025-24360 affects the Nuxt framework (Vue.js) prior to v3.15.3, with v3.8.1–v3.15.3 vulnerable due to default CORS settings that allow any origin to send requests to the development server and read responses. Several sources corroborate that, when using the Vite builder with the default serv...
CVE-2025-24013
CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or...
