124 matches found
Apache Cocoon 2.1.12 - XML Injection
Apache Cocoon 2.1.12 contains an XML injection caused by parsing user-provided XML with external system entities in StreamGenerator, letting attackers access arbitrary files on the server, exploit requires sending malicious XML. id: CVE-2020-11991 info: name: Apache Cocoon 2.1.12 - XML Injection...
CVE-2026-108089
UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...
CVE-2026-108088
UNSUPPORTED WHEN ASSIGNED Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project ...
CVE-2026-108086
UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted...
CVE-2026-108087
UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...
CVE-2026-108089
Apache Cocoon (all versions ) is vulnerable to an exposure of sensitive system information to an unauthorized control sphere. An unauthenticated user can gain access to diagnostic interfaces, which allows for triggering the cache, exposing verbose debug logging, and viewing profile information. B...
EUVD-2026-104914
UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...
CVE-2026-108089 Apache Cocoon: Unauthenticated access to diagnostic interfaces
UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...
EUVD-2026-104913
UNSUPPORTED WHEN ASSIGNED Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project ...
CVE-2026-108088
This vulnerability affects all versions of Apache Cocoon , which is a retired project. The issue is a cross-user cache poisoning (CWE-524) where cached values containing sensitive information from one user could be served to other users in a multi-user application. Because the project is retired,...
CVE-2026-108088 Apache Cocoon: Cross-user cache poisoning
UNSUPPORTED WHEN ASSIGNED Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project ...
CVE-2026-108087
All versions of Apache Cocoon are affected by a SQL injection vulnerability caused by a lack of input sanitation. This flaw allows for arbitrary SQL injection via the SQL processor or sql:/esql: logicsheets . Because the project is retired, the maintainers will not release a fix; users should see...
EUVD-2026-104912
UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...
CVE-2026-108087 Apache Cocoon: SQL Injection
UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...
EUVD-2026-104911
UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted...
CVE-2026-108086
The Apache Cocoon project (all versions) is vulnerable to an XML Entity Expansion (XEE) issue due to improper restriction of recursive entity references in DTDs. Specifically, XEE in the fp: form processor can lead to Server-Side Request Forgery (SSRF) , which may allow an attacker to expose serv...
CVE-2026-108086 Apache Cocoon: XEE could lead to SSRF and information disclosure
UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted...
PT-2026-118326
UNSUPPORTED WHEN ASSIGNED Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project ...
PT-2026-118327
UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...
PT-2026-118325
UNSUPPORTED WHEN ASSIGNED Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql:...