Lucene search
+L

493117 matches found

OSV
OSV
added yesterday6 views

GHSA-HHMC-Q9HP-R662 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

Impact In affected versions, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization. Depending on the destination path and server configuration, an attacker can supply a filename containing path traversal sequences e.g. ../../public/shell.php t...

7.5CVSS5.4AI score0.0045EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
added yesterday9 views

CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

Impact In affected versions, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization. Depending on the destination path and server configuration, an attacker can supply a filename containing path traversal sequences e.g. ../../public/shell.php t...

7.5CVSS5.3AI score0.0045EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
added yesterday10 views

EUVD-2026-51397

CodeIgniter: SQL injection in Query Builder deleteBatch when used with where conditions...

9.4CVSS5.6AI score0.00377EPSS
SaveExploits0References4
OSV
OSV
added yesterday6 views

GHSA-C9W5-RWH3-7PM9 CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

Impact A SQL injection vulnerability exists in the Query Builder's deleteBatch method. When deleteBatch is used together with where conditions, the bound values from the WHERE clause are substituted directly into the generated SQL with their escape flag ignored, so they are never escaped or quote...

9.4CVSS5.8AI score0.00377EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
added yesterday6 views

CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

Impact A SQL injection vulnerability exists in the Query Builder's deleteBatch method. When deleteBatch is used together with where conditions, the bound values from the WHERE clause are substituted directly into the generated SQL with their escape flag ignored, so they are never escaped or quote...

9.4CVSS5.7AI score0.00377EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
added yesterday10 views

EUVD-2026-51396

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure...

4.8CVSS5.2AI score0.00135EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added yesterday7 views

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

Impact IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request. In affected deployments, an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request as secure. This may impact applications that rely on...

4.8CVSS5.3AI score0.00135EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added yesterday6 views

GHSA-7WMF-PW8J-MC78 CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

Impact IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request. In affected deployments, an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request as secure. This may impact applications that rely on...

4.8CVSS5.4AI score0.00135EPSS
SaveExploits0References5
EUVD
EUVD
added yesterday9 views

EUVD-2025-27054

Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed i...

8.1CVSS5.7AI score
SaveExploits0References3
CVE
CVE
added yesterday20 views

CVE-2025-58375

Frappe (full-stack web framework) is affected by an insecure endpoint parameter enabling error-based SQL injection in versions 14.96.9 and earlier, and 15.0.0–15.71.0, due to lack of input validation. Impact includes potential retrieval of sensitive information (e.g., versioning). Remediation: up...

8.1CVSS5.7AI score
SaveExploits0References3
Cvelist
Cvelist
added yesterday14 views

CVE-2025-58375 Frappe has potential SQL Injection due to missing validation

Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed i...

8.1CVSS
SaveExploits0References3
NVD
NVD
added yesterday7 views

CVE-2026-56818

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling...

6.5CVSS
SaveExploits0References4
NVD
NVD
added yesterday7 views

CVE-2026-19082

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

7.5CVSS
SaveExploits0References4
OSV
OSV
added yesterday6 views

GHSA-WCX4-WPFV-MC5C jsii-diff: Command Injection via npm: package argument

Summary jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. An issue exists where specially formatted command line arguments can be used to execute shell commands via this tool. Impa...

8.4CVSS5.8AI score0.0063EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
added yesterday9 views

jsii-diff: Command Injection via npm: package argument

Summary jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. An issue exists where specially formatted command line arguments can be used to execute shell commands via this tool. Impa...

8.4CVSS5.7AI score0.0063EPSS
SaveExploits0References5Affected Software1
GithubExploit
GithubExploit
added yesterday17 views

reverse-engineering-vault

Reverse Engineering Vault Browse the notes directly on GitHub...

5.7AI score
SaveExploits0
EUVD
EUVD
added yesterday7 views

EUVD-2026-54561

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

7.5CVSS5.3AI score
SaveExploits0References3
Cvelist
Cvelist
added yesterday23 views

CVE-2026-19082 Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

SaveExploits0References3
CVE
CVE
added yesterday21 views

CVE-2026-19082

Affected product: Imager (Perl) versions from 0.45_02 up to (but not including) 1.034. Root cause: copy_string_tags computes tag length as entry->size - 1; when entry->size is 0 (zero-count ASCII EXIF entry), i_tags_add() uses -1, causing strlen() to read past the entry and copy adjacent he...

7.5CVSS5.3AI score
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added yesterday4 views

CVE-2026-19082

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

7.5CVSS5.3AI score
SaveExploits0References4Affected Software1
Rows per page
Query Builder