CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

EUVD-2026-53309

Grocy's API request-body parser controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing , , and back to , and & immediately after purification. This...

EUVD-2025-179251

Malicious code in double-decode-encrypt-cache-bundle npm...

nike.com Cross Site Scripting vulnerability OBB-2201528

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| nike.com ---|--- Open Bug Bounty...

Microsoft IIS/PWS CGI Filename Double Decode Command Execution

No description provided by source. $Id: ms01026dbldecode.rb 11513 2011-01-08 00:25:44Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms o...

Microsoft IIS/PWS - CGI Filename Double Decode Command Execution (MS01-026) (Metasploit)

$Id: ms01026dbldecode.rb 11513 2011-01-08 00:25:44Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Directory Traversal vulnerability in IPCheck Monitor Server

Directory Traversal vulnerability in IPCheck Monitor Server -------------------------------------- Overview A directory traversal vulnerability has been identified in IPCheck Server Monitor Free/Trial/Professional, which may be exploited by potential attackers to retrieve files from the underlyin...

Immunity Canvas: IIS_DOUBLEDECODE

Name| iisdoubledecode ---|--- CVE| CVE-2001-0333 Exploit Pack| CANVAS Description| iisdoubledecode MS01-026 Notes| CVE Name: CVE-2001-0333 VENDOR: Microsoft Notes: The IIS Double Decode module will automatically use tftp to get a MOSDEF node on the remote target. This will not work through a...