CVE-2025-70936: Improper Neutralization of Input During Web Page Generation

Vtiger CRM 8.4.0 contains a reflected cross-site scripting XSS vulnerability in the MailManager module. Improper handling of user-controlled input in the folder parameter allows a specially crafted, double URL-encoded payload to be reflected and executed in the context of an authenticated user s...

EUVD-2006-5195

Malware in sbrugna...

Photo Gallery by WD <= 1.3.66 - Cross-Site Scripting (XSS)

User input gets first escaped with eschtml and then urldecoded. This leads to the possibility of reflected XSS with a double url encoded payload. PoC...

CVE-2006-5858: Exposure of Sensitive Information to an Unauthorized Actor

Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file...

CVE-2006-5858

Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file...

CVE-2006-6600: Undefined Security Weakness

Cross-site scripting XSS vulnerability in dir.php in TorrentFlux 2.2, when allows remote attackers to inject arbitrary web script or HTML via double URL-encoded strings in the dir parameter, a related issue to CVE-2006-5609...

CVE-2006-6177

CVE-2006-6177 describes an SQL injection in Neocrome Seditio

CVE-2006-5210: Undefined Security Weakness

Directory traversal vulnerability in IronWebMail before 6.1.1 HotFix-17 allows remote attackers to read arbitrary files via a GET request to the IMFILE identifier with double-url-encoded "../" sequences "%252e%252e/"...