Astro SSR - Server-Side Request Forgery

Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources. id: CVE-2026-25545 info: name: Astro SSR - Server-Side Request Forgery author:...

CVE-2019-10092_Docker

CVE-2019-10092 Docker - Apache HTTP Server 사용 방법 $ docker-compose up Docker Hub로부터 사용 $ docker run -p 5555:5555 motikan2010/cve-2019-10092 PoC Disclosures/CVE-2019-10092-Limited Cross-Site Scripting in modproxy Error Page-Apache httpd at master · DrunkenShells/Disclosures...

CVE-2019-10092

CVE-2019-10092: Ограниченный межсайтовый скриптинг через страницу «Ошибка прокси» в Apache HTTP Server В Apache HTTP Server 2.4.0-2.4.39 была обнаружена проблема ограниченного межсайтового скриптинга, затрагивающая страницу ошибки modproxy. Злоумышленник мог вызвать искажение ссылки на странице...

CVE-2019-20372

CVE-2019-20372 Этот репозиторий предназначен только для образовательных целей. /server запустите уязвимый сервер: ./server.sh /exploit.py запустите скрипт эксплойта: python3 exploit.py важно! https://blkcipher.pl/assets/pdfs/2019-12-10-errorpagerequestsmuggling.pdf...

cpanel-xss-177

XSS - cPanel CVE-2023-29489 cPanel в версиях 11.102.0.x 11.102.0.31 / 11.106.0.x 11.106.0.x / 11.108.0.x 11.108.0.13 / 11.109.9999.x 11.109.9999.116 подвержен Reflected Cross-Site Scripting через специально созданные запросы к ID веб-вызова при отображении на странице ошибки для cpsrvd. Установка...

CVE-2017-9822

CVE-2017-9822 Десериализация Cookie DotNetNuke и удаленное выполнение кода RCE Версии DotNetNuke DNN с 5.0.0 по 9.3.0 подвержены уязвимости десериализации, приводящей к удаленному выполнению кода RCE. DotNetNuke использует cookie DNNPersonalization для хранения параметров персонализации анонимных...

CVE-2023-29489

Введение Обнаружена эксплуатируемая отраженная межсайтовая скриптовая уязвимость XSS в некоторых версиях cPanel, которой присвоен номер CVE-2023-29489. Эта уязвимость позволяет злоумышленникам выполнять произвольный JavaScript-код без аутентификации. XSS-уязвимость может быть использована, даже...

CVE-2026-105114

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

EUVD-2026-92018

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114: Improper Neutralization of Input During Web Page Generation

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

PT-2026-104575

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An issue exists where unauthenticated attackers can perform reflected cross-site scripting XSS by providing crafted parameters that are rendered without proper encoding on the OAuth2 authorization...

CVE-2025-62168

CVE-2025-62168 — Утечка токена Squid Proxy PoC Автор не несет ответственности за неправомерное использование или ущерб, причиненный данным инструментом. Исследование предоставляется исключительно в образовательных и защитных целях. Описание Этот репозиторий содержит Proof-of-Concept PoC для...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090055)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090055 advisory. In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the modproxy error page. An attacker could cause the link on the erro...

PT-2026-89679

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

CVE-2026-89145: Improper Neutralization of Input During Web Page Generation

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

RLSA-2026:64772 Important: xmlrpc-c security update

XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC remote procedure call over the Internet. It converts an RPC into an XML document,...

xmlrpc-c security update

An update is available for xmlrpc-c. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list XML-RPC is a remote procedure call RPC protocol that uses XML to encode its...

MiracleLinux 8 : xmlrpc-c-1.51.0-11.el8_10.1 (AXSA:2026-1789:02)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1789:02 advisory. xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component CVE-2026-15928 Tenable has extracted the preceding description block directly from t...