Astro SSR - Server-Side Request Forgery

Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources. id: CVE-2026-25545 info: name: Astro SSR - Server-Side Request Forgery author:...

CVE-2019-10092_Docker

CVE-2019-10092 Docker - Apache HTTP Server Using $ docker-compose up Using from Docker Hub $ docker run -p 5555:5555 motikan2010/cve-2019-10092 PoC Disclosures/CVE-2019-10092-Limited Cross-Site Scripting in modproxy Error Page-Apache httpd at master · DrunkenShells/Disclosures...

CVE-2019-10092

CVE-2019-10092: Limited Cross-Site Scripting via "Proxy Error" Page in Apache HTTP Server In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point t...

cpanel-xss-177

xss - cpanelCVE-2023-29489 cPanel versions 11.102.0.x 11.102.0.31 / 11.106.0.x 11.106.0.x / 11.108.0.x 11.108.0.13 / 11.109.9999.x 11.109.9999.116 are vulnerable to Reflected Cross-Site Scripting via a specially crafted request to the web call ID when displayed on the error page for cpsrvd. How t...

CVE-2019-20372

CVE-2019-20372 This repository is for educational purposes only. /server vulnerable server run ./server.sh /exploit.py exploit script run python3 exploit.py importante! https://blkcipher.pl/assets/pdfs/2019-12-10-errorpagerequestsmuggling.pdf https://github.com/vuongnv3389-sec/CVE-2019-20372 why...

CVE-2017-9822

CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution RCE DotNetNuke DNN versions between 5.0.0 - 9.3.0 are affected to deserialization vulnerability that leads to Remote Code Execution RCE. DotNetNuke uses the DNNPersonalization cookie to store anonymous users’ personalization...

CVE-2023-29489

Introductoin An exploitable reflected cross-site scripting XSS vulnerability has been discovered in certain versions of cPanel and was assigned with CVE-2023-29489. This vulnerability allows attackers to execute arbitrary JavaScript code without requiring authentication. The XSS vulnerability can...

Exploit for CVE-2016-4977

Spring Security OAuth2 Whitelabel SpEL RCE CVE-2016-4977 V...

CVE-2025-62168

CVE-2025-62168 — Squid Proxy Token Leak PoC The author assumes no liability for misuse or damage caused by this tool. Research is provided strictly for educational and defensive purposes. Description This repository contains a Proof-of-Concept PoC for CVE-2025-62168 , an information-disclosure fl...

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the...

GHSA-R5MF-4R5X-Q78F Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the...

CVE-2026-105114

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

EUVD-2026-92018

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114 OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

CVE-2026-105114: Improper Neutralization of Input During Web Page Generation

OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. Attackers can lure victims to a crafted /oauth2/authorize link with repeat...

PT-2026-104575

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An issue exists where unauthenticated attackers can perform reflected cross-site scripting XSS by providing crafted parameters that are rendered without proper encoding on the OAuth2 authorization...

Rocky Linux 9 [CIQ] Security Update: xmlrpc-c / xmlrpc-c-c++ / xmlrpc-c-c++-debuginfo / xmlrpc-c-client / etc (crlsa-2026_61316)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202661316 advisory. xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component CVE-2026-15928 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: xmlrpc-c / xmlrpc-c-c++ / xmlrpc-c-c++-debuginfo / xmlrpc-c-client / etc (crlsa-2026_64772)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202664772 advisory. xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component CVE-2026-15928 Tenable has extracted the preceding description block directly from the CIQ...