224 matches found
multiparty-CVE-2026-8161
CVE-2026-8161 Prueba de concepto de CVE-2026-8161 Multiparty Descripción [email protected] y versiones anteriores son vulnerables a denegación de servicio mediante una excepción no capturada. El analizador almacena los campos y archivos subidos en objetos JavaScript simples y no distingue de...
NPM: fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
NPM: fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization vulnerability discovered by ? in WordPress Npm fast-uri versions = 4.1.3, 4.1.5...
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
Impact fast-uri's mailto scheme parser compares each query field name to the reserved names to, subject, body while the name is still percent-encoded, and only percent-decodes it when storing it as a generic header. On serialize, the decoded name is re-emitted, so a field name such as %74o...
Cross-site Scripting (XSS)
Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the AssetPresenter process. An attacker can execute arbitrary scripts in the context of a higher-privileged user's session by injecting maliciou...
GHSA-P9H3-GVPQ-5539 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
Impact A user with the "customfields.create" permission can store HTML/JS in a Custom Field name, which is later rendered as an asset-list column title WITHOUT escaping at app/Presenters/AssetPresenter.php line 364 'title' = $field-name and injected into the table header by the bundled...
CVE-2026-91809
Foxit PDF Editor/Reader is susceptible to a use-after-free vulnerability during the handling of malformed PDF form fields. The root cause is improper validation during field-name traversal , which can lead the application to access a released object. This vulnerability can result in an applicatio...
CVE-2026-91809 Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vulnerability
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash...
EUVD-2026-85154
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash...
grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
A flaw in Grafana allows authenticated 'Editor' users to inject malicious scripts into a table panel's field names. Viewing the compromised dashboard executes the script in the victim's browser, risking data theft or client-side attacks...
PT-2026-87151
Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description A flaw in the JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. The issue occurs when a BSON document containing ...
CVE-2026-85602
The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...
CVE-2026-85602 Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass
The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...
CVE-2026-85602 Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass
The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...
PT-2026-85502
The Grav Form plugin getgrav/grav-plugin-form versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker can place their v3 token under the v2 fie...
CVE-2026-84966
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intende...
grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
A flaw in Grafana allows authenticated 'Editor' users to inject malicious scripts into a table panel's field names. Viewing the compromised dashboard executes the script in the victim's browser, risking data theft or client-side attacks...
grafana: Grafana: Stored Cross-Site Scripting via malicious dashboard field name
A flaw in Grafana allows authenticated 'Editor' users to inject malicious scripts into a table panel's field names. Viewing the compromised dashboard executes the script in the victim's browser, risking data theft or client-side attacks...
CVE-2026-82333 multer vulnerable to Denial of Service via oversized array index in field names
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A larg...
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
Overview A DataObject class-definition field name is concatenated, without an identifier allowlist, into the PHP class source that Pimcore generates for every DataObject class protected $;. A user holding only the ordinary objects DataObjects permission can import a class definition whose field...
GHSA-9X44-4GXF-8C25 Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
Overview A DataObject class-definition field name is concatenated, without an identifier allowlist, into the PHP class source that Pimcore generates for every DataObject class protected $;. A user holding only the ordinary objects DataObjects permission can import a class definition whose field...