Lucene search
+L

6 matches found

NVD
NVD
added 2026/08/30 3:16 a.m.17 views

CVE-2026-77846

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...

2.1CVSS0.00139EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/30 2:52 a.m.48 views

CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...

2.1CVSS0.00139EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/30 2:52 a.m.15 views

EEF-CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite

Summary Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields...

2.1CVSS5.8AI score0.00139EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/30 2:52 a.m.34 views

CVE-2026-77846

ash-project ash_sqlite versions from 0.1.2-rc.0 before 0.2.18 contain a JSON-path injection in AshSqlite.SqlImplementation. The json_extract path is built by concatenating "$." with Enum.join(right, "."), so a single get_path/2 segment containing ., [, ], or $ re-interprets the JSON path (e.g., "...

2.1CVSS5.9AI score0.00139EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/30 2:52 a.m.9 views

CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...

2.1CVSS5.9AI score0.00139EPSS
SaveExploits0References9
Snyk
Snyk
added 2025/03/01 6:34 a.m.6 views

Directory Traversal

Overview lilya is a Yet another ASGI toolkit that delivers Affected versions of this package are vulnerable to Directory Traversal in getpath function in staticfiles.py. Details A Directory Traversal attack also known as path traversal aims to access files and directories that are stored outside...

8.7CVSS7.6AI score
SaveExploits0References3
Rows per page
Query Builder