Apache Tomcat - Cross-Site Scripting

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, fro...

CVE-2026-116238

In server mode pgAdmin 4 locks an internal account after MAXLOGINATTEMPTS failed logins 3 by default. The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration: ...

python-codext

CodExt Encode/decode anything. CodExt is a library Python 3.10 or later that extends the native codecs library namely for adding new custom encodings and character mappings and provides 120+ new codecs , hence its name combining CODecs EXTension. It also features a guess mode for decoding multipl...

EUVD-2026-114379

In server mode pgAdmin 4 locks an internal account after MAXLOGINATTEMPTS failed logins 3 by default. The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration: ...

pcfg_cracker

PCFG = Probabilistic Context Free Grammar PCFG = Pretty Cool Fuzzy Guesser In short: A collection of tools to perform research into how humans generate passwords. These can be used to crack password hashes, but also create synthetic passwords honeywords, or help develop better password strength...

CVE-2026-116238: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default)

In server mode pgAdmin 4 locks an internal account after MAXLOGINATTEMPTS failed logins 3 by default. The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration: ...

EUVD-2026-102189

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::chec...

CVE-2026-102334

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-96599

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer...

tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example

A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting XSS, allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to...

tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example

A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting XSS, allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to...

tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example

A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting XSS, allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to...

tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example

A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting XSS, allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to...

tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example

A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting XSS, allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to...

tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example

A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting XSS, allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to...

tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example

A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting XSS, allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 8.0. before 8.0.29, 8.1. before 8.1.20, and 8.2. before 8.2.7, when using SOAP HTTP Digest Authentication, the random value generator was not checked for failures. It used a narrower range of values than necessary. In the event of a random value generator failure, it could lead to...

CVE-2023-24284

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the ismarkable function...

UBUNTU-CVE-2023-24284

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the ismarkable function...

tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example

A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting XSS, allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to...