370 matches found
filebuster
Filebuster An extremely fast and flexible web fuzzer What is it? Filebuster is a HTTP fuzzer / content discovery script with loads of features and built to be easy to use and fast! It uses one of the fastest HTTP classes in the world of PERL - Furl::HTTP. Also the thread modelling is optimized to...
CVE-2026-61812
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can inspect different bytes than a browser ...
CVE-2026-61812
The ModSecurity web application firewall (WAF) engine is vulnerable to rule evasion due to a limitation in the t:htmlEntityDecode transformation. Prior to versions 2.9.15 and 3.0.17 , the decoder recognizes only a small subset of named HTML entities, allowing attackers to encode ASCII separators ...
CLEANSTART-2024-DM47223 Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities
Security vulnerability affects the librewolf package. Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities...
Astra Linux ā vulnerability in python-django
An issue was found in Django versions prior to 5.1.4, 5.0 prior to 5.0.10, and 4.2 prior to 4.2.17. The striptags method and the striptags template filter are vulnerable to denial-of-service attacks caused by certain inputs containing large sequences of nested incomplete HTML entities...
EulerOS 2.0 SP13 : perl-HTML-Parser (EulerOS-SA-2026-4085)
According to the versions of the perl-HTML-Parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities. The XS routine backing...
EulerOS 2.0 SP13 : perl-HTML-Parser (EulerOS-SA-2026-4176)
According to the versions of the perl-HTML-Parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities. The XS routine backing...
EulerOS 2.0 SP15 : perl-HTML-Parser (EulerOS-SA-2026-4003)
According to the versions of the perl-HTML-Parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities.x000D x000D The XS routine backing...
EulerOS 2.0 SP15 : perl-HTML-Parser (EulerOS-SA-2026-3937)
According to the versions of the perl-HTML-Parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities.x000D x000D The XS routine backing...
CVE-2026-85680
The Ultimate Member WordPress plugin (versions before 2.13.1 ) is vulnerable to an unauthenticated stored XSS flaw. The root cause is the failure to escape values derived from user-supplied profile names before they are output in the page title, combined with the decoding of HTML entities after s...
PYSEC-2026-3831 eml_parser has a URL extraction bypass via HTML entities in URLs
Summary emlparser performs certain validations on potential URL strings to discard bogus values. In versions prior to 3.0.2, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject valid URLs that use HTML...
eml_parser has a URL extraction bypass via HTML entities in URLs
Summaryemlparser performs certain validations on potential URL strings to discard bogus values. In versions prior to 3.0.2, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject valid URLs that use HTML...
EulerOS 2.0 SP12 : perl-HTML-Parser (EulerOS-SA-2026-3293)
According to the versions of the perl-HTML-Parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities. The XS routine backing...
EulerOS 2.0 SP12 : perl-HTML-Parser (EulerOS-SA-2026-3368)
According to the versions of the perl-HTML-Parser package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities. The XS routine backing...
PT-2026-86485
šØ CVE-2026-84219 The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an...
CVE-2026-84219: Improper Neutralization of Input During Web Page Generation
The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on...
CVE-2026-55618
A flaw was found in emlparser, a Python module for parsing email files. The cleanfounduri function incorrectly validates Uniform Resource Locator URL strings by processing them before unescaping HTML entities. This allows a remote attacker to craft malicious URLs using HTML entities that are then...
Improper Encoding or Escaping of Output
Overview eml-parser is a Python EML parser library Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the URL extraction process. An attacker can cause valid URLs containing HTML entities to be omitted from extraction by encoding characters such as :, /...
GHSA-FXGQ-9M89-CXJ9 eml_parser has a URL extraction bypass via HTML entities in URLs
Summary emlparser performs certain validations on potential URL strings to discard bogus values. In versions prior to 3.0.2, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject valid URLs that use HTML...
eml_parser has a URL extraction bypass via HTML entities in URLs
Summary emlparser performs certain validations on potential URL strings to discard bogus values. In versions prior to 3.0.2, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject valid URLs that use HTML...