74 matches found
CVE-2026-61589
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory.get... with no HTTPHOST, so request.gethost defaulted to...
EUVD-2026-81306
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory.get... with no HTTPHOST, so request.gethost defaulted to...
CVE-2026-61589 djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory.get... with no HTTPHOST, so request.gethost defaulted to...
CVE-2026-15202
A security vulnerability has been detected in YzmCMS up to 7.5. Affected is the function geturl of the file /yzmphp/yzmphp.php of the component Header Handler. The manipulation of the argument HTTPHOST leads to cross site scripting. The attack may be initiated remotely. The exploit has been...
CVE-2026-15202: Improper Neutralization of Input During Web Page Generation
A security vulnerability has been detected in YzmCMS up to 7.5. Affected is the function geturl of the file /yzmphp/yzmphp.php of the component Header Handler. The manipulation of the argument HTTPHOST leads to cross site scripting. The attack may be initiated remotely. The exploit has been...
CVE-2026-54588
Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled HTTPHOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An...
CVE-2026-54588
Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled "HTTPHOST" request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An...
CVE-2026-54588: Improper Input Validation
Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled HTTPHOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An...
TOTOLINK WA300 buffer overflow vulnerability
TOTOLINK WA300 is a 300Mbps single-band 2.4GHz wired wireless AP access point designed for installation in standard 86-type enclosures. It is primarily used for wireless coverage in hotels, dormitories, and office environments. The TOTOLINK WA300 has a buffer overflow vulnerability. This...
CVE-2026-7719 Totolink WA300 POST Request cstecgi.cgi loginauth buffer overflow
A security flaw has been discovered in Totolink WA300 5.2cu.7112B20190227. The affected element is the function loginauth of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument httphost results in buffer overflow. The attack may be launched...
CVE-2026-32616
Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $SERVER'HTTPHOST' without validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host header in the HTTP request, causing the verification lin...
CVE-2025-60699: Stack-based Buffer Overflow
A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592B20191022ALL within the global.so binary. The getSaveConfig function retrieves the httphost parameter from user input via websGetVar and copies it into a fixed-size stack buffer v13 using strcpy without...
CVE-2025-63468: Stack-based Buffer Overflow
Totolink LR350 v9.3.5u.6369B20220309 was discovered to contain a stack overflow via the httphost parameter in the sub426EF8 function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...
EUVD-2005-3662
Malware in sbrugna...
EUVD-2023-40870
Malicious code in bioql PyPI...
EUVD-2024-35310
Malicious code in bioql PyPI...
EUVD-2023-40308
Malicious code in bioql PyPI...
CVE-2024-42547
TOTOLINK A3100R V4.1.2cu.5050B20200504 has a buffer overflow vulnerability in the httphost parameter in the loginauth function...