CVE-2024-38475

CVE-2024-38475 POC Credit : All credit to this guy: https://blog.orange.tw/ and https://x.com/orange8361 all i did was make a POC script from his research. Introduction : Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesyste...

CVE-2026-34197-Apache-ActiveMQ-RCE

Fixed the issue where the reverse shell failed because the command was not XML-escaped...

ALPINE-CVE-2026-109476

Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network...

CVE-2026-109476

Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network...

CVE-2026-109476

Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network...

CVE-2026-83559 Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal

Improper encoding or escaping of output in Apache Wicket. org.apache.wicket.core.util.string.JavaScriptUtilsescapeQuotes replaces each single quote in its input with a backslash and a single quote, and each double quote with a backslash and a double quote, so that the value can be placed inside a...

CVE-2026-83559

The Apache Wicket framework is vulnerable to an improper encoding issue in org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes(). The method fails to escape backslashes before escaping quotes, allowing an attacker to break out of a JavaScript string literal if they can influence the i...

CLEANSTART-2024-BG02614 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website

CVE-2020-6811 affects multiple packages. The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. See references for individual vulnerability details...

CLEANSTART-2024-AC47233 When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped

CVE-2021-43541 affects multiple packages. When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. See references for individual vulnerability details...

CLEANSTART-2024-VQ62925 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website

CVE-2020-6811 affects multiple packages. The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. See references for individual vulnerability details...

CLEANSTART-2024-AZ31228 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website

CVE-2020-12393 affects multiple packages. The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. See references for individual vulnerability details...

CLEANSTART-2024-TS30385 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website

CVE-2020-12392 affects multiple packages. The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. See references for individual vulnerability details...

CLEANSTART-2026-QH90865 trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped

CVE-2026-97030 affects multiple packages. A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. See references for individual vulnerability details...

CLEANSTART-2024-OM32175 constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell

CVE-2022-22744 affects multiple packages. The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. See references for individual vulnerability details...

GHSA-WX4J-MVGX-MQWP Satori-generated SVG has improper escaping

Impact Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Workaround No complete workaround exists besides upgrading. Applications tha...

npm: Satori-generated SVG has improper escaping

npm: Satori-generated SVG has improper escaping vulnerability discovered by ? in WordPress npm satori versions = 0.0.27, 0.33.5...

Satori-generated SVG has improper escaping

Impact Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the generated SVG is consumed. Workaround No complete workaround exists besides upgrading. Applications tha...

EUVD-2026-110523

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events.name values to the chart.sankey...

CVE-2026-116815

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events.name values to the chart.sankey...

CVE-2026-116815 OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events.name values to the chart.sankey...