GHSA-G6V3-WV4J-X9HG October Rain has Environment Variable Exfiltration via INI Parser Interpolation

A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parseinistring function supports $ syntax for environment variable interpolation. Attackers with Editor access could inject $APPKEY, $DBPASSWORD, or similar patterns into CMS page settings fields,...

October Rain has Environment Variable Exfiltration via INI Parser Interpolation

A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parseinistring function supports $ syntax for environment variable interpolation. Attackers with Editor access could inject $APPKEY, $DBPASSWORD, or similar patterns into CMS page settings fields,...

CVE-2026-25125

October is a Content Management System CMS and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability in the INI settings parser. Because PHP's parseinistring function supports $ syntax for environment variable interpolation, attackers with...

CVE-2026-25125 October CMS: Environment Variable Exfiltration via INI Parser Interpolation

October is a Content Management System CMS and web platform. Versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability in the INI settings parser. Because PHP's parseinistring function supports $ syntax for environment variable interpolation, attackers with...

CVE-2026-25125

CVE-2026-25125 affects October CMS versions prior to 3.7.14 and 4.1.10. The issue is a server-side information disclosure in the INI settings parser: if cms.safe_mode is enabled, an Editor user can inject patterns like ${APP_KEY} or ${DB_PASSWORD} via parse_ini_string() through page settings, cau...

CVE-2020-7617

ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a 'proto' payload...

EUVD-2020-0473

Malware in sbrugna...

MAL-2025-16710 Malicious code in cello-ini-parser (npm)

The package cello-ini-parser was found to contain malicious code...

Malicious code in cello-ini-parser (npm)

The package cello-ini-parser was found to contain malicious code...

OESA-2025-1277 iniparser security update

This modules offers parsing of ini files from the C level. See a complete documentation in HTML format, from this directory open the file html/index.html with any HTML-capable browser. Security Fixes: Heap-based Buffer Overflow vulnerability in iniparserdumpsectionini in iniparser allows attacker...

USN-7286-1 iniparser vulnerability

It was discovered that iniParser incorrectly handled certain files. An attacker could possibly use this issue to cause iniParser to crash, resulting in a denial of service...

USN-6486-1 iniparser vulnerability

It was discovered that iniParser incorrectly handled certain files. An attacker could possibly use this issue to cause a crash...

iniParser analysis library Heap Buffer Overflow DoS

The vulnerability of the iniparsergetlongint function in the iniParser analysis library is related to pointer arithmetic errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2022-8903 · Js-Ini · Js-Ini

Name of the Vulnerable Software and Affected Versions: js-ini versions prior to 1.3.0 Description: The issue arises when an attacker submits a malicious INI file to an application that uses the parse function to parse it. This can lead to prototype pollution on the application, which can be furth...

PHP zend_ini_do_op Code Execution

The vulnerability of the zendinidoop function Zend/zendini parser.c in the PHP interpreter is caused by buffer overflow. Exploiting this vulnerability could allow a remote attacker to execute arbitrary PHP code...

fio:fuzz_parseini: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6236771218751488 Project: fio Fuzzing Engine: libFuzzer Fuzz Target: fuzzparseini Job Type: libfuzzerubsanfio Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00ad9e1702a0 Crash State: NULL Sanitizer: undefined UBSAN Recommended...

CVE-2021-23328

This affects all versions of package iniparserjs. This vulnerability relates when iniparser.js is concentrating arrays. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program...

fio:fuzz_parseini: Crash in fio_option_dup_subs

Detailed Report: https://oss-fuzz.com/testcase?key=5187740813623296 Project: fio Fuzzing Engine: libFuzzer Fuzz Target: fuzzparseini Job Type: libfuzzerubsanfio Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x006b353d7362 Crash State: fiooptiondupsubs dupandsuboptions fiooptionsparse...

Prototype Pollution

Overview multi-ini is an ini-file parser which supports multi line, multiple levels and arrays to get a maximum of compatibility with Zend config files. Affected versions of this package are vulnerable to Prototype Pollution. It is possible to pollute an object's prototype by specifying the proto...

.ini-parser Code Execution

The vulnerability of the parse function in the .ini parsing library “ini-parser” from the NPM package is due to an uncontrolled resource consumption. Exploiting this vulnerability could allow a attacker to execute arbitrary code...