92 matches found
OWASP__json-sanitizer_CVE-2020-13973_1-2-0
json-sanitizer Dado contenido similar a JSON, el Sanitizador de JSON lo convierte a JSON válido. Primeros pasos - Contacto Esto puede colocarse en cualquier extremo de un pipeline de datos para ayudar a cumplir el principio de Postel: sé conservador en lo que haces, sé liberal en lo que aceptas d...
CheatSheetHost
CheatSheetHost Un servidor web ligero y basado en contenido para alojar hojas de trucos interactivas y materiales de referencia. Perfecto para desafíos CTF Capture The Flag, ingeniería inversa y documentación técnica. Es ideal para usar en laboratorios donde se desea limitar o prescindir del...
CVE-2025-65881
CVE-2025-65881 El proyecto Zoo Management System v1.00 es vulnerable a Cross-site scripting XSS en /zms/classes/Login.php?f=login debido a: 1. Content-type inválido de las respuestas JSON en /zms/classes/Login.php?f=login 2. Entrada de usuario sin sanear en las respuestas Lo que permite a atacant...
CVE-2022-28108
Selenium Chrome RCE Exploit Extendido Este repositorio contiene una versión modificada de un módulo de Metasploit que explota una vulnerabilidad de Ejecución Remota de Código en versiones antiguas de Selenium Server Grid. Por favor, lea este README atentamente antes de usar este código...
burp-jq
Burp JQ Esta es una extensión de Burp para aplicar consultas jq al contenido JSON del visor de mensajes HTTP. Compilación root@kitploit: $ gradle fatJar Créditos Burp JQ depende de jackson-jq, una implementación de jq en Java. jq jackson jackson-jq...
CVE-2026-82468
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...
CVE-2026-82468 Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...
GHSA-PMV8-RQ9R-6J72 Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
Summary Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names to this...
SUSE CVE-2026-13218
A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causin...
EUVD-2026-39594
A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causin...
CVE-2026-13218
A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causin...
CVE-2026-7439
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation...
CVE-2026-7439
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation...
EUVD-2026-26278
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation...
CVE-2026-7439 AgentFlow Local Web API Content-Type Validation Bypass
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation...
PT-2026-35970
Name of the Vulnerable Software and Affected Versions AgentFlow affected versions not specified Description The local web API fails to enforce application/json validation for non-JSON content types on the 'POST /api/runs' and 'POST /api/runs/validate' endpoints. This allows attackers to bypass...
CVE-2026-33252 MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site POST requests without validating the Origin header and without requiring Content-Type: application/json. In deployments without Authorization,...
EUVD-2025-198335
Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possible for a logged in manager user...