CVE-2023-36085_SISQUALWFM-Host-Header-Injection

CVE-2023-36085 SISQUALWFM 호스트 헤더 주입 취약점 이 저장소에는 SISQUALWFM 버전 7.1.319.103에서 발견된 호스트 헤더 주입 취약점과 관련된 정보가 포함되어 있으며, 이 취약점으로 인해 공격자가 웹페이지 링크를 조작하거나 사용자를 악성 사이트로 리디렉션할 수 있습니다. 이 취약점에는 CVE-2023-36085가 할당되었으며 버전 7.1.319.111 이상에서 수정되었습니다. 취약점 세부 정보 익스플로잇 제목: SISQUALWFM 7.1.319.103 호스트 헤더 주입 발견 날짜:...

CVE-2019-10092

CVE-2019-10092: Apache HTTP Server의 "Proxy Error" 페이지를 통한 제한적 크로스 사이트 스크립팅 Apache HTTP Server 2.4.0-2.4.39에서 modproxy 오류 페이지에 영향을 주는 제한적 크로스 사이트 스크립팅 문제가 보고되었습니다. 공격자는 오류 페이지의 링크를 잘못된 형태로 만들어 자신이 선택한 페이지를 가리키도록 할 수 있습니다. 이 취약점은 프록시가 활성화되어 있지만 Proxy Error 페이지가 표시되도록 잘못 구성된 서버에서만 악용될 수 있습니다. 공급업체 공...

ROS-20260813-73-0017

The vulnerability in Gitea is related to the use of a name with an incorrect link. Exploiting this vulnerability can allow an attacker to cause service failures...

Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation

SummaryAn application-wide Cross-Site Request Forgery CSRFvulnerability was found Open-WebUl's image uploading functionality. An attacker can set an image URL to a malicious endpoint, allowing them to perform actions on behalf of a victim user. Any authenticated user can exploit this vulnerabilit...

PYSEC-2026-2738 Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation

Summary An application-wide Cross-Site Request Forgery CSRF vulnerability was found Open-WebUl's image uploading functionality. An attacker can set an image URL to a malicious endpoint, allowing them to perform actions on behalf of a victim user. Any authenticated user can exploit this...

CVE-2026-10836

The CVE-2026-10836 entry concerns a vulnerability in Password Manager where improper neutralization of HTTP headers allows an attacker to manipulate the Host header via crafted requests. This can lead to generation of manipulated links or responses and potentially cause limited information disclo...

CVE-2026-10581

A flaw has been found in DedeCMS 5.7.88. Affected by this vulnerability is the function base64decode of the file /plus/download.php?open=1. This manipulation of the argument Link causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and...

CVE-2026-8492

The Translate Drupal with GTranslate module (versions 0.0.0 through 3.0.4) is vulnerable to a Modification of Assumed-Immutable Data (MAID) issue. The root cause is that the module's widget JavaScript fails to sufficiently validate that document.currentScript refers to the executing script elemen...

CVE-2026-8492 Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035

Modification of Assumed-Immutable Data MAID vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects Translate Drupal with GTranslate: from 0.0.0 before 3.0.5...

Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035

The GTranslate module provides a language switcher widget for Drupal sites. The module’s widget JavaScript did not sufficiently validate that document.currentScript referred to the executing script element. A user who can add HTML to a page could cause the generated language-switcher links to poi...

CVE-2026-6604 modelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgery

A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function parseurl/prepareimage/openaiaudiototext of the file src/agentscope/tool/multimodality/openaitools.py of the component Cloud Metadata Endpoint. Such manipulation of the argument...

CVE-2026-5470 mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request forgery

A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83. This issue affects the function extractContent of the file src/services/content-extractor.service.ts of the component Model Context Protoc...

EUVD-2026-9964

A vulnerability was determined in Wavlink WL-NU516U1 V240425. This affects the function sub405AF4 of the file /cgi-bin/adm.cgi of the component OTA Online Upgrade. This manipulation of the argument firmwareurl causes command injection. It is possible to initiate the attack remotely. The exploit h...

PT-2026-21944

Name of the Vulnerable Software and Affected Versions feiyuchuixue sz-boot-parent versions through 1.3.2-beta Description A weakness exists in feiyuchuixue sz-boot-parent up to version 1.3.2-beta. This issue affects unknown code within the /api/admin/common/files/download file. Manipulation of th...

CVE-2026-26747

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...

CVE-2026-2853

A vulnerability was detected in D-Link DWR-M960 1.01.07. This affects the function sub462E14 of the file /boafrm/formSysLog of the component System Log Configuration Endpoint. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. The attack can be initiated...

CVE-2025-15577

An unauthenticated attacker can exploit this vulnerability by manipulating URL to achieve arbitrary file read access.This issue affects Valmet DNA Web Tools: C2022 and older...

Cross-site Scripting (XSS)

Overview @tutao/otest is a little test runner Affected versions of this package are vulnerable to Cross-site Scripting XSS via the contact viewer. An attacker can manipulate the appearance and behavior of the link button by injecting specially crafted contact data, causing the link address to be...

GHSA-24V3-254G-JV85 Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature

Impact Users importing contacts from untrusted sources. Specifically crafted contact data can lead to some of DOM modifications for the link button next to the field e.g. the link address can be overriden. CSS can be manipulated to give the button arbitrary look and change it's size so that any...

Race Condition Enabling Link Following

Overview Affected versions of this package are vulnerable to Race Condition Enabling Link Following in the handling of procfs file writes. An attacker can cause arbitrary writes to sensitive files or trigger a denial of service by redirecting write operations through race conditions and...