EUVD-2026-74274

n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node...

NPM: n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

NPM: n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

CVE-2026-86082

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...

CVE-2026-86082

n8n , an open source workflow automation platform, is affected by a domain-restriction bypass in the OpenAI Chat Model node . The root cause is that the searchModels code path in loadModels.ts omitted the assertOpenAiCredentialAllowsUrl check, meaning the credential allowed-domain restrictions en...

CVE-2026-86082 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...

CVE-2026-86082 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...

PT-2026-88513

Impact The OpenAI Chat Model node checked a custom base URL against the credential's allowed-domains configuration before sending a request, but the model-search dropdown did not. A request setting options.baseURL on that path reached an arbitrary host with the credential attached, so the domain...

EUVD-2008-2532

Malware in sbrugna...

EUVD-2025-14085

Malicious code in bioql PyPI...

CVE-2025-48265

Cross-Site Request Forgery CSRF vulnerability in Pektsekye Year Make Model Search for WooCommerce ymm-search allows Cross Site Request Forgery.This issue affects Year Make Model Search for WooCommerce: from n/a through = 1.0.11...

CVE-2025-48265

Cross-Site Request Forgery CSRF vulnerability in Pektsekye Year Make Model Search for WooCommerce ymm-search allows Cross Site Request Forgery.This issue affects Year Make Model Search for WooCommerce: from n/a through = 1.0.11...

CVE-2025-4376

CVE-2025-4376 : Sparx Systems Pro Cloud Server’s WebEA model search field is affected by an improper input validation causing Cross-Site Scripting (XSS). Impact applies to Pro Cloud Server versions earlier than 6.0.165. Remediation: upgrade to version 6.0.165 or later. Exploitation details are no...

CVE-2025-4376 Cross-Site Scripting vulnerability in Model Search in Pro Cloud Server's WebEA

Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting XSS. This issue affects Pro Cloud Server: earlier than 6.0.165...

torrid.com XSS vulnerability

Open Bug Bounty ID: OBB-457140 Description| Value ---|--- Affected Website:| torrid.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2008-2537

SQL injection vulnerability in cat.php in HispaH Model Search allows remote attackers to execute arbitrary SQL commands via the cat parameter...

Sql injection

SQL injection vulnerability in cat.php in HispaH Model Search allows remote attackers to execute arbitrary SQL commands via the cat parameter...

CVE-2008-2537

CVE-2008-2537 concerns a SQL injection vulnerability in the cat.php component of HispaH Model Search. The flaw allows remote attackers to inject arbitrary SQL commands through the cat parameter, enabling potential manipulation of the backend database. The available documents identify the affected...

CVE-2008-2537

SQL injection vulnerability in cat.php in HispaH Model Search allows remote attackers to execute arbitrary SQL commands via the cat parameter...

HispaH Model Search (cat.php cat) Remote SQL Injection Vulnerability

No description provided by source. Remote SQL Injection Cyb3r-1st Cyb3r-1st InjEctOr5 TeaM author : cyb3r-1st contact : t3tto0 at yahoo.com cyb3r-1st at hotmail.com script : model-search download : www.hispah.com/demos/models1rock :: demo dork : find it exploit : http://www.site.me/cat.php?cat=sq...

hispah-sql.txt

Remote SQL Injection InjEctOr5 TeaM demo dork : find it exploit : http://www.site.me/cat.php?cat=sql injection example:here u can found an sql exploit ::: for admin inf0 ::: www.site.me/cat.php?cat=9999999'+union+select+concatusername,0x3a,password+from+admin/ for users inf0 :::...