12014 matches found
CVE-2026-76985 Apache Wicket: XSS in Palette via getAdditionalAttributes
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings...
CVE-2026-76985 Apache Wicket: XSS in Palette via getAdditionalAttributes
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings...
CVE-2026-5956 SQLi in Ankara Hosting's Site Management Panel
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affects Site Management Panel: through 15062026...
EUVD-2026-68508
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affects Site Management Panel: through 15062026...
CVE-2026-5956 SQLi in Ankara Hosting's Site Management Panel
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affects Site Management Panel: through 15062026...
CVE-2026-5956
Ankara Hosting Site Management Panel is affected by a SQL injection vulnerability caused by improper neutralization of special elements used in an SQL command. The issue affects versions through 15062026 . The assigned CVSS 3.1 score is 8.8 (HIGH) , with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:...
CVE-2026-65646
A flaw was found in Plesk. Improper neutralization of special elements allows remote authenticated users to disclose arbitrary local files. This vulnerability can also lead to privilege escalation within the system...
PT-2026-83798
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affects Site Management Panel: through 15062026...
PT-2026-83806
Name of the Vulnerable Software and Affected Versions Apache Wicket versions 1.4.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0 Description Improper neutralization of input during web page generation occurs in the...
CVE-2026-76985: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings...
CVE-2026-76984: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates and header tags. It escaped the attribute names it wrote, but ran the attribute values through a replacement of " with ". A backslash before a double quote mean...
CVE-2026-77846
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...
CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...
Improper Neutralization of Special Elements
Overview org.graylog2:graylog2-server is a log management platform. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in its syslog key-value message parser, which handles the key-value format emitted by Fortigate devices. An attacker can overwrite...
CVE-2026-70331
Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-66323
Improper neutralization of parameter/argument delimiters in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...
CVE-2026-76797 MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports
The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading characters that spreadsheet applications treat as formulas. A user with write privileges on the cluster can choose a namespace name that is later evaluated as a...
EUVD-2026-67849
Improper neutralization of parameter/argument delimiters in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...