17782 matches found
CVE-2025-67649
CVE-2025-67649 affects PHP Jabbers – Car Rental Script. A SQL injection vulnerability arises from improper neutralization of user input in parameters used for sorting, enabling unauthenticated attackers to perform SQL Injection. The issue is fixed in version 4.1. If applying mitigations, upgrade ...
CVE-2026-18209
A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. Whe...
EUVD-2026-51479
A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can...
EUVD-2026-51410
The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks...
CVE-2026-14554
The Check & Log Email WordPress plugin versions before 2.0.15 is vulnerable to SQL injection because it fails to properly sanitize and escape parameters used in SQL queries. This flaw allows users with administrator privileges to execute unauthorized SQL commands. Specifically, the vulnerability ...
CVE-2026-14554 Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters
The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks...
EUVD-2026-51374
A Server-Side Request Forgery SSRF vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client...
PT-2026-66748
Name of the Vulnerable Software and Affected Versions PHP Jabbers scripts affected versions not specified Description An authenticated SQL injection occurs due to improper neutralization of input provided by a user into parameters used for sorting functions. This allows an authenticated attacker ...
CVE-2026-56568: Generation of Error Message Containing Sensitive Information
HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...
PT-2026-66729
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the SAML protocol implementation when handling authentication requests via the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can...
PT-2026-66765
HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...
Brother MFC-9970CDW Printers Cross-site Scripting (CVE-2013-2671)
Multiple cross-site scripting XSS vulnerabilities in the Brother MFC-9970CDW printer with firmware L 1.10 allow remote attackers to inject arbitrary web script or HTML via the 1 id or 2 val parameter to admin/adminmain.html; 3 id, 4 val, or 5 arbitrary parameter name QUERYSTRING to...
JLSEC-2026-1042 ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of...
ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing out-of-bounds heap buffer reads. Attackers can trigger heap buffer overflow by providing incorrect morphology parameters causing single pixel memory access violations...
CVE-2026-17543
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...
UBUNTU-CVE-2026-17543
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...
CVE-2026-17543
CVE-2026-17543 affects PHP with ext-pgsql, where improper escaping of backslashes in attacker-provided parameters enables SQL injection via E'...' backslash breakout. Vulnerable PHP versions: 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9. Affected component...
Linux Distros Unpatched Vulnerability : CVE-2026-58041
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement...
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...
CVE-2026-54735
Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafte...
prebid-server's request forgery vulnerability allows for possible host environment data extraction
Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing...