CVE-2025-71431 Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters

Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory...

CVE-2025-71431 Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters

Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory...

CVE-2025-71431 Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters

Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory...

CVE-2024-58391 Frappe before 15.4.0 XSS via Printview Parameters

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the...

CVE-2024-58391 Frappe before 15.4.0 XSS via Printview Parameters

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the...

CVE-2026-93879

A flaw was found in Hibernate Validator starting with version 5.4.1. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS by submitting specially crafted input containing unescaped message parameters. Improper escaping allows user-supplied data to be...

PT-2026-111005

Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory...

sqlmc

SQLMC - Controllo Massivo di SQL Injection Demo Informazioni Questo strumento è solo per scopi educativi, l'uso di SQLMC per attaccare target senza il preventivo consenso reciproco è illegale. Gli sviluppatori non si assumono alcuna responsabilità e non sono responsabili per qualsiasi uso impropr...

CVE-2026-5725 Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix

The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt' prefixed request parameters in all versions up to, and including, 1.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-14335

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-14335

The Easy Digital Downloads WordPress plugin (versions 3.6.9 and below ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping specifically within PayPal IPN Parameters . This allows unauthenticated attackers to i...

CVE-2026-14335 Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible fo...

EUVD-2026-96116

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-14335 Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible fo...

parameth

parameth Esta herramienta se puede usar para descubrir por fuerza bruta parámetros GET y POST A menudo, cuando estás explorando un directorio en busca de archivos comunes, puedes identificar scripts por ejemplo test.php que parecen necesitar un parámetro desconocido. Con suerte, esto puede ayudar...

CLEANSTART-2026-YB42445 Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters

Security vulnerability affects the apache-nifi package. Applications using Spring Data Commons may be vulnerable to a Denial of Service DoS attack leading to a StackOverflowException when parsing Sort parameters...

CVE-2026-108665: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or POST requests to /airag/prompts/edit with a template id to overwrite prompt...

PT-2026-109521

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible fo...

PT-2026-117915

Security vulnerability affects the apache-nifi package. Applications using Spring Data Commons may be vulnerable to a Denial of Service DoS attack leading to a StackOverflowException when parsing Sort parameters...

CVE-2026-5725: Improper Neutralization of Input During Web Page Generation

The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt' prefixed request parameters in all versions up to, and including, 1.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...