783 matches found
CVE-2026-75922
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...
CVE-2026-75922 Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...
EUVD-2026-64662
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...
Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting
Mitel ShoreTel 19.46.1802.0 devices and their conference component are vulnerable to an unauthenticated attacker conducting reflected cross-site scripting attacks via the PATHINFO variable to index.php due to insufficient validation for the timezone object in the HOMEMEETING& page. id:...
SUSE CVE-2026-27590
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because...
CVE-2026-27590
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because...
GO-2026-4486 FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp
FrankenPHP's unicode case-folding length expansion causes incorrect splitpath index SCRIPTNAME/PATHINFO confusion in FrankenPHP in github.com/dunglas/frankenphp...
CVE-2019-20515
ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the addresses/ URI...
CVE-2019-20521
ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the api/ URI...
CVE-2019-20516
ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the blog/ URI...
CVE-2019-16657
TuziCMS 2.0.6 has XSS via the PATHINFO to a group URI, as demonstrated by index.php/article/group/id/2/...
EUVD-2017-7375
Malware in sbrugna...
EUVD-2014-4656
Malware in sbrugna...
EUVD-2008-0369
Malware in sbrugna...
EUVD-2010-4786
Malware in sbrugna...
EUVD-2011-1722
Malware in sbrugna...
EUVD-2018-10351
Malware in sbrugna...
EUVD-2012-1009
Malware in sbrugna...