356 matches found
Arbitrary Code Injection
Overview superduper-framework is a Build compositional and declarative AI applications and agents Affected versions of this package are vulnerable to Arbitrary Code Injection in the parseoppart function due to the use of eval on user-supplied input without adequate sanitization or restriction. An...
Use of GET Request Method With Sensitive Query Strings
Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings in the OAuth login process, where the user's password hash is included as a query parameter in a redirect UR...
CVE-2026-30923 libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecurity v3 project. A segmentation fault occurs when a rule using the t:hexDecode transformation inspects a query string parameter containing a...
CVE-2026-30923
CVE-2026-30923 affects libModSecurity3 (ModSecurity v3) where a rule using the t:hexDecode transformation can trigger a segmentation fault when inspecting a single-character query string, causing worker process crashes and denial of service. All versions prior to 3.0.15 are affected; the issue is...
CVE-2026-30923 libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecurity v3 project. A segmentation fault occurs when a rule using the t:hexDecode transformation inspects a query string parameter containing a...
The vulnerability of the application programming interface of the software for creating self-governing Git repositories called Gogs allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the application programming interface of the Gogs self-managed Git repository creation software is related to the disclosure of information through query strings. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to...
PT-2026-37036
Name of the Vulnerable Software and Affected Versions github.com/gofiber/fiber/v3 versions prior to 3.1.0 Description The default key generator in the cache middleware uses only the request path via the c.Path function and excludes the query string. Consequently, requests targeting the same path...
Improper Encoding or Escaping of Output
Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the encode function in AxiosURLSearchParams. An attacker can smuggle a NUL byte into serialized query...
OpenClaw 信息泄露漏洞
OpenClaw is an intelligent artificial assistant developed under the OpenClaw open source project. OpenClaw has a vulnerability related to information leakage, which stems from the exposure of sensitive data through authorized URL query strings, potentially leading to credential leaks...
Use of GET Request Method With Sensitive Query Strings
Overview org.apache.openmeetings:openmeetings-parent is a web-conferencing software. Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings via the REST login endpoint when sensitive information such as username and password is transmitted as...
CVE-2026-34020
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact This issue affects Apache OpenMeetings: from 3.1.3...
Apache OpenMeetings 安全漏洞
Apache OpenMeetings is a multilingual, customizable video conferencing and collaboration system developed by the Apache Foundation in the United States. This product supports audio and video capabilities, and allows users to view the desktops of each participant. Versions of Apache OpenMeetings...
CVE-2026-34020: Use of GET Request Method With Sensitive Query Strings
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact This issue affects Apache OpenMeetings: from 3.1.3...
PT-2026-31641
Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions 3.1.3 through 8.9.99 Description The REST login endpoint uses the HTTP GET method, transmitting the username and password as query parameters. This practice exposes sensitive credentials in server logs, browser...
CVE-2026-27949
Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling e.g., when an invalid magic code is submitted. Transmitting personally...
CVE-2026-28461
OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key accumulation by varying query strings. Remote attackers can exploit this by sending repeated requests with different que...
CVE-2025-14808: Use of GET Request Method With Sensitive Query Strings
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques...
Security Bulletin: IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive information (CVE-2025-14808)
Summary A sensitive information disclosure vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2025-14808 DESCRIPTION: InfoSphere Information Server could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to...
EUVD-2026-14565
OpenClaw before 2026.3.1 contains an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger memory exhaustion by varying query strings. Attackers can send repeated requests with different query parameters to the same webhook route,...