1579 matches found
Astra Linux – Vulnerability in Less
Closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE...
Astra Linux – Vulnerability in PHP 7.3, PHP 8.1
In PHP versions 8.0. before 8.0.27, 8.1. before 8.1.15, and 8.2. before 8.2.2, when using the PDO::quote function to quote user-supplied data for SQLite, providing an overly long string may cause the driver to incorrectly quote the data. This can further lead to SQL injection vulnerabilities...
Astra Linux – Vulnerability in python-oslo.utils
A flaw was discovered in python-oslo-utils. Due to improper parsing, passwords that contain double quotes " cause incorrect masking in debug logs, resulting in any part of the password after the double quote being displayed as plain text...
Astra Linux – Vulnerability in Vim
Buffer over-reading in the findnextquote function in the GitHub repository’s Vim/Vim version prior to 8.2.4925. These vulnerabilities can cause software to crash, modify memory, and may lead to remote execution...
CVE-2026-89241
WWBN AVideo contains a reflected cross-site scripting (XSS) vulnerability in confirmLivePassword.php . The root cause is that the script copies the REQUEST_URI variable directly into a form action attribute without encoding. An attacker can craft a malicious URL containing a quote character to br...
EUVD-2026-76053
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUESTURI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of t...
CVE-2026-87859
A flaw was found in morgan, an HTTP request logger middleware for Node.js. An unauthenticated remote attacker can exploit this vulnerability by injecting an unescaped double quote into a log field they control, such as the User-Agent or Referer header. This causes the log field to close...
CVE-2026-87859
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...
DEBIAN-CVE-2026-87859
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...
UBUNTU-CVE-2026-87859
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...
CVE-2026-87859
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...
CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...
CVE-2026-87859
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1 , the escapeLogField() function fails to escape the double quote character, which delimits quoted fields in the Apache combined log format. An unauthenticated remote attacker who controls a value written to a quote...
CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...
CVE-2026-87859: Improper Output Neutralization for Logs
morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...
PT-2026-89814
Name of the Vulnerable Software and Affected Versions morgan versions prior to 1.12.1 Description The escapeLogField function fails to escape the double quote character used to delimit quoted fields in the Apache combined log format. An unauthenticated remote attacker can exploit this by injectin...
Linux Distros Unpatched Vulnerability : CVE-2026-87859
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, whic...
WordPress ELEX WooCommerce Request a Quote plugin < 2.4.1 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Artus KG in WordPress Plugin ELEX WooCommerce Request a Quote versions 2.4.1...