CVE-2025-49132-PoC

CVE-2025-49132 PoC by Pwndalf Overview This repository contains a Proof of Concept PoC for CVE-2025-49132, a Remote Code Execution RCE vulnerability affecting Pterodactyl Panel -l -p...

EasySpider 0.6.2 - Arbitrary File Read

A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input...

CLEANSTART-2026-OB67421 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

Likeshop < 2.5.7.20210311 - Arbitrary File Upload

A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file with an...

CLEANSTART-2026-UE71064 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-NF66444 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CVE-2026-111210

A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pkitype can lead to server-side request forgery. It is possible to launch the attac...

CVE-2026-111210 bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgery

A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pkitype can lead to server-side request forgery. It is possible to launch the attac...

CVE-2026-111210 bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgery

A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pkitype can lead to server-side request forgery. It is possible to launch the attac...

EUVD-2026-102547

A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pkitype can lead to server-side request forgery. It is possible to launch the attac...

CVE-2026-111210

The bitcoinj library, version up to 0.17 , contains a Server-Side Request Forgery (SSRF) vulnerability within the Payment Request Handler component. Specifically, the url.openConnection function in the PaymentSession.java file is susceptible to exploitation through the manipulation of the pki_typ...

CVE-2026-111210: Server-Side Request Forgery (SSRF)

A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pkitype can lead to server-side request forgery. It is possible to launch the attac...

PT-2026-115336

Name of the Vulnerable Software and Affected Versions bitcoinj versions prior to 0.18 Description In the Payment Request Handler component, the url.openConnection function within the PaymentSession.java file is susceptible to server-side request forgery. This occurs when the pki type argument is...

Astra Linux – Vulnerability in python-tornado

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the provided “reason” phrase is used unescaped in HTTP headers where it could be used for header injection or in HTML on the default error page where it could be used for XSS attacks. This...

CLEANSTART-2026-XD86126 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-ZY41765 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CVE-2026-108542

A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of the component MCP Request Handler. The manipulation of the argument path results in server-side request forgery. The attack can be executed remotel...

CVE-2026-88903

The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key ha...

CVE-2026-108542

A server-side request forgery (SSRF) vulnerability exists in the 021is elvix-sdk up to version 0.10.1 . The flaw is located within an unknown functionality of the src/mcp/index.ts file in the MCP Request Handler component. By manipulating the argument path , an attacker can execute the attack rem...

EUVD-2026-96863

A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of the component MCP Request Handler. The manipulation of the argument path results in server-side request forgery. The attack can be executed remotel...