HarnessRouter server request forgery vulnerability

HarnessRouter versions 0.31.12 and earlier contain a server-side request forgery vulnerability. This vulnerability stems from improper handling of the baseurl parameter by an unknown function within the gateway/app.py file in the Targets Test Endpoint component, potentially enabling remote...

NoMachine server request forgery vulnerability

NoMachine 9.8.21 version has a vulnerability related to server-side request forgeing. This vulnerability arises from the web service failing to correctly validate URIs before accessing resources. As a result, unauthorized remote attackers can initiate arbitrary server-side requests under the...

Apache Traffic Server input validation error vulnerability

A input validation error vulnerability exists in Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. This vulnerability stems from improper handling when Content-Length or Transfer-Encoding is included in HEAD requests, potentially leading...

Electron Cross-Site Request Forgery Vulnerability

Versions of Electron prior to 42.11.3, 43.0.0-alpha.1 through 43.7.0, 44.0.0-alpha.1 through 44.3.0, and 45.0.0-alpha.1 through 45.0.0-alpha.6 contain a cross-site request forgeing vulnerability. This vulnerability arises from treating a page that opens in a new window as a navigation request...

Apache Traffic Server input validation error vulnerability

A input validation error vulnerability exists in Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. This vulnerability arises when a client sends a POST request containing Expect: 100-continue, and the source server responds before readin...

hMailServer cross-site request forgery vulnerability

Versions 6.0.0 through 6.3.6 of hMailServer contain a cross-site request forgery vulnerability. This flaw arises because the REST API’s cross-site request forgery protection only applies to cookie sessions and does not cover HTTP Basic authentication. As a result, remote attackers may exploit the...

Splunk Enterprise cross-site request forgery vulnerability

Versions prior to Splunk Enterprise 10.4.4, 10.2.8, 10.0.11, and 9.4.16 contain a cross-site request forgery vulnerability. This vulnerability arises because the REST API of the federated provider accepts GET requests to modify its status. Unauthenticated attackers can trick users with...

Data Intelligence Lab@HKU Vibe-Trading prompt injection vulnerability

In Data Intelligence Lab@HKU Vibe-Trading versions 0.1.0 through 0.1.7, there is a prompt injection vulnerability. This occurs because the agent injects commands into documents or web pages; BashTool and BackgroundRunTool pass the commands generated by the model directly to subprocess.run execute...

Grokability Snipe-IT side-channel information leakage vulnerability

Versions of Grokability Snipe-IT prior to 8.7.0 contain a side-channel information disclosure vulnerability. This vulnerability stems from server-side request forgery within the webhook testing functionality, enabling super administrators to discover internal network addresses including loopback...

SvelteKit server-side request forgery vulnerability

Versions of SvelteKit prior to 3.0.0 contain a server-side request forgery vulnerability. This vulnerability arises from self-fetch fallback behavior that automatically follows HTTP redirects. Attackers can manipulate the Host or forwarded headers to redirect the fallback requests to their own...

Coraza - Web Application Firewall: Input validation error vulnerability

Coraza – Web Application Firewall versions 3.0.4 to 3.8.1 had a vulnerability related to input validation errors. This issue arose from an exact comparison of the entire Content-Type value during the request body processor selection. As a result, URL-encoded request bodies containing media type...

Improper handling of exceptions vulnerability in Apache Traffic Server

Versions 9.2.15, 10.1.4, and 10.2.0 of Apache Traffic Server contain a vulnerability related to improper exception handling. This occurs when a client POST request is partially closed, causing the chunk source response to be re-parsed from a reentrant write completion callback. As a result, a nul...

CVE-2026-93003

The NetX Duo Web HTTP server contains a vulnerability where the HTTP server searches the entire request packet for header fields rather than stopping at the end of the header section. This allows a header field name placed within the request body to be incorrectly reported as a header. Consequent...

CVE-2026-93003 NetX Duo Web HTTP server interprets request body content as HTTP header fields

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

EUVD-2026-105153

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

CVE-2026-93003 NetX Duo Web HTTP server interprets request body content as HTTP header fields

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

CVE-2026-93003 NetX Duo Web HTTP server interprets request body content as HTTP header fields

The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were a header, which lets a client control request framing...

EUVD-2026-105134

Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8...

CVE-2026-112836

The VikRentCar WordPress plugin (e4jvikwp), versions up to and including 1.4.8 , is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). This flaw allows an attacker to perform unauthorized actions on behalf of a victim user. While the impact is categorized as HIGH with a C...

CVE-2026-112836 WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8...