26 matches found
CVE-2026-128053
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPTNAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught...
CVE-2026-128053
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the error pages because errors/processor.php prints URLs derived from SCRIPT_NAME without proper escaping. An unauthenticate...
EUVD-2026-125056
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPTNAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught...
SUSE CVE-2026-27590
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because...
CVE-2026-27590
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because...
GO-2026-4486 FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP in github.com/dunglas/frankenphp
FrankenPHP's unicode case-folding length expansion causes incorrect splitpath index SCRIPTNAME/PATHINFO confusion in FrankenPHP in github.com/dunglas/frankenphp...
CVE-2026-24895
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...
CVE-2026-24895
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...
GHSA-G966-83W7-6W38 FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP
Summary FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the original path. Because strings.ToLower in Go can increase the...
CVE-2026-24895: Incorrect Behavior Order: Validate Before Canonicalize
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index for finding .php on a lowercased copy of the request path but applies that byte index to the...
Cross site scripting
A vulnerability, which was classified as problematic, has been found in 01-Scripts 01ACP. This issue affects some unknown processing. The manipulation of the argument $SERVER'SCRIPTNAME' leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is...
CVE-2021-4309 01-Scripts 01ACP cross site scripting
A vulnerability, which was classified as problematic, has been found in 01-Scripts 01ACP. This issue affects some unknown processing. The manipulation of the argument $SERVER'SCRIPTNAME' leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is...
CVE-2021-4309
A vulnerability, which was classified as problematic, has been found in 01-Scripts 01ACP. This issue affects some unknown processing. The manipulation of the argument $SERVER'SCRIPTNAME' leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is...
CVE-2021-4309: Improper Neutralization of Input During Web Page Generation
A vulnerability, which was classified as problematic, has been found in 01-Scripts 01ACP. This issue affects some unknown processing. The manipulation of the argument $SERVER'SCRIPTNAME' leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is...
CVE-2020-15339: Improper Neutralization of Input During Web Page Generation
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows live/CPEManager/AXCampaignManager/handlecampaignscriptlink?scriptname= XSS...
CVE-2018-5337
Zoho ManageEngine Desktop Central is affected by CVE-2018-5337. The issue is a directory traversal vulnerability in the SCRIPT_NAME field when modifying existing scripts, present in versions 10.0.124 and 10.0.184. An attacker could exploit this vulnerability to read files. The connected CNVD/NVD ...
CVE-2018-5337
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPTNAME field when modifying existing scripts...
CVE-2018-5337: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: directory traversal in the SCRIPTNAME field when modifying existing scripts...
