16 matches found
CVE-2026-100654
A flaw was found in vLLM. An authenticated remote attacker can cause a Denial of Service DoS by submitting a completion request containing out-of-range stop token identifiers. Because the service does not verify that user-supplied token identifiers fall within the supported vocabulary range of th...
LimeSurvey has a SQL Injection issue
The RemoteControl API methods inviteparticipants and remindparticipants pass a caller-supplied token-ID array into TokenDynamic::findUninvited, which concatenates the values directly into a tid IN '...' SQL clause without parameterization or input validation. A remote, authenticated attacker...
CVE-2026-50636 LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection
The RemoteControl API methods inviteparticipants and remindparticipants pass a caller-supplied token-ID array into TokenDynamic::findUninvited, which concatenates the values directly into a tid IN '...' SQL clause without parameterization or input validation. A remote, authenticated attacker...
CVE-2026-41273
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise contains an authentication bypass vulnerability that allows an unauthenticated attacker to obtain OAuth 2.0 access tokens associated with a public chatflow. By accessing a public...
CVE-2025-64706 Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure
Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference IDOR vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by simply knowing th...
EUVD-2022-4027
Malicious code in bioql PyPI...
Apex Softcell LD Geo 安全漏洞
Apex Softcell LD Geo is an application from Apex Softcell. Apex Softcell LD Geo has a security vulnerability that stems from improper validation of transaction token IDs in the API endpoint...
UBUNTU-CVE-2021-36398
In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk...
GHSA-GWWQ-54QP-9PGP Zend Framework CSRF Vulnerability
Cross-site request forgery CSRF vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers...
Zend Framework CSRF Vulnerability
Cross-site request forgery CSRF vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers...
pki-core: stored Cross-site scripting (XSS) in the pki-tps web Activity tab
It was found that the Token Processing Service TPS did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting XSS vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would...
CVE-2020-26415
creationtimestamp| type| source ---|---|--- 2020-12-11 07:35:24+00:00| seen| https://t.me/cibsecurity/19785 2020-12-11 07:38:23+00:00| seen| https://t.me/cibsecurity/19805 2020-12-11 08:25:42+00:00| seen| https://t.me/cibsecurity/19825 2020-12-11 09:25:37+00:00| seen| https://t.me/cibsecurity/198...
CVE-2015-1786
Cross-site request forgery CSRF vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers...
CVE-2015-1786
Cross-site request forgery CSRF vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers...
