4269 matches found
CVE-2021-24959
CVE-2021-24959 Description The WP Email Users WordPress plugin through 1.7.6 does not escape the dataraw parameter in the weuselectedusers1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks. CVE CVE-2021-24959 CVSS 8.8 High Publicly Published Januar...
GHSA-V6PJ-GXXW-PHFW MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
Description With the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out...
CVE-2026-22785
CVE-2026-22785 재현 튜토리얼 취약점 개요 CVE : CVE-2026-22785 영향 : orval = 7.18.0 CVSS : 9.3 CRITICAL 유형 : 코드 주입 취약점 원리 orval 예시 python cvetool.py shell whoami python cvetool.py shell "node --version" python cvetool.py shell dir 파일 스캔 python cvetool.py scan 3. 출력 설명 + CVE-2026-22785: Payload 주입 성공 + 주입 위치:...
CVE-2026-5050-Blind-LDAP-Injection-via-Unescaped-Filter
CVE-2026-5050 – 이스케이프되지 않은 필터를 통한 블라인드 LDAP 인젝션 프로그램 코드 Python 기반 ldap3 시뮬레이션 ldapserversim.py - Simulated LDAP authentication server from flask import Flask, request, jsonify app = Flaskname Fake user database USERS = 'admin': 'password': 'secret', 'role': 'admin', 'user': 'password': 'pass',...
CVE-2026-42568
CVE-2026-42568 — YAMCS LDAP Injection in LdapAuthModule Summary An LDAP injection vulnerability exists in org.yamcs.security.LdapAuthModule. The username parameter is inserted directly into LDAP search filters without RFC 4515 escaping, allowing authentication bypass. Field| Value ---|--- CVE|...
DRUPAL-CONTRIB-2026-195
This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet. The module ships with library configurations that do not escape JavaScript within the TeX it formats. Notice: This release updates CDN URLs where...
CVE-2026-106577
The open-source image manipulation software ImageMagick is vulnerable to code injection in its PostScript coders. The root cause is the processing of unescaped or untrimmed values , which allows for the injection of code into the output generated by these coders. This vulnerability affects versio...
CVE-2026-103871
A flaw was found in pulp-python's PyPI simple index. Project names are written into the HTML index without escaping. A user who can publish a Python package can store markup in the package name. A person who opens that index in a browser runs the markup in the origin that served the page, and the...
CVE-2026-105111
The Apache Commons BCEL library is vulnerable to a stored cross-site scripting (XSS) flaw in versions before 6.13.0 . The issue occurs when using the Class2HTML component to generate webpages from potentially attacker-controlled class files. Specifically, the Class2HTML emitters fail to properly ...
CVE-2026-105111 Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...
LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values
Summary @langchain/redis did not properly escape values used to construct structured RediSearch TAG and TEXT filters. An application that passes attacker-controlled values into these filters could allow the attacker to alter the resulting search query. Affected versions @langchain/redis versions...
GHSA-5X6V-P487-7QH2 LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values
Summary @langchain/redis did not properly escape values used to construct structured RediSearch TAG and TEXT filters. An application that passes attacker-controlled values into these filters could allow the attacker to alter the resulting search query. Affected versions @langchain/redis versions...
CVE-2026-46490-samlify-SAML-Attribute-Injection
CVE-2026-46490 — samlify SAML AttributeValue XML Injection → Privilege Escalation samlifyValue — is inserted unescaped , so a normal user can inject extra elements e.g. role=admin into their own, IdP-signed SAML assertion. Because the injection happens before signing, the Service Provider's...
CVE-2025-69848-security-advisories
NetBox ProtectedError 처리의 반사형 XSS CVE-2025-69848 개요 NetBox는 오픈소스 인프라 리소스 모델링 및 IP 주소 관리 플랫폼입니다. ProtectedError 예외 처리 로직에 반사형 교차 사이트 스크립팅XSS 취약점이 존재합니다. 보호된 관계로 인해 삭제 작업이 실패하면 객체 표시 이름이 적절한 이스케이프 없이 HTML 오류 메시지에 삽입됩니다. 이로 인해 사용자가 제어하는 콘텐츠가 NetBox 웹 인터페이스에 렌더링될 수 있습니다. 영향 객체 이름을 제어할 수 있는 공격자는 오류 메시...
CLEANSTART-2026-MM79132 Actions which insert URLs into the content attribute of HTML meta tags are not escaped
Security vulnerability affects the temporal-server package. Actions which insert URLs into the content attribute of HTML meta tags are not escaped...
EUVD-2026-92453
Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension 6.6.0 - The page a shared image link opens the share mini page of the front end can link the article the image was shared from when the option "Share article links" is on. I...
Astra Linux – Vulnerability in Gegl
The loadcache function in GEGL before version 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This issue arises due to the use of the system library function for executing the ImageMagick convert fallback in magick-load. NOTE: GEGL versions...
Astra Linux – Vulnerability in Rails
Active Storage allows users to attach cloud and local files in Rails applications. Before versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage’s DiskServicedeleteprefixed method passed blob keys directly to Dir.glob, without escaping the glob metacharacters. If a blob key contains...
CVE-2026-102778: Cross-Site Request Forgery (CSRF)
Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension 6.6.0 - The page a shared image link opens the share mini page of the front end can link the article the image was shared from when the option "Share article links" is on. I...