EUVD-2026-93922

With migrations ALLOWEDDOMAINS set to a matching entry such as or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as 169.254.169.254, even when ALLOWLOCALNETWORKS = false. The local-network block list did not cover these ranges, and a...

GHSA-XVQ9-WJP8-HWQF i18next-http-backend incomplete URL validation permits SSRF

There is an SSRF vulnerability when using i18next-http-backend. A colon in an attacker-controlled language value can make a custom path template request an unintended origin. This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolat...

NPM: i18next-http-backend incomplete URL validation permits SSRF

NPM: i18next-http-backend incomplete URL validation permits SSRF vulnerability discovered by ? in WordPress Npm i18next-http-backend versions 4.0.2...

CVE-2023-40037

CVE-2023-40037: التحقق غير الكامل من عناوين URL لاتصالات JDBC و JNDI في Apache NiFi تدعم Apache NiFi من الإصدار 1.21.0 إلى 1.23.0 الوصول إلى JDBC و JNDI JMS في العديد من المعالجات وخدمات التحكم مع التحقق من عنوان URL للاتصال الذي لا يوفر حماية كافية ضد المدخلات المصممة. يمكن للمستخدم المصادق عليه...

PT-2026-107295

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.5.1 Backstage versions prior to 3.6.2 Backstage versions prior to 3.7.2 Backstage versions prior to 3.8.2 Backstage versions prior to 3.9.1 Description The @backstage/plugin-catalog-backend package contains improp...

Cisco ASA/FTD Incorrect Authorization (CVE-2020-3578)

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass a configured access rule and access parts of the WebVPN portal that are supposed to be blocked...

Server-Side Request Forgery (SSRF)

java-json-tools jackson-coreutils is vulnerable to server-side request forgery SSRF. The vulnerability is due to improper URL validation in the JsonLoader.fromURL function, which allows a remote attacker to manipulate the URL and cause the server to send unauthorized requests to attacker-controll...

CVE-2024-34361-Pi-Hole-SSRF-to-RCE

CVE-2024-34361 Pi-hole रिमोट कोड निष्पादन SSRF to RCE विवरण इस रिपॉजिटरी में CVE-2024-34361 के लिए एक एक्सप्लॉइट है, जो Pi-hole में खोजी गई एक गंभीर भेद्यता CVSS 8.6 है। Pi-hole एक DNS सिंकहोल है जिसका व्यापक रूप से नेटवर्क स्तर पर विज्ञापनों और ट्रैकिंग डोमेन को ब्लॉक करने के लिए उपयोग किया जाता...

CVE-2025-55816

CVE-2025-55816 CVE-2025-55816 HotelDruid 3.0.7 المؤلف: partywave التعاون: فريق Raptx المراجع الخارجية سجل تغييرات HotelDruid 3.0.8 منشور المدونة الخاص بـ CVE موقع Raptx الثغرة الأمنية الثغرة هي Stored Cross Site Scripting XSS بسيطة في نقطة النهاية /modificaapp.php. يمكن للمهاجم إدخال حمولة جافا...

CVE-2021-41277

CVE-2021-41277 उपयोग 1. सहायता जानकारी दिखाएं /CVE-2021-41277 ❯ go run main.go -h Usage of main: -f string File containing list of targets to verfity -o string File to write output to optional -s Show VulnInfo output -t int Number of concurrent goroutines for resolving default 10 -u string Target...

SSRF-CVE-2020-15002

ملخص تعاني منطق التحقق من صحة عنوان URL المطبق عند معالجة /appsuite/api/oxodocumentfilter&action=addfile من ثلاثة عيوب يمكن استخدامها لتنفيذ هجوم SSRF من نوع Time of Check Time of Use ToCToU. تسمح هذه المشكلة للمهاجمين بتنفيذ طلبات HTTP GET على خدمات الشبكة الداخلية وقد تؤدي إلى تسرب معلومات محمي...

CVE-2026-55252 OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect

OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks. This issue has been patched in version...

CVE-2026-55252 OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect

OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks. This issue has been patched in version...

CVE-2026-103686

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-103686 rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-103686

The rhukster dom-sanitizer library (up to version 1.0.15 ) is vulnerable to Cross-Site Scripting (XSS) due to a flaw in the URL Validation component. Specifically, the DOMSanitizer::isDangerousUrl function in src/DOMSanitizer.php can be manipulated to allow malicious scripts. This vulnerability c...

CVE-2026-103686 rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

EUVD-2026-90847

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-103686 rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-103686: Improper Neutralization of Input During Web Page Generation

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...