3795 matches found
PT-2026-85666
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL...
CVE-2022-35499: Improper Neutralization of Input During Web Page Generation
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL...
PT-2026-85569
Name of the Vulnerable Software and Affected Versions Dub affected versions not specified Description An open redirect issue exists where the redir url query parameter is accepted on every short link without validation or domain allowlist enforcement. This allows attackers to append the redir url...
EUVD-2026-57321
Material for MkDocs: DOM XSS in search suggestions via query parameter...
CVE-2026-81571
The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...
CVE-2026-53683
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
CVE-2026-53683
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
EUVD-2026-69892
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
CVE-2026-53683: URL Redirection to Untrusted Site
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
CVE-2026-81571: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...
PT-2026-84747
The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...
CVE-2018-18964
creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:12+00:00| seen| https://t.me/hackingAttack/29057 2026-09-01 20:02:15+00:00| seen| https://t.me/hackingAttack/27123 2026-09-01 20:02:17+00:00| seen| https://t.me/hackingAttack/27117 2026-09-01 20:02:17+00:00| seen|...
CVE-2026-59111 Command Injection vulnerability in eObčanka-Identifikace
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...
CVE-2026-59111 Command Injection vulnerability in eObčanka-Identifikace
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...
CVE-2026-40465
NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...
CVE-2026-40465 An Open Re-direct Vulnerability in Nokia NSP
NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...
CVE-2026-72001: Authorization Bypass Through User-Controlled Key
Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token...
PT-2026-83752
Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.16.208 Description An authorization bypass exists in TooljetDB controller endpoints that accept organizationId from the URL path without verifying if it matches the authenticated user's workspace. This allows...