Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
## Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when `Object.prototype.p
#cwe-200
共收录 1778 条相关情报。
← 返回所有主题File Browser: Share API exposes the password hash and bypass token
CVE-2026-62684
## Summary When a user creates a password-protected share or lists existing shares, the JSON response includes the full
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
CVE-2026-59883
### Impact `CookieJar` does not restrict a cookie scoped to an IP address to the exact host that set it. When a stored
Guzzle: Proxy-Authorization headers can be sent to origin servers
### Impact In affected versions, the built-in cURL handlers (`CurlHandler` and `CurlMultiHandler`) put every first-clas
RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privileg...
CVE-2026-44231
RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prio
The Joomla extension Quix Page Builder Pro is vulnerable to an information disclosure. Raw exceptions reflected in AJAX handler responses.
CVE-2026-60031
The Joomla extension Quix Page Builder Pro is vulnerable to an information disclosure. Raw exceptions reflected in AJAX
An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.
CVE-2026-51027
An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions...
CVE-2026-46410
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may le
FileBrowser Quantum: unauthenticated user share share info
CVE-2026-46410
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may le
SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reac...
CVE-2026-63746
SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references.
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing auth...
CVE-2026-8825
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning p
@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, ...
CVE-2026-44979
该漏洞影响 @hapi/wreck（一款 Node.js HTTP 客户端实用工具）版本低于 18.1.1。当 @hapi/wreck 遵循 HTTP 3xx 重定向到不同主机时，默认仅剥离 `Authorization` 和 `Cooki
Prompty: Arbitrary file read via file reference expansion
CVE-2026-53598
## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolv
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:read ACL can take over any admin account by triggering POST...
CVE-2026-48009
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:re
Shopware: Admin Account Takeover via User Recovery Hash Exposure
CVE-2026-48009
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:re
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE express...
CVE-2026-49211
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\En
Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil
CVE-2026-49211
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\En
HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in an iFrame on his m...
CVE-2024-23570
HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an atta
HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. Displaying version information of software ...
CVE-2024-23568
HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by th
The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.62 vi...
CVE-2026-9656
The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information