CWE-116

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe

Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-I

Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenti

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, trans

diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When list

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface usi

Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feat

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/u

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via une

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequest

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in

WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across th

Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely r

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki vulnerable to remote code execution. An arbitra

A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplyin

get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache

Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by add

A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privile

XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 1

Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious use

Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messa

A HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To

pyLoad is a free and open-source download manager written in Python. In versions prior to 0.5.0b3.dev91, pyLoad web inte

Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code

GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-

In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerabi

dom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's `.r

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions

Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, du

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML sty

A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of t

MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: h

Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerab

Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in

Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-

Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows