CWE-346

692 vulnerabilities with CWE-346

CVE-2025-25302 MEDIUM

rembg < 2.0.57 - Origin Validation Error in CORS Middleware

CVSS 6.5

CVE-2025-23117 MEDIUM

UniFi Protect < - Privilege Escalation

CVSS 6.8

CVE-2025-1102 MEDIUM

Q-Free MaxTime <= 2.11.0 - Unauthenticated Origin Validation Error in CORS Configuration

CVSS 5.5

CVE-2025-1083 LOW

Mindskip xzs-mysql 3.9.0 - Permissive Cross-domain Security Policy with Untrusted Domains in CORS Handler

CVSS 3.1

CVE-2025-23023 HIGH

Discourse < 3.3.2 - Cache Poisoning via Anonymous Cache Header Manipulation

CVSS 8.2

CVE-2025-21542 MEDIUM

Oracle Communications Order and Service Management 7.4.0, 7.4.1, 7.5.0 - Origin Validation Error

CVSS 6.3

CVE-2025-21511 HIGH

Oracle JD Edwards EnterpriseOne Tools < 9.2.9.0 - Unauthenticated Unauthorized Data Access via Web Runtime SEC

CVSS 7.5

CVE-2025-21497 MEDIUM

MySQL Server < 8.0.40, 8.4.3 and prior, 9.1.0 and prior - Denial of Service and Unauthorized Data Manipulation in InnoDB

CVSS 5.5

CVE-2025-24010 MEDIUM

vitejs/vite < 4.5.5, 6.0.0-6.0.9 - Origin Validation Error via CORS and WebSocket

CVSS 6.5

CVE-2025-23109 MEDIUM

Firefox < 134.0 - URL Spoofing via Long Hostnames

CVSS 6.5

CVE-2024-32642 HIGH

MasaCMS < 7.2.8 - Account Takeover via Host Header Poisoning

CVSS 8.8

CVE-2024-14006 MEDIUM

Nagios XI < 2024R1.2.2 - Host Header Injection

CVSS 6.1

CVE-2024-13068 HIGH

LimonDesk <1.02.17 - Forceful Browsing

CVSS 7.3

CVE-2024-12973 MEDIUM

Akinsoft OctoCloud s1.09.01-v1.11.01 - HTTP Response Splitting via Origin Validation Error

CVSS 4.7

CVE-2024-31127 HIGH

Zscaler Client Connector <4.2.0.241 - Privilege Escalation

CVSS 7.3

CVE-2024-45354 MEDIUM

Xiaomi shop application 5.30.0.20241103.r1 - Remote Code Execution

CVSS 4.3

CVE-2024-45353 MEDIUM

Xiaomi quick app framework - Intent Redirection via Improper Input Validation

CVSS 4.3

CVE-2024-45352 HIGH

Xiaomi smarthome application 10.0.623 - Remote Code Execution

CVSS 8.8

CVE-2024-8487 CRITICAL

modelscope/agentscope <0.0.4 - CSRF

CVSS 9.8

CVE-2024-8183 HIGH

Prefect < 3.0.3 - Origin Validation Error in CORS Configuration

CVSS 7.6

CVE-2024-8024 HIGH

netease-youdao/qanything <1.4.1 - SSRF

CVSS 7.5

CVE-2024-7819 HIGH

danswer-ai/danswer < latest - Origin Validation Error in CORS Configuration

CVSS 7.4

CVE-2024-6844 MEDIUM

corydolphin/flask-cors 4.0.1 - Info Disclosure

CVSS 5.3

CVE-2024-11602 HIGH

feast 0.40.0 - Origin Validation Error in CORS Configuration

CVSS 7.4

CVE-2024-11045 CRITICAL

automatic1111/stable-diffusion-webui 1.10.0 - Cross-Site WebSocket Hijacking via Unvalidated WebSocket Connection

CVSS 9.6