Advisories · Weakness
CWE-115.
Every Advisory and CVE whose sources give the weakness CWE-115, newest first.
- CVSS 8.6 High
Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation
- jelmer dulwich
- CWE-115
- CWE-1250
- CVSS 4.0 Medium
DoS vulnerability in the file parsing module.
- Huawei HarmonyOS
- CWE-115
- CVSS 9.4 CriticalCritical · CVSS 9+
pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier
- pgadmin.org pgAdmin 4
- Command injection
- CWE-115
- CVSS 8.2 High
HPE NonStop DNS 9.2.3 Non Secure Version
- Hewlett Packard Enterprise HPE NonStop DNS 9.2.3 Non Secure Version
- CWE-115
- CVSS 2.0 Low
Improper certificate validation in OpenVPN
- OpenVPN
- Weak cryptography or TLS
- CWE-115
- CVSS 9.4 CriticalCritical · CVSS 9+
pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)
- pgadmin.org pgAdmin 4
- Command injection
- CWE-115
- CVSS 9.4 CriticalCritical · CVSS 9+
pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)
- pgadmin.org pgAdmin 4
- SQL injection
- CWE-115
- CVSS 3.7 Low
EDNS options smuggling
- PowerDNS DNSdist
- CWE-115
- CVSS 4.8 Medium
Duplicate Advisory: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
- CWE-115
>=0.11.0, <=0.23.0 · no fixed version yet
GHSA-x8xr-mj9x-6h7w - CVSS 4.8 Medium
vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
- CWE-115
- CWE-436
>=0.11.0, <0.24.0 · fixed in 0.24.0
GHSA-8jr5-v98p-w75m · CVE-2026-12491 - CVSS 6.5 Medium
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
- Weak cryptography or TLS
- CWE-115
<1.0.0 · fixed in 1.0.0
GHSA-6gvq-jcmp-8959 · CVE-2025-68113 - CVSS 6.9 Medium
Astro allows unauthorized third-party images in _image endpoint
- Cross-site scripting (XSS)
- CWE-115
<4.16.19 || >=5.0.0-alpha.0, <5.13.2 · fixed in 4.16.19, 5.13.2
GHSA-xf8x-j4p2-f749 · CVE-2025-55303 - CVSS 7.0 High
GitProxy Backfile Parsing Exploit
- CWE-115
<1.19.2 · fixed in 1.19.2
GHSA-xxmh-rf63-qwjv · CVE-2025-54584 - CVSS 6.3 Medium
Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability
- Autel MaxiCharger AC Wallbox Commercial
- CWE-115
- CVSS 8.0 High
WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability
- WOLFBOX Level 2 EV Charger
- CWE-115
- CVSS 7.5 High
Libsoup: denial of service on libsoup through http/2 server
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- CWE-115
- CVSS 5.4 Medium
LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality
- Cross-site scripting (XSS)
- CWE-115
<2.22.0 · fixed in 2.22.0
GHSA-w6hh-w36c-vxmw · CVE-2024-9900 - CVSS 7.5 High
Unhandled Exception Leading to Server Crash in danny-avila/librechat
- danny-avila/librechat
- CWE-115
- CVSS 4.4 Medium
HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
- CWE-20
- CWE-115
<0.36.0 · fixed in 0.36.0
GHSA-qxp5-gwg8-xv66 · CVE-2025-22870 - CVSS 6.5 Medium
Apache Kvrocks: Cross-Protocol Scripting Vulnerability
- Apache Software Foundation Apache Kvrocks
- CWE-115
- CVSS 4.6 Medium
A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last authorized user.
- Bosch AMS
- Bosch BIS
- CWE-115
- CVSS 6.5 Medium
A potential Misinterpretation of Input vulnerability has been identified in SMAX, AMX, and HCMX products.
- OpenText™ Service Management Automation X (SMAX)
- OpenText™ Asset Management X (AMX)
- CWE-115
- CVSS 8.3 High
Misinterpretation of Input in thorsten/phpmyfaq
- CWE-115
<3.1.11 · fixed in 3.1.11
GHSA-f9c6-4j9h-6c5r · CVE-2023-0880 - CVSS 7.4 High
Cisco IOS XE Software IPv6 VPN over MPLS Denial of Service Vulnerability
- Cisco IOS XE Software
- CWE-115
- CVSS 9.4 CriticalCritical · CVSS 9+
parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing
- CWE-115
<8.1.0 · fixed in 8.1.0
GHSA-pqw5-jmp5-px4v · CVE-2022-3224 - CVSS 6.5 Medium
URL Confusion When Scheme Not Supplied in medialize/uri.js
- Open redirect
- CWE-115
<1.19.11 · fixed in 1.19.11
GHSA-g694-m8vq-gv9h · CVE-2022-1233 - CVSS 9.8 CriticalCritical · CVSS 9+
Authentication Bypass in github.com/russellhaering/gosaml2
- CWE-115
<0.6.0 · fixed in 0.6.0
GHSA-xhqq-x44f-9fgg · CVE-2020-29509 - CVSS 6.5 Medium
/etc/pki/tls and /etc/ssl/certs include distrusted certificates in make-ca
- lfs-book make-ca
- CWE-115
- CVSS 8.6 High
Cisco NX-OS Software VXLAN OAM (NGOAM) Denial of Service Vulnerability
- Cisco NX-OS Software
- CWE-115
- CVSS 9.8 CriticalCritical · CVSS 9+
XML Processing error in github.com/crewjam/saml
- Authentication bypass
- CWE-115
<0.4.3 · fixed in 0.4.3
GHSA-4hq8-gmxx-h6w9 · CVE-2020-27846 - CVSS 7.5 High
REXML round-trip instability
- XML external entities (XXE)
- CWE-115
<3.2.5 · fixed in 3.2.5
GHSA-8cr8-4vfw-mr7h · CVE-2021-28965 - CVSS 4.3 Medium
Misinterpretation of malicious XML input
- CWE-115
- CWE-436
<0.5.0 · fixed in 0.5.0
GHSA-h6q6-9hqw-rwfv · CVE-2021-21366 - CVSS 7.5 High
NFX250, NFX350, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series: Certain genuine traffic received by the Junos OS device will be discarded instead of forwarded.
- Juniper Networks Junos OS
- CWE-115
- CWE-436
- CVSS 9.8 CriticalCritical · CVSS 9+
Go: The encoding/xml package in Go (all versions) does not correctly preserve the semantics…
- Go
- CWE-115
- CVSS 9.8 CriticalCritical · CVSS 9+
Go: The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the…
- Go
- CWE-115
-
Node.js: Node.js: All versions prior to Node.js 6.15.0, 8.14.0…
- Node.js
- CWE-115
-
Node.js: Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If…
- Node.js
- CWE-115
-
Node.js: The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length`…
- Node.js
- CWE-115