Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-123617

Openwhyd before 1.65.1 NoSQL Injection via POST /api/user

Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users' public profile records.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Openwhyd
Products
Openwhyd
CVE-2021-3837

Improper Authorization in openwhyd/openwhyd

openwhyd is vulnerable to Improper Authorization

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Openwhyd
Products
Openwhyd
CVE-2021-3829

Open Redirect in openwhyd/openwhyd

openwhyd is vulnerable to URL Redirection to Untrusted Site

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Openwhyd
Products
Openwhyd