CVE-2024-22049Medium· 5.3▾ Sunlithttparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker co…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.3%
httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.
debian_linux = 10.0debian_linux = 11.0fedora = 38fedora = 39httparty < 0.21.0Upgrade past the affected range:
httparty 0.21.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115450High· 7.1Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier
CVE-2026-16453High· 7.1Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-on…
CVE-2026-111447High· 8.1Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved
CVE-2026-77470High· 8.3Lychee is a free, open-source photo-management tool
CVE-2026-55384Medium· 5.3InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates
CVE-2026-103671Medium· 4.7External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin"