Skip to content
Noroxi

OWASP records

49 published records for vendor owasp.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
81.6%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

49 records
  • CVE-2021-42575
    40Plan

    The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

    CriticalCVSS 9.8No exploitEPSS 3%

    owasp · java html sanitizerOct 18, 2021

  • CVE-2022-23457
    40Plan

    Path Traversal in ESAPI

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    owasp · enterprise security apiApr 25, 2022

  • CVE-2021-35368
    40Plan

    OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a tr

    CriticalCVSS 9.8No exploitEPSS 3%

    owasp · owasp modsecurity core rule setNov 5, 2021

  • CVE-2021-23899
    40Plan

    OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input.

    CriticalCVSS 9.8No exploitEPSS 2%

    owasp · json-sanitizerJan 13, 2021

  • CVE-2022-39955
    39Monitor

    Partial rule set bypass in OWASP ModSecurity Core Rule Set by submitting a specially crafted HTTP Content-Type header

    CriticalCVSS 9.8No exploitEPSS 1%

    owasp · owasp modsecurity core rule setSep 20, 2022

  • CVE-2020-22669
    39Monitor

    Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability.

    CriticalCVSS 9.8No exploitEPSS 1%

    owasp · owasp modsecurity core rule setSep 2, 2022

  • CVE-2022-39956
    39Monitor

    Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encodi

    CriticalCVSS 9.8No exploitEPSS 1%

    owasp · owasp modsecurity core rule setSep 20, 2022

  • CVE-2023-38199
    39Monitor

    coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms.

    CriticalCVSS 9.8No exploitEPSS 1%

    owasp · corerulesetJul 12, 2023

  • CVE-2025-66022
    39Monitor

    FACTION Unauthenticated Custom Extension Upload leads to RCE

    CriticalCVSS 9.8No exploitEPSS 1%

    owasp · factionNov 25, 2025

  • CVE-2023-48171
    35Monitor

    An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component.

    HighCVSS 8.8No exploitEPSS 1%

    owasp · defectdojoAug 12, 2024

  • CVE-2026-40316
    35Monitor

    OWASP BLT has RCE in Github Actions via untrusted Django model execution in workflow

    HighCVSS 8.8No exploitEPSS 1%

    owasp · owasp bltApr 15, 2026

  • CVE-2021-28490
    35Monitor

    In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token.

    HighCVSS 8.8No exploitEPSS 1%

    owasp · csrfguardAug 19, 2021

  • CVE-2024-1019
    34Monitor

    WAF bypass of the ModSecurity v3 release line

    HighCVSS 8.6No exploitEPSS 1%

    owasp · modsecurityJan 30, 2024

  • CVE-2026-52747
    34Monitor

    ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass

    HighCVSS 8.6No exploitEPSS 0%

    owasp · modsecurityJul 10, 2026

  • CVE-2025-66021
    34Monitor

    OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

    HighCVSS 8.6No exploitEPSS 0%

    owasp · java html sanitizerNov 25, 2025

  • CVE-2018-12036
    32Monitor

    OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filena

    HighCVSS 7.8Proof of conceptEPSS 2%

    owasp · dependency-checkJun 7, 2018

  • CVE-2026-30923
    32Monitor

    libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings

    HighCVSS 8.2No exploitEPSS 1%

    owasp · modsecurityMay 5, 2026

  • CVE-2026-42268
    32Monitor

    ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators

    HighCVSS 8.2No exploitEPSS 0%

    owasp · modsecurityMay 12, 2026

  • CVE-2021-42717
    31Monitor

    ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects.

    HighCVSS 7.5Proof of conceptEPSS 3%

    owasp · modsecurityDec 7, 2021

  • CVE-2020-15598
    31Monitor

    Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request.

    HighCVSS 7.5No exploitEPSS 3%

    owasp · modsecurityOct 6, 2020

  • CVE-2019-19886
    31Monitor

    Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to

    HighCVSS 7.5No exploitEPSS 3%

    owasp · modsecurityJan 21, 2020

  • CVE-2021-23900
    31Monitor

    OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input.

    HighCVSS 7.5No exploitEPSS 2%

    owasp · json-sanitizerJan 13, 2021

  • CVE-2018-16384
    31Monitor

    A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} wher

    HighCVSS 7.5No exploitEPSS 2%

    owasp · owasp modsecurity core rule setSep 2, 2018

  • CVE-2026-33691
    30Monitor

    OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks

    HighCVSS 7.5Proof of conceptEPSS 2%

    owasp · owasp modsecurity core rule setApr 2, 2026

  • CVE-2022-39958
    30Monitor

    Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range

    HighCVSS 7.5No exploitEPSS 1%

    owasp · owasp modsecurity core rule setSep 20, 2022