owasp-modsecurity

Records57All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical10CVSS 9.0–10.0

CVSS high26CVSS 7.0–8.9

Exploited now

owasp-modsecurity records in CISA KEV

No owasp-modsecurity vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Modsecurity 15 records HIGH Owasp Modsecurity Core Rule Set 9 records MEDIUM Enterprise Security Api 4 records HIGH Json-sanitizer 3 records MEDIUM Defectdojo 2 records MEDIUM Dependency-check 2 records MEDIUM Dependency-track 2 records LOW Java Html Sanitizer 2 records HIGH

Records

57 records

TI-2026-37865 CVE-2026-52747

ModSecurity: Multipart form-data parser silently strips embedded line breaks from…

HIGH 76

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00476 Published 2026-07-10 Partial fix · 3.0.16 CWE-180

TI-2025-40548 CVE-2025-66022

FACTION Unauthenticated Custom Extension Upload leads to RCE

HIGH 76

FACTION is a PenTesting Report Generation and Collaboration Framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00717 Published 2025-11-26 Fixed in 1.7.1 CWE-287

TI-2022-07517 CVE-2022-23457 · GHSA-8m5h-hrqm-pxm2

Path Traversal in ESAPI

HIGH 76

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02849 Published 2022-04-25 Fixed in 2.3.0.0 CWE-22

TI-2026-30581 CVE-2026-42268

ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators

HIGH 75

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00396 Published 2026-05-12 Partial fix · 3.0.15 CWE-191

TI-2026-23748 CVE-2026-30923

libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings

HIGH 75

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00435 Published 2026-05-05 Fixed in 3.0.15 CWE-125

TI-2025-19980 CVE-2025-27110

Libmodsecurity3 has possible bypass of encoded HTML entities

HIGH 74

Libmodsecurity is one component of the ModSecurity v3 project.

CVSS 4.0HIGH 7.9 Network No auth No interaction EPSS 0.00485 Published 2025-02-25 No fix listed CWE-172

TI-2026-29093 CVE-2026-40316

OWASP BLT has RCE in Github Actions via untrusted Django model execution in workflow

HIGH 73

OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00411 Published 2026-04-15 No fix listed CWE-94

TI-2025-40547 CVE-2025-66021 · GHSA-g9gq-3pfx-2gw2

OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization

HIGH 72

OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00289 Published 2025-11-26 Partial fix · 20260101.1 CWE-79

TI-2025-31022 CVE-2025-48866

ModSecurity has possible DoS vulnerability in sanitiseArg action

HIGH 72

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00867 Published 2025-06-02 Partial fix · 2.9.10 CWE-1050

TI-2025-30340 CVE-2025-47947

ModSecurity Has Possible DoS Vulnerability

HIGH 72

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00599 Published 2025-05-21 Fixed CWE-1050

TI-2025-34348 CVE-2025-54571

ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure

HIGH 70

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00349 Published 2025-08-05 Partial fix · 2.9.12 CWE-252

TI-2021-03105 CVE-2021-4247 · GHSA-45xc-w9gq-g735

OWASP NodeGoat Query Parameter research.js denial of service

HIGH 66

A vulnerability has been found in OWASP NodeGoat and classified as problematic.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01075 Published 2022-12-18 No fix listed CWE-404

TI-2026-17577 CVE-2026-21876

OWASP CRS has multipart bypass using multiple content-type parts

MEDIUM 63

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.1735 Published 2026-01-08 Fixed in 4.22.0, 3.3.8 CWE-794

TI-2022-08701 CVE-2022-24891 · GHSA-q77q-vx4q-xx6q

Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file

MEDIUM 60

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01715 Published 2022-04-27 Fixed in 2.3.0.0 CWE-79

TI-2026-03305 CVE-2026-3816 · GHSA-22w8-2mrr-vh7h

OWASP DefectDojo SonarQubeParser/MSDefenderParser parser.py input_zip.read denial of service

MEDIUM 57

A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00605 Published 2026-03-09 Fixed in 2.56.0 CWE-404

TI-2024-15704 CVE-2024-23686 · GHSA-frxm-v7q3-v2wv

DependencyCheck Debug Mode Logging of NVD API Key

MEDIUM 57

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00603 Published 2024-01-19 Fixed in 9.0.6 CWE-532

TI-2022-18921 CVE-2022-39955 · GHSA-x6xv-j46p-v597

Partial rule set bypass in OWASP ModSecurity Core Rule Set by submitting a specially crafted HTTP Content-Type header

MEDIUM 51

The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01421 Published 2022-09-20 Will not fix CWE-863

TI-2023-19612 CVE-2023-38199 · GHSA-662c-vg67-m327

coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple…

MEDIUM 50

coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00748 Published 2023-07-13 No fix listed CWE-843

TI-2022-18922 CVE-2022-39956 · GHSA-5xc6-pmr2-qj78

Incorrect authorization in owasp-modsecurity ModSecurity Core Rule Set

MEDIUM 50

The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01212 Published 2022-09-20 Will not fix CWE-863

TI-2021-18855 CVE-2021-42575 · GHSA-3w73-fmf3-hg5c

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies…

MEDIUM 47

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02975 Published 2021-10-18 Fixed in 20211018.1 CWE-20

TI-2021-14182 CVE-2021-35368 · GHSA-2xw7-44j9-24rv

OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before…

MEDIUM 47

OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02733 Published 2021-11-05 No fix listed

TI-2021-06251 CVE-2021-23899 · GHSA-mm8j-9x84-m9cv

OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section…

MEDIUM 46

OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02093 Published 2021-01-13 Fixed in 1.2.2 CWE-611

TI-2020-14375 CVE-2020-22669 · GHSA-rj75-2px6-36w6

Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection…

MEDIUM 45

Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01411 Published 2022-09-02 No fix listed CWE-89

TI-2024-00942 CVE-2024-1019 · GHSA-w56r-g989-xqw3

WAF bypass of the ModSecurity v3 release line

MEDIUM 44

ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00688 Published 2024-01-30 No fix listed CWE-20

TI-2023-26060 CVE-2023-48171 · GHSA-wpgr-jvp4-g62h

An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate…

MEDIUM 41

An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00627 Published 2024-08-12 No fix listed CWE-269

Open these records in search →