CriticalCVSS 9.8
EPSS 2.2%
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.
Product
url-parse project url-parse vulnerabilities
8 published CVES affecting url-parse project url-parse, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 8
- Critical
- 3
- High
- 0
- Medium
- 5
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest url-parse project url-parse CVEs
Newest publication first
-
-
CriticalCVSS 9.1 EPSS 1.8%
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.
-
MediumCVSS 5.3 EPSS 1.5%
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.
-
MediumCVSS 5.3 EPSS 1.8%
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
-
MediumCVSS 5.3 EPSS 2.1%
url-parse is vulnerable to URL Redirection to Untrusted Site
-
MediumCVSS 5.3 EPSS 2.0%
url-parse before 1.5.0 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path.
-
MediumCVSS 5.3 EPSS 1.7%
Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.
-
CVE-2018-3774 Open Redirect in url-parse
PublishedCriticalCVSS 10.0 EPSS 3.8%Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.