Web-Framework

CakePHP versions through 5.4.3 contain an SQL injection vulnerability in the WindowExpression::range() and frame() methods that allows attackers to execute arbitrary SQL via crafted input passed to the OVER clause.

Elysia versions before 1.4.29 are vulnerable to a denial-of-service attack due to quadratic time complexity in the 'multipart/form-data' normalization process, leading to CPU exhaustion.

The Phoenix web framework lacks limits on channels per transport, allowing an unauthenticated attacker to cause a DoS by exhausting Erlang VM process limits via CVE-2026-56811.

A vulnerability in VMware Tanzu Spring Framework identified as CVE-2024-38816 allows a remote, unauthenticated attacker to bypass security restrictions.

The Salvo web framework before version 0.89.3 is vulnerable to denial of service due to unbounded memory allocation when parsing form data, enabling attackers to crash services by sending large payloads.

Salvo web framework versions 0.39.0 through 0.89.2 are vulnerable to Path Traversal and Access Control Bypass, allowing unauthenticated external attackers to bypass proxy routing constraints and access unintended backend paths.