Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
v.26.4.2314

Web Application Vulnerabilities

This page lists 25223 vulnerabilities in 64 categories.

Critical: 1706 High: 13413 Medium: 9129 Low: 904 Information: 71
Vulnerability Name
CVE
CWE
Severity
timthumb.php remote code execution
CVE-2011-4106
CWE-20
High
TinyMCE ajax_create_folder remote code execution vulnerability
-
CWE-94
High
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-1010091)
CVE-2019-1010091
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-12648)
CVE-2020-12648
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-17480)
CVE-2020-17480
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-23066)
CVE-2020-23066
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-23494)
CVE-2022-23494
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-45818)
CVE-2023-45818
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-45819)
CVE-2023-45819
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-48219)
CVE-2023-48219
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-21908)
CVE-2024-21908
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-21910)
CVE-2024-21910
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-21911)
CVE-2024-21911
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-29203)
CVE-2024-29203
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-29881)
CVE-2024-29881
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-47759)
CVE-2026-47759
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-47760)
CVE-2026-47760
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-47761)
CVE-2026-47761
CWE-707
Medium
TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-47762)
CVE-2026-47762
CWE-707
Medium
TLS/SSL (EC)DHE Key Reuse
-
CWE-327
Information
TLS/SSL certificate key size too small
-
CWE-326
Medium
TLS/SSL LOGJAM attack
CVE-2015-4000
CWE-326
Medium
TLS/SSL Sweet32 attack
CVE-2016-6329
CWE-327
Medium
TLS/SSL Weak Cipher Suites
-
CWE-327
Medium
Tomcat path traversal via reverse proxy mapping
-
CWE-22
High
Tomcat status page
-
CWE-200
Low
ToolsPack malware plugin
-
CWE-95
High
TorchServe Management API publicly exposed
CVE-2023-43654
CWE-200
High
TorchServe Management API SSRF (CVE-2023-43654)
CVE-2023-43654
CWE-918
Critical
Tornado Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2024-52804)
CVE-2024-52804
CWE-770
High
Tornado Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2025-47287)
CVE-2025-47287
CWE-770
High
Tornado debug mode
-
CWE-489
Medium
Tornado Improper Handling of Invalid Use of Special Elements Vulnerability (CVE-2026-35536)
CVE-2026-35536
CWE-159
Medium
Tornado Improper Input Validation Vulnerability (CVE-2012-2374)
CVE-2012-2374
CWE-20
Medium
Tornado Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-67724)
CVE-2025-67724
CWE-707
Medium
Tornado Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Vulnerability (CVE-2020-28476)
CVE-2020-28476
CWE-444
High
Tornado Observable Differences in Behavior to Error Inputs Vulnerability (CVE-2014-9720)
CVE-2014-9720
-
Medium
Tornado Uncontrolled Resource Consumption Vulnerability (CVE-2025-67725)
CVE-2025-67725
CWE-400
High
Tornado Uncontrolled Resource Consumption Vulnerability (CVE-2025-67726)
CVE-2025-67726
CWE-400
High
Tornado Uncontrolled Resource Consumption Vulnerability (CVE-2026-31958)
CVE-2026-31958
CWE-400
High
Tornado URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2023-28370)
CVE-2023-28370
CWE-601
Medium
Tornado weak secret key
-
CWE-1391
Medium
TornadoWebServer : Uncontrolled Resource Consumption Vulnerability (CVE-2026-82397)
CVE-2026-82397
CWE-400
High
TornadoWebServer Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-103261)
CVE-2026-103261
CWE-770
Medium
TornadoWebServer Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-91990)
CVE-2026-91990
CWE-770
High
TornadoWebServer Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2026-91992)
CVE-2026-91992
CWE-200
Medium
TornadoWebServer Improper Handling of Highly Compressed Data (Data Amplification) Vulnerability (CVE-2026-103262)
CVE-2026-103262
CWE-409
High
TornadoWebServer Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2026-103263)
CVE-2026-103263
CWE-59
Medium
TornadoWebServer Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response (CVE-2024-58384)
CVE-2024-58384
CWE-707
Medium
TornadoWebServer Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response (CVE-2026-91991)
CVE-2026-91991
CWE-707
Medium
TornadoWebServer Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') V (CVE-2023-54397)
CVE-2023-54397
-
High
TornadoWebServer Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') V (CVE-2024-14029)
CVE-2024-14029
-
High
Total.js Directory Traversal (CVE-2019-8903)
CVE-2019-8903
CWE-22
High
Trac CVE-2009-4405 Vulnerability (CVE-2009-4405)
CVE-2009-4405
-
High
Trac Incorrect Default Permissions Vulnerability (CVE-2010-5108)
CVE-2010-5108
CWE-276
High
Trac URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2008-2951)
CVE-2008-2951
CWE-601
Medium
TRACE Method enabled
-
CWE-489
Low
Trace.axd Detected
-
CWE-215
High
TRACK Method enabled
-
CWE-489
Low
Tracy debugging tool enabled
-
CWE-200
Medium
Trojan shell script
-
CWE-507
High
Twisted Web HTTP Server Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Vulnerability (CVE-2022-21716)
CVE-2022-21716
CWE-120
High
Twisted Web HTTP Server Direct Request ('Forced Browsing') Vulnerability (CVE-2016-1000111)
CVE-2016-1000111
CWE-425
Medium
Twisted Web HTTP Server Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2022-21712)
CVE-2022-21712
CWE-200
High
Twisted Web HTTP Server Improper Certificate Validation Vulnerability (CVE-2014-7143)
CVE-2014-7143
CWE-295
High
Twisted Web HTTP Server Improper Certificate Validation Vulnerability (CVE-2019-12855)
CVE-2019-12855
CWE-295
High
Twisted Web HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-39348)
CVE-2022-39348
CWE-707
Medium
Twisted Web HTTP Server Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2019-12387)
CVE-2019-12387
CWE-138
Medium
Twisted Web HTTP Server Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Vulnerability (CVE-2022-24801)
CVE-2022-24801
CWE-444
High
Twisted Web HTTP Server Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Vulnerability (CVE-2023-46137)
CVE-2023-46137
-
Medium
TwistedHTTP Request Splitting Vulnerability (CVE-2020-10108)
CVE-2020-10108
-
Critical
TwistedHTTP Request Splitting Vulnerability (CVE-2020-10109)
CVE-2020-10109
-
Critical
TYPO3 7PK - Security Features Vulnerability (CVE-2016-5091)
CVE-2016-5091
-
High
Typo3 Admin publicly accessible
-
CWE-200
Information
TYPO3 Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2022-36104)
CVE-2022-36104
CWE-770
High