CWE-178 · Input Validation and Logic
Improper Handling of Case Sensitivity
135CVEs
SortMost likely exploited
135 CVEs with CWE-178 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-24347CheckWordPress SP Project & Document Manager <4.22 - Authenticated Shell UploadSmartypantsplugins · SP Project & Document Manager · 2021-06-14 | – | 54% | 2021-06-14 |
| CVE-2018-9845CheckEtherpad Lite <1.6.4 - Admin Authentication BypassEtherpad · Etherpad Lite · 2018-04-29 | – | 13% | 2018-04-29 |
| CVE-2026-53595CheckFreeScout < 1.8.224 - Invite Hash Authorization Bypassfreescout-help-desk · freescout · CVSS 9.4 · 2026-07-20 | 9.4 | 1.9% | 2026-07-20 |
| CVE-2025-27636Apache Camel: Camel Message Header Injection via Improper FilteringApache Software Foundation · Apache Camel · CVSS 5.6 · 2025-03-09 | 5.6 | 97% | 2025-03-09 |
| CVE-2003-0411Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension instead of the lowercas…Oracle · Sun One Application Server · 2003-06-11 | – | 25% | 2003-06-11 |
| CVE-2026-47323Apache Camel: Camel-CXF Message Header Injection via Missing Inbound FilteringApache Software Foundation · Apache Camel · CVSS 9.8 · 2026-05-19 | 9.8 | 20% | 2026-05-19 |
| CVE-2001-0766Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched b…Apache · Http Server · 2001-10-12 | – | 8.9% | 2001-10-12 |
| CVE-1999-0239Netscape FastTrack Web server lists files when a lowercase "get" command is used instead of an uppercase GET.Netscape · Fasttrack Server · 1999-09-29 | – | 7.6% | 1999-09-29 |
| CVE-2007-3365MyServer 0.8.9 and earlier does not properly handle uppercase characters in filename extensions, which allows remote attackers to obtain sensitive information (script source code)…Myserverproject · Myserver · 2007-06-22 | – | 6.0% | 2007-06-22 |
| CVE-2022-22968In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a fie…Vmware · Spring Framework · 2022-04-14 | – | 5.7% | 2022-04-14 |
| CVE-2021-28323Windows DNS Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1803 · CVSS 6.5 · 2021-04-13 | 6.5 | 4.6% | 2021-04-13 |
| CVE-2026-33691OWASP CRS: Whitespace padding in filenames bypasses file upload extension checkscoreruleset · coreruleset · CVSS 6.8 · 2026-04-02 | 6.8 | 3.8% | 2026-04-02 |
| CVE-2025-46701Apache Tomcat: Security constraint bypass for CGI scriptsApache Software Foundation · Apache Tomcat · CVSS 7.3 · 2025-05-29 | 7.3 | 3.1% | 2025-05-29 |
| CVE-2000-0497IBM WebSphere server 3.0.2 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.Ibm · Websphere Application Server · 2000-10-13 | – | 3.1% | 2000-10-13 |
| CVE-2004-2214Mbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to bypass access restrictions via a URI with mixed case characters.Mbedthis · Appweb Http Server · 2005-07-17 | – | 2.7% | 2005-07-17 |
| CVE-2002-2119Novell eDirectory 8.6.2 and 8.7 use case insensitive passwords, which makes it easier for remote attackers to conduct brute force password guessing.Novell · Edirectory · 2005-08-05 | – | 2.7% | 2005-08-05 |
| CVE-2005-0269The file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all lowercase letters, which allows remote attackers to upload arbitrary files via file…Sir · Gnuboard · 2005-02-10 | – | 2.6% | 2005-02-10 |
| CVE-2000-0499The default configuration of BEA WebLogic 3.1.8 through 4.5.1 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in…Bea · Weblogic Server · 2000-10-13 | – | 2.5% | 2000-10-13 |
| CVE-2023-3545Chamilo LMS Htaccess File Upload Security BypassChamilo · Chamilo · CVSS 9.8 · 2023-11-28 | 9.8 | 2.4% | 2023-11-28 |
| CVE-2002-1820register.php in Ultimate PHP Board (UPB) 1.0 and 1.0b uses an administrative account Admin with a capital "A," but allows a remote attacker to impersonate the administrator by reg…Ultimate Php Board Project · Ultimate Php Board · 2005-06-28 | – | 2.4% | 2005-06-28 |
| CVE-2000-0498Unify eWave ServletExec allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.Unify · Ewave Servletexec · 2001-01-22 | – | 2.3% | 2001-01-22 |
| CVE-2026-40453Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-goo…Apache Software Foundation · Apache Camel JMS · CVSS 9.9 · 2026-04-27 | 9.9 | 2.1% | 2026-04-27 |
| CVE-2004-2154CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowerc…Apple · Cups · CVSS 9.8 · 2005-07-05 | 9.8 | 2.1% | 2005-07-05 |
| CVE-2001-0795Perception LiteServe 1.25 allows remote attackers to obtain source code of CGI scripts via URLs that contain MS-DOS conventions such as (1) upper case letters or (2) 8.3 file name…Cmfperception · Liteserve · 2001-10-12 | – | 2.0% | 2001-10-12 |
| CVE-2019-6289uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension and then renaming with…Dedecms · Dedecms · 2019-01-15 | – | 1.9% | 2019-01-15 |
| CVE-2004-1083Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which…Apple · Mac Os X · 2005-04-14 | – | 1.9% | 2005-04-14 |
| CVE-2023-46218This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to…curl · curl · CVSS 6.5 · 2023-12-07 | 6.5 | 1.7% | 2023-12-07 |
| CVE-2021-45893An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Improper Handling of Case Sensitivity, which makes password guessing easier.Zauner · Arc · 2022-04-05 | – | 1.6% | 2022-04-05 |
| CVE-2026-58057Flowise - Custom MCP Environment Variable Denylist Bypass via Case SensitivityFlowise · Flowise · CVSS 5 · 2026-06-28 | 5.0 | 1.6% | 2026-06-28 |
| CVE-2018-8337A security feature bypass vulnerability exists when Windows Subsystem for Linux improperly handles case sensitivity, aka "Windows Subsystem for Linux Security Feature Bypass Vulne…Microsoft · Windows 10 · 2018-09-13 | – | 1.5% | 2018-09-13 |
| CVE-2002-0485Norton Anti-Virus (NAV) allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headers are mixed upper and lower case, whic…Symantec · Norton Antivirus · CVSS 7.5 · 2002-06-11 | 7.5 | 1.5% | 2002-06-11 |
| CVE-2017-8493Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to set variables that are either…Microsoft Corporation · Microsoft Windows · 2017-06-15 | – | 1.5% | 2017-06-15 |
| CVE-2021-39155Authorization Policy Bypass Due to Case Insensitive Host Comparisonistio · istio · CVSS 8.3 · 2021-08-24 | 8.3 | 1.2% | 2021-08-24 |
| CVE-2001-1238Task Manager in Windows 2000 does not allow local users to end processes with uppercase letters named (1) winlogon.exe, (2) csrss.exe, (3) smss.exe and (4) services.exe via the Pr…Microsoft · Windows 2000 · 2002-05-03 | – | 1.2% | 2002-05-03 |
| CVE-2021-25920In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious user able to read and send sensitive messag…Open-Emr · openemr · CVSS 6.5 · 2021-03-22 | 6.5 | 1.1% | 2021-03-22 |
| CVE-2022-29604An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. Improper handling of c…Opennetworking · Onos · CVSS 9.8 · 2023-04-20 | 9.8 | 1.0% | 2023-04-20 |
| CVE-2026-80343Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path MatchingApache Software Foundation · Apache Camel · CVSS 8.2 · 2026-10-19 | 8.2 | 0.9% | 2026-10-19 |
| CVE-2026-73270httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystemsErlang · OTP · CVSS 8.2 · 2026-09-01 | 8.2 | 0.9% | 2026-09-01 |
| CVE-2024-23331Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystemvitejs · vite · CVSS 7.5 · 2024-01-19 | 7.5 | 0.8% | 2024-01-19 |
| CVE-2024-5699In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive compari…Mozilla · Firefox · CVSS 9.8 · 2024-06-11 | 9.8 | 0.8% | 2024-06-11 |
| CVE-2026-68548Algernon: Case-insensitive filesystem lets unauthenticated requests bypass /admin,/repo,/data permission-prefix gatexyproto · algernon · CVSS 9.4 · 2026-11-12 | 9.4 | 0.8% | 2026-11-12 |
| CVE-2026-49336@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdaptermicrosoft · kiota-typescript · CVSS 5.5 · 2026-06-19 | 5.5 | 0.7% | 2026-06-19 |
| CVE-2024-6866Case-Insensitive Path Matching in corydolphin/flask-corscorydolphin · corydolphin/flask-cors · CVSS 5.3 · 2025-03-20 | 5.3 | 0.7% | 2025-03-20 |
| CVE-2026-85254Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name CasingApache Software Foundation · Apache Camel · CVSS 6.5 · 2026-10-19 | 6.5 | 0.7% | 2026-10-19 |
| CVE-2026-73416jupyterlab: PyPI extension blocklist package-name canonicalization bypassjupyterlab · jupyterlab · CVSS 6.1 · 2026-08-13 | 6.1 | 0.7% | 2026-08-13 |
| CVE-2026-109411Samba: access control bypass via vfs_ceph_rgw case-insensitive openSamba · Samba · CVSS 8.1 · 2026-10-28 | 8.1 | 0.6% | 2026-10-28 |
| CVE-2026-54567Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)jugmac00 · flask-reuploaded · CVSS 7.5 · 2026-09-14 | 7.5 | 0.6% | 2026-09-14 |
| CVE-2024-38820CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match ExceptionVMware · Spring · CVSS 3.1 · 2024-10-18 | 3.1 | 0.6% | 2024-10-18 |
| CVE-2026-77560Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist fortinyauthapp · tinyauth · CVSS 8.1 · 2026-09-21 | 8.1 | 0.6% | 2026-09-21 |
| CVE-2026-116135HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding themHTTP-Body · CVSS 9.8 · 2026-10-28 | 9.8 | 0.6% | 2026-10-28 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.