Skip to content
OpenAdvisories

Product · maximmasiutin

TinyWeb

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-29046

    TinyWeb: HTTP Header Control Character Injection into CGI Environment

    TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.04, TinyWeb accepts request header values and later maps them into CGI environment variables (HTTP_*). The parser did not strictly reject dangerous control characters in hea…

    maximmasiutin TinyWeb
  • Critical 9.3
    CVE-2026-28497

    TinyWeb: Integer Overflow in `_Val` (HTTP Request Smuggling)

    TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Prior to version 2.03, an integer overflow vulnerability in the string-to-integer conversion routine (_Val) allows an unauthenticated remote attacker to bypass Content-Length restrictions and …

    maximmasiutin TinyWeb
  • Critical 10.0
    CVE-2026-27613

    CGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)

    TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers to bypass the web server's CGI parameter security controls. Depending on the server configuration and the spec…

    maximmasiutin TinyWeb
  • Critical 10.0
    CVE-2026-22781

    TinyWeb CGI Command Injection

    TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI execu…

    maximmasiutin TinyWeb