Client-side HTTP parameter pollution (stored)
Summary: Client-side HTTP parameter pollution (HPP) vulnerabilities arise when an application embeds user input in URLs in an unsafe manner, letting an attacker construct a URL that, when visited by another user, inserts additional query string parameters into URLs in the response and sometimes overrides existing ones. The stored variant occurs when the input was submitted in a previous request and saved by the application, and PortSwigger rates its severity as low.
Why it matters: The impact depends on what the application does: PortSwigger notes an invitation form could be manipulated so the invitation is delivered to an unexpected recipient, and even with no direct impact an attacker may chain it with other vulnerabilities to raise overall severity.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026