~/research/ cve
> CVE Archive
294 CVE IDsVulnerabilities I found through source review and bug bounty, coordinated and disclosed via Patchstack and VulnCheck. Every entry below has a published CVE record.
294
Total CVEs
284
VulnCheck
10
Patchstack
20
Critical
0x01 Patchstack
Patchstack profile ↗ CVE-2026-78259
WPLegalPages API Secret Disclosure and Account Disconnect via Unauthenticated REST API
Unauthenticated WPLegalPages <= 3.6.4 REST endpoints disclose API secrets and allow attackers to disconnect the connected account.
CVE-2026-59557
Events Made Easy Arbitrary Person Record Modification Without Login
Broken access control in Events Made Easy <= 3.0.67 lets unauthenticated attackers modify arbitrary person records through the public personal-information AJAX endpoint.
CVE-2026-61948
Unauthenticated SQL Injection in Mini Cart Coupon REST Endpoint
Unauthenticated SQL injection in WPDM Premium Packages <= 6.2.0 exposes the public Mini Cart coupon REST endpoint to blind time-based database extraction.
CVE-2026-57408
Peach Payments Gateway Payment Status Forgery via Unauthenticated Webhook
Unauthenticated webhook forgery in Peach Payments Gateway <= 4.0.2 lets attackers mark pending WooCommerce orders as paid by submitting a forged successful payment result.
CVE-2026-57365
Stored XSS in reCAPTCHA for Asgaros Forum via Site Key
Stored XSS in reCAPTCHA for Asgaros Forum <= 1.1.0 lets a low-privilege Subscriber inject JavaScript through the reCAPTCHA site key rendered in the forum editor.
CVE-2026-57341
Colissimo Officiel Unauthenticated Shipping Rate Tampering
Broken authentication in Colissimo Officiel <= 2.9.0 exposes shipping-rate import/export actions to unauthenticated visitors via the shared admin-ajax dispatcher.
CVE-2026-54826
SupportCandy Attachment IDOR via Thread Endpoint
IDOR in SupportCandy <= 3.4.6 lets a low-privilege user reassign and download another user's private ticket attachments via the thread-creation endpoint.
CVE-2026-54840
Newsletters Unauthenticated Subscriber Management Account Takeover
Broken access control in Newsletters <= 4.13 lets an unauthenticated attacker take over any subscriber's management account via a predictable md5(id) token.
CVE-2026-54804
Melhor Envio Subscriber API Token Disclosure and Overwrite
Broken authentication in Melhor Envio <= 2.16.3 lets a low-privilege Subscriber read and overwrite the store's Melhor Envio API tokens.
CVE-2026-42743
Masteriyo LMS Lemon Squeezy Webhook Forgery
Broken authentication in Masteriyo LMS 2.1.8 allows unauthenticated attackers to forge Lemon Squeezy webhooks and mark pending orders as paid.
0x02 VulnCheck
critical
Damselfly REST API has no authorization on any controller, allowing unauthenticated admin creation and account takeover
Webreaper · Damselfly
critical
ZKEACMS hardcoded JWT signing key allows unauthenticated administrator impersonation on the REST API
SeriaWei · ZKEACMS
critical
StaffDeck default session-token signing secret and always-on admin seed allow pre-authenticated admin takeover
OpenBMB · StaffDeck
critical
FastapiAdmin v3.0 unauthenticated auto-login account takeover and a hardcoded default JWT signing secret
FastapiAdmin · FastapiAdmin
critical
FastapiAdmin v3.0 unauthenticated auto-login account takeover and a hardcoded default JWT signing secret
FastapiAdmin · FastapiAdmin
critical
Misaka Danmu Server: unauthenticated /api/ui endpoints and an arbitrary config write that escalates to admin
l429609201 · Misaka Danmu Server
critical
Misaka Danmu Server: unauthenticated /api/ui endpoints and an arbitrary config write that escalates to admin
l429609201 · Misaka Danmu Server
critical
IceCMS backend /User admin controller is unauthenticated, enabling arbitrary account takeover, deletion, and disabling
Thecosy · IceCMS
critical
WeRSS (we-mp-rss) unauthenticated server-side template injection to remote code execution via the RSS template parameter
rachelos · WeRSS
critical
Simple Admin Core ships a hard-coded JWT AccessSecret that lets anyone forge a super-admin token and bypass authentication
suyuan32 · Simple Admin Core
critical
DataBuff pre-auth admin takeover via a hardcoded default JWT signing secret and default admin credentials
databufflabs · DataBuff AI-native APM
critical
DataBuff pre-auth admin takeover via a hardcoded default JWT signing secret and default admin credentials
databufflabs · DataBuff AI-native APM
critical
LangChat ships a configured Sa-Token auth layer that is never enforced, exposing stored passwords, provider API keys, and admin account creation to unauthenticated callers
LangChat Team · LangChat
critical
WhatiTicket Community: unauthenticated signup creates an admin account, plus cross-agent ticket and message IDOR
canove · WhatiTicket Community
critical
WhatiTicket Community: unauthenticated signup creates an admin account, plus cross-agent ticket and message IDOR
canove · WhatiTicket Community
critical
LingGuo-Drama: broken access control gives any registered user full cross-account takeover and project IDOR
LingGuoAI · LingGuo-Drama (灵果短剧AI
critical
LingGuo-Drama: broken access control gives any registered user full cross-account takeover and project IDOR
LingGuoAI · LingGuo-Drama (灵果短剧AI
critical
nest-admin ships a static JWT signing secret in tracked env files, enabling pre-authentication super-admin token forgery
buqiyuan · nest-admin
critical
OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery
AIDotNet · OpenDeepWiki
critical
MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key
yincongcyincong · MuseBot
high
UnicomAI Wanwu: any enabled user can delete another tenant's agent or RAG app through the appspace delete API
UnicomAI · Wanwu self-hosted multi-tenant AI platform
high
UnicomAI Wanwu: an enabled user can unpublish another owner's app and revoke every other user's AppKeys
UnicomAI · Wanwu self-hosted platform
high
mark3labs/mcp-go Streamable HTTP server reads the entire POST body into memory before any validation
mark3labs · mcp-go
high
BotSharp WebStarter ships a fixed JWT signing key, so a caller holding the committed key can forge a bearer token and pass the API authentication check
SciSharp · BotSharp WebStarter API
high
Unla MCP gateway: the OAuth authorization server issues tokens with no resource owner, so any caller can self-issue a bearer token that the MCP OAuth2 gate accepts
AmoyLab · Unla
high
Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API
Square · Squash
high
sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace
Th0rgal · sandboxed.sh
high
MateCloud storage admin endpoints missing function-level authorization lets any authenticated user read, delete and upload arbitrary objects
MateCloud · MateCloud microservice admin platform
high
risesoft-y9 Digital-Infrastructure file manager: unauthenticated path traversal in retrieveFileStream and storeFile for arbitrary file read and write
risesoft-y9 · Digital-Infrastructure
high
risesoft-y9 Digital-Infrastructure file manager: unauthenticated path traversal in retrieveFileStream and storeFile for arbitrary file read and write
risesoft-y9 · Digital-Infrastructure
high
SmartAdmin level-3 security-protection config endpoints missing function-level authorization lets any authenticated user disable the platform security controls
1024-lab · SmartAdmin sa-admin backend
high
risesoft-y9 WorkFlow-Engine: any authenticated user can act on arbitrary workflow tasks (complete, reassign, rollback, take back, claim) by task id
risesoft-y9 · WorkFlow-Engine
high
yshopmall member API is missing object-level ownership checks on address and after-sales endpoints
guchengwuyue · yshopmall
high
yshopmall member API is missing object-level ownership checks on address and after-sales endpoints
guchengwuyue · yshopmall
high
lilishop seller API lets any seller overwrite and take over another store's product through the goods edit endpoint (cross-store authorization bypass)
lilishop · lilishop multi-merchant mall
high
lilishop seller API lets any seller overwrite and take over another store's product through the goods edit endpoint (cross-store authorization bypass)
lilishop · lilishop multi-merchant mall
high
FastBee IoT platform: device read and write endpoints trust a caller-supplied deviceId with no owner check, so any device-role account can read and modify another owner's device
kerwincui · FastBee IoT platform
high
waynboot-mall mobile member API is missing object-level ownership checks across order, address, and cart endpoints
wayn111 · waynboot-mall
high
waynboot-mall mobile member API is missing object-level ownership checks across order, address, and cart endpoints
wayn111 · waynboot-mall
high
waynboot-mall mobile member API is missing object-level ownership checks across order, address, and cart endpoints
wayn111 · waynboot-mall
high
fuint store-membership system exposes any member order through an unauthenticated order-detail endpoint
fushengqian · fuint store-membership marketing mall
high
Wukong-AICRM: missing backend authorization across the whole API enables account takeover, stored AI provider key exfiltration, cross-user data access, RBAC and user-lifecycle tampering, and AI configuration SSRF
WuKongOpenSource · Wukong AICRM backend
high
Wukong-AICRM: missing backend authorization across the whole API enables account takeover, stored AI provider key exfiltration, cross-user data access, RBAC and user-lifecycle tampering, and AI configuration SSRF
WuKongOpenSource · Wukong AICRM backend
high
ai-fusion-video: platform-wide broken access control across the project, storyboard, team, membership, and generation APIs, plus media-upload path traversal and ungated credential disclosure
Stonewuu · ai-fusion-video Spring Boot backend. Affected surfaces: the project
high
ai-fusion-video: platform-wide broken access control across the project, storyboard, team, membership, and generation APIs, plus media-upload path traversal and ungated credential disclosure
Stonewuu · ai-fusion-video Spring Boot backend. Affected surfaces: the project
high
ai-fusion-video: platform-wide broken access control across the project, storyboard, team, membership, and generation APIs, plus media-upload path traversal and ungated credential disclosure
Stonewuu · ai-fusion-video Spring Boot backend. Affected surfaces: the project
high
iFLYTEK SkillHub: any authenticated user can hard-delete any other user's skill through the CLI delete route
iFLYTEK · SkillHub server
high
youlai-boot: privilege escalation through an ungated role-permission assignment endpoint, and account status tampering through an ungated user status endpoint
youlaitech · youlai-boot Spring Boot 3 admin backend
high
youlai-boot: privilege escalation through an ungated role-permission assignment endpoint, and account status tampering through an ungated user status endpoint
youlaitech · youlai-boot Spring Boot 3 admin backend
high
kubeflow/hub Model Registry InferenceService controller: a tenant-set URL annotation makes the controller send its Kubernetes ServiceAccount bearer token to an attacker-chosen host
Kubeflow · Kubeflow Model Registry
high
rovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe
NSPC911 · rovr
high
KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name
KDE · Dolphin
high
Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution
vifm · vifm
high
NullHub through 2026.5.29 Missing Authentication for /api Management API
nullclaw · NullHub
high
SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API
pppscn · SmsForwarder
high
Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header
Portkey-AI · gateway
high
Jpom cross-workspace IDOR in the SSH file controller lets a workspace user read and write files on another tenant's SSH hosts
dromara · Jpom
high
Huly Platform account service exposes an unauthenticated-by-role person merge (mergeSpecifiedPersons) that any authenticated user can invoke against persons they do not own
hcengineering · Huly Platform
high
Jeepay merchant console: cross-merchant overwrite of an application's payment channel config and cross-merchant deletion of a division receiver
jeequan · Jeepay open-source payment gateway
high
Jeepay merchant console: cross-merchant overwrite of an application's payment channel config and cross-merchant deletion of a division receiver
jeequan · Jeepay open-source payment gateway
high
netdisk-fast-download: unauthenticated /v2/randomAuth leaks donated netdisk credentials reversibly encrypted under a hardcoded AES key
qaiu · netdisk-fast-download
high
AllData data-dts: unauthenticated JDBC URL injection with file read-back, plus a hardcoded JWT signing secret
AllData · AllData data middle-platform
high
DataCap cross-user datasource disclosure through the generic get-by-id endpoint (IDOR exposing cleartext connection credentials)
devlive-community · DataCap
high
Oqtane Framework cross-site settings disclosure in the Setting API leaks another co-tenant site's SMTP credentials
Oqtane · Oqtane Framework
high
WHartTest UI-automation WebSocket accepts anonymous connections, enabling cross-user task interception and result spoofing
MGdaasLab · WHartTest
high
Chat Nio (coaidev/coai) unauthenticated path traversal in generation and article archive download endpoints
coaidev · Chat Nio
high
FilePress authenticated ORDER BY SQL injection in the pichome library and collection file lists
zyx0814 · FilePress
high
o2oa process-platform work attachment download: missing attachment-to-work binding allows cross-work file read
o2oa · o2oa enterprise OA platform
high
TDuck survey form: cross-user disclosure of form settings including the write password via GET /user/form/setting/{key}
TDuckCloud · TDuck survey form
high
smart-sso: OAuth2 authorization code leak through an unvalidated redirectUri and a code that is not bound to the requesting application
a466350665 · smart-sso
high
XiaoZhi ESP32 Server Java unauthenticated OTA endpoint issues a device access token for any device id, enabling cross-user device channel takeover
joey-zhou · XiaoZhi ESP32 Server Java
high
IoTSharp cross-tenant IDOR in Devices and Customers API: any NormalUser reads other tenants' customers, device inventory, and device attribute data
IoTSharp · IoTSharp
high
abp-next-admin AIManagement chat module reads and writes another user's AI conversations (IDOR via ConversationId)
colinin · abp-next-admin
high
Helical Insight: authenticated SQL injection through unescaped EFWD report parameters in /executeDatasource
Helical Insight · Helical Insight BI platform
high
Helical Insight: authenticated SQL injection through unescaped EFWD report parameters in /executeDatasource
Helical Insight · Helical Insight BI platform
high
NexoPOS unauthenticated accounting transaction disclosure through the pre-auth /api/fields route
Blair2004 · NexoPOS
high
sshportal: non-admin disclosure of backend host private SSH keys through the unguarded `key show` command
moul · sshportal
high
bbs-go Google One Tap login accepts ID tokens for any audience, enabling cross-user account takeover
mlogclub · bbs-go
high
DooTask OKR comment dialog skips membership check, authenticated cross-user message read and injection
kuaifan · DooTask
high
MrDoc import-local-doc API missing object authorization lets any user publish and reparent another user's documents
zmister2016 · MrDoc
high
SurveyKing unauthenticated arbitrary file read through the public preview endpoint
javahuang · SurveyKing
high
ChronoFrame unauthenticated setup-wizard API lets anonymous callers repoint storage, overwrite map tokens, and deface site settings
HoshinoSuzumi · ChronoFrame
high
risesoft-y9 Digital-Infrastructure log module: cross-tenant personal-data export through a trusted tenantId parameter
risesoft-y9 · Digital-Infrastructure
high
engineercms: missing authorization in the attachment image and video download branch discloses other users' project files
3xxx · engineercms
high
53AIHub: Unauthenticated Cross-Tenant Enterprise Profile Update via PUT /api/enterprises/:id
53AI · 53AIHub
high
FastBee device group endpoints let any user read, modify, and delete another user's groups by id
kerwincui · FastBee open-source IoT platform
high
SSCMS cross-site channel IDOR: a site-scoped admin can read and overwrite another site's channels
SSCMS · SSCMS multi-site CMS
high
waynboot-mall exposes internal order and mail callbacks as unauthenticated H5 routes (order forgery, cross-member order cancel, operator mail relay)
wayn111 · waynboot-mall
high
waynboot-mall exposes internal order and mail callbacks as unauthenticated H5 routes (order forgery, cross-member order cancel, operator mail relay)
wayn111 · waynboot-mall
high
waynboot-mall exposes internal order and mail callbacks as unauthenticated H5 routes (order forgery, cross-member order cancel, operator mail relay)
wayn111 · waynboot-mall
high
Chaskiq server-side request forgery in the oembed endpoint and createUrlUpload mutation and cross-tenant Stripe billing authorization bypass
chaskiq · Chaskiq live chat and support platform. Affected components: the oembed endpoint
high
Chaskiq server-side request forgery in the oembed endpoint and createUrlUpload mutation and cross-tenant Stripe billing authorization bypass
chaskiq · Chaskiq live chat and support platform. Affected components: the oembed endpoint
high
AIHelms efficiency analytics module exposes organization-wide AI spend to any authenticated user (missing authorization)
beizhu-1209 · AIHelms
high
ZR.Admin.NET authenticated ORDER BY SQL injection through the paging Sort parameter
izhaorui · ZR.Admin.NET RBAC admin framework
high
ClickVisual report module missing authorization, cross-instance ClickHouse schema disclosure and row-count inference
clickvisual · ClickVisual
high
cube-studio: missing authorization on custom lifecycle API endpoints lets any authenticated user control another user's notebook, inference service, and pipeline
data-infra · cube-studio
high
cube-studio: missing authorization on custom lifecycle API endpoints lets any authenticated user control another user's notebook, inference service, and pipeline
data-infra · cube-studio
high
course-tencent-cloud (酷瓜云课堂) account takeover through brute force of the account verification code
深圳市酷瓜软件有限公司 · course-tencent-cloud
high
APIPark team-scope authorization bypass lets any team manager read, edit, and delete another team's services and apps
APIParkLab · APIPark
high
EFAK v5 missing admin authorization on the user management and model config REST APIs lets any logged-in user become administrator and read provider API keys
smartloli · EFAK v5
high
EFAK v5 missing admin authorization on the user management and model config REST APIs lets any logged-in user become administrator and read provider API keys
smartloli · EFAK v5
high
Ralph DCIM rack visualization API lets any staff user read, modify, and create data-center racks without the rack model permission
allegro · Ralph
high
Magistrala certs service: missing workspace scope lets any member revoke, read, and issue other tenants' device certificates
Abstract Machines · Magistrala IoT platform
high
IceCMS unauthenticated SQL injection in the WebResource and WebArticle preview-by-num endpoints
Thecosy · IceCMS
high
IceCMS unauthenticated SQL injection in the WebResource and WebArticle preview-by-num endpoints
Thecosy · IceCMS
high
WIMOOR ERP: downstream microservices trust a forgeable X-USERINFO header, enabling cross-tenant impersonation
wimoor · WIMOOR cross-border e-commerce ERP
high
qKnow unauthenticated user directory and org-structure disclosure via permitAll /flyflow endpoints
Jiangsu Qiantong Technology Co. · qKnow
high
data-platform-open: cross-workspace datasource IDOR discloses another tenant's database credentials and schema, compounded by a hardcoded default AES key
shaiwz · data-platform-open
high
data-platform-open: cross-workspace datasource IDOR discloses another tenant's database credentials and schema, compounded by a hardcoded default AES key
shaiwz · data-platform-open
high
HUIZHI-ChargeOS-cloud mini-program API trusts a client-supplied userId, exposing any member's wallet, credit, orders, and allowing balance writes
roinli · HUIZHI-ChargeOS-cloud
high
HUIZHI-ChargeOS-cloud mini-program API trusts a client-supplied userId, exposing any member's wallet, credit, orders, and allowing balance writes
roinli · HUIZHI-ChargeOS-cloud
high
wx-api (niefy) cross-WeChat-account IDOR in the admin console plus unauthenticated fan PII read
niefy · wx-api
high
WebVella ERP: authenticated SQL injection through EQL text literals in the query API
WebVella · WebVella ERP. Affected components: the EQL query API action `WebApiController.EqlQueryAction` and the EQL to SQL compiler `EqlBuilder.Sql.cs`.
high
Nubase storage default download route serves private-bucket objects without authentication
OtterMind · Nubase
high
ChatOllama cross-user knowledge base disclosure via missing ownership checks on the get-by-id and chat endpoints
sugarforever · ChatOllama Nitro API server
high
yshop-crm: cross-user IDOR on customer by-id routes and missing authorization on SMS, mail, and rule-config endpoints
guchengwuyue · yshop-crm
high
99AI chat-log module: unauthenticated bulk conversation export and cross-user single-message IDOR
vastxie · 99AI
high
99AI chat-log module: unauthenticated bulk conversation export and cross-user single-message IDOR
vastxie · 99AI
high
AipexBase dynamic data API SQL injection through order_by and group_by, bypassing row-level security
KuaFuAI · AipexBase
high
roncoo-pay unauthenticated cross-merchant payment record disclosure via the F2F order query route
RonCoo · roncoo-pay
high
fish-island-backend web-page preview endpoint allows unauthenticated SSRF with title and description readback
lhccong · fish-island-backend
high
Open WES gateway never enforces per-warehouse scope, enabling cross-warehouse authorization bypass
jingsewu · Open WES
high
yudao-cloud data-permission-enable request header disables row-level data scope and exposes other departments and users
YunaiV · yudao-cloud
high
MrDoc DocShare management modify branch missing owner check lets any user flip another user's private share to public
zmister2016 · MrDoc
high
Artalk: unauthenticated server-side request forgery through the comment page_key page-title fetch
ArtalkJS · Artalk
high
FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming
idinging · FreeMail
high
Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check
OrchardCMS · Orchard
high
DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization
devlive-community · DataCap
high
CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList
CoreUnion · CoreShop
high
CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList
CoreUnion · CoreShop
high
Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend
songloft-org · songloft
medium
CoreShop buyer API confirm-receipt missing ownership check lets one buyer finalize another buyer's order
CoreUnion · CoreShop
medium
CoreShop through 2026.2.2 Missing Authorization via ResourceController listAction
CoreShop · CoreShop
medium
thClaws HTTP API: an authenticated POST /v1/inputs write follows a pre-existing symlink out of the workspace prefix
thClaws · thClaws AI agent harness
medium
Company Research Agent: unauthenticated PDF generation performs server-side requests through unescaped ReportLab image markup
guy-hartstein · Company Research Agent
medium
phpMyFAQ MCP `faq_search` returns active FAQ text outside the anonymous visibility scope
phpMyFAQ · phpMyFAQ
medium
UnicomAI Wanwu legacy AppKey deletion deletes any key by numeric ID with no owner check
UnicomAI · Wanwu self-hosted multi-tenant AI agent platform
medium
UnicomAI Wanwu: an authenticated user can mint an MCP app key bound to another owner's server ID and connect to that server
UnicomAI · Wanwu self-hosted AI agent platform
medium
Hugging Face Text Embeddings Inference writes the configured API key to startup logs in cleartext
Hugging Face · Text Embeddings Inference router
medium
LoRAX writes the caller-supplied private-adapter API token into the /generate request logs
Predibase · LoRAX router
medium
Odoo MCP server: generic `execute_method` read bypasses the field ACL and returns denied fields to the agent
erpipe-org · Odoo MCP server
medium
APIPark authorization lookup returns another application's API key when given a foreign authorization UUID
APIParkLab · APIPark self-hosted API management platform
medium
Plano publishes an unauthenticated Envoy admin interface that leaks provider API keys through config_dump
Katanemo · Plano Envoy deployment
medium
Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
Pimcore · Pimcore
medium
Ikaros: TOTP two-factor authentication bypass through the pre-2FA temp token and unenforced login paths
Ikaros project · Ikaros ACGMN media content management system
medium
B3log Symphony 3.6.4 admin console: AdminProcessor endpoints with no permission rule run without the admin role
B3log · B3log Symphony community platform
medium
RuoYi-Vue-Plus: the social-account unbind endpoint deletes a binding by caller-supplied id with no owner check, so any authenticated user can unbind another user's third-party login
dromara · RuoYi-Vue-Plus admin framework
medium
RuoYi-Cloud-Plus: the social-account unbind endpoint deletes a third-party login binding by primary key with no owner check, so any authenticated user can unbind another user's account
dromara · RuoYi-Cloud-Plus microservice admin system
medium
JetLinks Community lets a read-only user overwrite a product transparent-message codec because the product-level save handler is missing its save-action check (reactive authorization bypass)
JetLinks · JetLinks Community reactive IoT platform
medium
JetLinks Community lets a read-only user overwrite a product transparent-message codec because the product-level save handler is missing its save-action check (reactive authorization bypass)
JetLinks · JetLinks Community reactive IoT platform
medium
PublicCMS trade module: the address save endpoint updates any address by id with no owner check, so any logged-in site member can overwrite another member's saved shipping address
sanluan · PublicCMS
medium
FJ-OMS oms-erp ships two anonymous Elasticsearch maintenance endpoints, one wipes the entire product search index
FJ-OMS · oms-erp omni-channel OMS
medium
maku-boot returns SMTP and cloud SMS credentials to any authenticated user through notification-config endpoints that skip the authority check
MakuNet · maku-boot
medium
fuintCatering member refund detail endpoint returns any member's refund order and buyer PII by refund id (IDOR)
fushengqian · fuintCatering
medium
ThriveX-Server 4.0 article API: any unauthenticated visitor can read unpublished draft articles (and soft-deleted posts) in full
LiuYuYang01 · ThriveX-Server blog backend
medium
Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query
Phase · Phase Console
medium
Snowy low-code platform: hardcoded download-signature key and missing authorization in the dev file module
xiaonuo · Snowy low-code platform
medium
vhr (微人事) online chat endpoint GET /chat/hrs returns every operator BCrypt password hash and personal data to any authenticated user
lenve · vhr
medium
Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup
Razorpay · IFSC
medium
Kavita CBL URL upload performs an SSRF-prone fetch that skips the connection-time address guard
Kavita · Kavita self-hosted reader server
medium
Shaarli open-mode thumbnail refresh issues a server-side request to a visitor-controlled URL with no safe-URL check (SSRF)
Shaarli Community · Shaarli bookmark application
medium
wallabag: a failed Pocket HTML import leaves attacker HTML in the public web root (stored XSS)
wallabag · wallabag self-hosted read-it-later web application
medium
XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint
sergix44 · XBackBone
medium
muCommander through 1.6.2 Path Traversal via Archive Extraction to FTP/SFTP
muCommander · muCommander
medium
Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture
elio-fm · elio
medium
MP Manager through 1.1.0 Path Traversal via Archive Extraction sanitizeEntryName Bypass
Abdurazaaq Mohammed · MP Manager
medium
we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint
rachelos · we-mp-rss
medium
frp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints
fatedier · frp
medium
Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename
meetecho · janus-gateway
medium
TurboDocx html-to-docx through 1.23.1 SSRF via img src Remote Image Download
TurboDocx · html-to-docx
medium
Erupt generic data API: HQL injection through the linkTree condition builder
erupts · erupt Java low-code runtime admin framework
medium
PlayEdu student API exposes department-restricted course attachments and course structure across departments
PlayEdu · PlayEdu enterprise training
medium
eladmin PUT and DELETE /api/users skip department data scope, enabling cross-department user modification and deletion
elunez · eladmin
medium
Open Journal Systems cross-journal subscription disclosure and reassignment through unscoped subscription forms
Public Knowledge Project · Open Journal Systems
medium
B3log Solo article console lets any non-admin author push and enumerate other authors' articles (missing ownership checks)
b3log · B3log Solo
medium
roncoo-education order cancel and continue-pay accept any user's order number with no ownership check
roncoo · roncoo-education
medium
mall4cloud seller order-address endpoint returns any shop's buyer shipping address by id (cross-shop IDOR)
gz-yami · mall4cloud
medium
lilishop buyer invoice endpoints expose any buyer's invoice records (cross-buyer IDOR and unscoped listing)
lilishop · lilishop
medium
BuildAdmin AdminInfo self-profile editor writes to any administrator by id (cross-admin IDOR)
build-admin · BuildAdmin
medium
paopao-ce: cross-user attachment download IDOR exposes private-post media (missing visibility check in DownloadAttachment)
rocboss · paopao-ce
medium
ThinkAdmin file manager edit action skips the owner check, letting any delegated admin read and overwrite another admin's file records
zoujingli · ThinkAdmin
medium
ChatWiki form filter handlers skip the tenant ownership check, allowing cross-tenant read and modification of another tenant's form filters
Wuhan Sesame Small Customer Service Network Technology Co. · ChatWiki
medium
BeikeShop customer RMA mark-as-shipped endpoint has no ownership check, any logged-in customer can tamper with another customer's return
BeikeShop · BeikeShop
medium
Piranha CMS Manager Language API: missing permission policy lets a limited manager user create, edit, and delete site languages
Piranha CMS · Piranha CMS
medium
Steedos Platform cross-tenant IDOR: any authenticated user reads every tenant's report definitions through the REST API
Steedos · Steedos Platform
medium
REBUILD project task comment read IDOR, any user reads another project's task comments by id
getrebuild · REBUILD low-code business-data platform
medium
Tbed (Hellohao image host): missing ownership check in /admin/setImgFileName lets any user rewrite another user's image metadata
Hello-hao · Tbed
medium
Faveo Helpdesk ticket tooltip endpoint discloses any ticket conversation to any agent across departments
Ladybird Web Solution · Faveo Helpdesk
medium
XBoot data-scope filter bypass and cross-department user disclosure in DepartmentController and UserController
Exrick · XBoot
medium
XBoot data-scope filter bypass and cross-department user disclosure in DepartmentController and UserController
Exrick · XBoot
medium
fuint member booking detail IDOR exposes another member's contact name, phone, and verification code
fushengqian · fuint multi-store member marketing and POS system
medium
Arkon cross-department IDOR: wiki graph, compilation plan, and skill version routes skip the department scope check
nduckmink · Arkon Enterprise AI Knowledge Hub
medium
Arkon cross-department IDOR: wiki graph, compilation plan, and skill version routes skip the department scope check
nduckmink · Arkon Enterprise AI Knowledge Hub
medium
Arkon cross-department IDOR: wiki graph, compilation plan, and skill version routes skip the department scope check
nduckmink · Arkon Enterprise AI Knowledge Hub
medium
yudao-cloud mall member app-api leaks any member's after-sale log through an unscoped afterSaleId (cross-member IDOR)
YunaiV · yudao-cloud
medium
xiaozhi-esp32-server manager-api device address-book IDOR, any normal user reads another user's device contact list
xinnan-tech · xiaozhi-esp32-server
medium
ONEARMY Community Platform: cross-user IDOR lets any member mark another user's notifications as read
ONEARMY · Community Platform
medium
rssant (蚁阅) publish story-detail endpoint ignores the only-publish filter and discloses a user's private feed stories
anyant · rssant
medium
EasyImages 2.0 unauthenticated path traversal arbitrary file read in thumb.php, down.php, and info.php
icret · EasyImages 2.0
medium
nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers
nopSolutions · nopCommerce
medium
NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions
Blair2004 · NexoPOS
medium
JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module
thinkgem · JeeSite
medium
UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download
HDInnovations · UNIT3D
medium
Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id
iluobei · miaomiaowu
medium
AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes
looplj · AxonHub
medium
Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints
blossom-editor · Blossom
medium
ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc
easysoft · zentaopms
medium
Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API
Open Web Analytics · Open Web Analytics
medium
RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}
dromara · RuoYi-Vue-Plus
medium
BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail
TencentBlueKing · bk-cmdb
medium
HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController
HuLaSpark · HuLa-Server
medium
HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion
HuLaSpark · HuLa-Server
medium
HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure
HuLaSpark · HuLa-Server
medium
Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path
admpub · nging
medium
FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations
zyx0814 · FilePress
medium
PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update
PowerDNS-Admin · PowerDNS-Admin
medium
Blossom through 1.17.1 Authorization Bypass via Folder Endpoints
blossom-editor · Blossom
medium
ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries
star7th · ShowDoc
medium
Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create
wannabespace · tamery
medium
Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update
wannabespace · tamery
medium
WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIs
MGdaasLab · WHartTest
low
Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity
Fossify · Fossify File Manager
low
Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label
Khronos Group · nnef
low
xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message
GuDong2003 · xianyu-auto-reply-fix
n/a
hyper-mcp OCI plugin loader: Cosign signature verification is not bound to the resolved manifest, so a mutable tag can load unverified WebAssembly
hyper-mcp-rs · hyper-mcp
n/a
hyper-mcp OCI plugin loader: Cosign signature verification is not bound to the resolved manifest, so a mutable tag can load unverified WebAssembly
hyper-mcp-rs · hyper-mcp
n/a
Deep Chat Markdown renderer disables Remarkable's unsafe-link scheme validation, allowing dangerous-scheme anchors in rendered messages
OvidijusParsiunas · Deep Chat browser web component
n/a
iFLYTEK Astron Agent: authenticated workflow resume does not bind the event to the caller's application, allowing cross-application resume of another application's paused workflow
iFLYTEK · Astron Agent workflow public API
n/a
BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint
BizSpringSource · BizSpring Java e-commerce platform
n/a
BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive
BizSpring · BizSpring Java Mall
n/a
Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter
weizhiqiang1995 · SkyEye ERP-Pro
n/a
ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl
YunaiV · ruoyi-vue-pro
n/a
REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid
getrebuild · REBUILD low-code business platform
n/a
vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil
wwwlike · vlife low-code platform
n/a
youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List
youlaitech · youlai-mall
n/a
Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter
Yiuman · citrus low-code Spring Boot scaffold
n/a
jshERP through 3.6 Missing Authorization via /user/batchSetStatus
jishenghua · jshERP
n/a
lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany
zuihou · lamp-boot
n/a
AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download
iFlytek · AstronRPA
n/a
FlexPrice through 2.1.38 QuickBooks Webhook Signature Verification Bypass
FlexPrice · FlexPrice usage-based billing platform
n/a
Colanode Server through 0.4.7 Path Traversal via Avatar Download Route
Colanode · Colanode server
n/a
Gitingest through 0.3.1 Arbitrary File Read via Symlink in Blob Ingestion
coderamp-labs · gitingest (repository-digest backend and hosted service
n/a
holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist
holaboss-ai · holaOS
n/a
holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist
holaboss-ai · holaOS
n/a
Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force
databasus · Databasus
n/a
Shopizer through 3.2.5 Authorization Bypass via Product Review customerId
Shopizer · Shopizer e-commerce platform
n/a
Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update
we-promise · Sure
n/a
GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint
GrowChief · GrowChief self-hosted backend
n/a
Blinko through 1.8.8 Private Attachment Read via /api/file Route
blinkospace · Blinko
n/a
Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access
ModelEngine-Group · Nexent
n/a
OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route
OpenHealthForAll · OpenHealth
n/a
JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch
DaKheera47 · JobOps
n/a
ValueCell through 0.1.20 Unauthenticated SSRF via /api/v1/models/check
ValueCell-ai · ValueCell
n/a
TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions
TaskingAI · TaskingAI
n/a
Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API
coleam00 · Archon OS
n/a
RedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/verify Endpoint
samugit83 · RedAmon
n/a
rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo
lejianwen · rustdesk-api
n/a
JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console
JuggleIM · JuggleIM im-server
n/a
JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console
JuggleIM · JuggleIM im-server
n/a
Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router
Dokploy · Dokploy self-hosted PaaS
n/a
OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie
AtalayaLabs · OxiCloud
n/a
pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}
pig-mesh · Pig
n/a
APITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/description
APITable · APITable
n/a
Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id
Chris Brame · Trudesk helpdesk
n/a
ZenTao PMS through 22.6 Authorization Bypass via action::editComment
ZenTao Co. · ZenTao PMS
n/a
go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd
eryajf · go-ldap-admin
n/a
Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints
likeshop · likeshop PHP e-commerce platform
n/a
Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL
puemos · Craftplan
n/a
Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group API
Papermark · Papermark
n/a
metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API
metas GmbH · metasfresh Open Source ERP
n/a
ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API
ThinkCMF · ThinkCMF content management framework
n/a
Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints
Peppermint-Lab · Peppermint open source help desk
n/a
crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints
CRMEB · CRMEB Java ecommerce platform
n/a
zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints
zhontai · Admin.Core
n/a
MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force
magicblack · MacCMS v10
n/a
SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form
mettle · SendPortal self-hosted email marketing. Affected component: subscriber tag association on the web subscriber create
n/a
CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift
Zhong Bang · CRMEB
n/a
BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox
DataElement · Bisheng LLM devops platform
n/a
MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch
mindoc-org · MinDoc team document management system
n/a
cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints
cool-team-official · cool-admin-midway
n/a
cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints
cool-team-official · cool-admin-midway
n/a
BillionMail through 4.9 Forgeable JWTs via Default Signing Key
aaPanel · BillionMail
n/a
ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes
ClassroomIO · ClassroomIO LMS
n/a
ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes
ClassroomIO · ClassroomIO LMS
no advisories match your filter