Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
407613 vulnerabilities
No criteria set — showing every indexed entry of the selected sources, newest first by published date.
CVE-2026-116099 (GCVE-0-2026-116099)
Vulnerability from cvelistv5 – Published: 2026-10-25 23:45 – Updated: 2026-10-25 23:45
VLAI
EPSS
VEX
Title
Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write
Summary
A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual Machine. Executing a manipulation can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3R is capable of addressing this issue. It is recommended to upgrade the affected component.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426167 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426167/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116099 | third-party-advisory |
| https://vuldb.com/submit/1001276 | third-party-advisory |
| https://drbloop.dev/blog/one-click-remote-code-ex… | related |
| https://store.steampowered.com/news/app/1782380/v… | related |
| https://github.com/drbloop2000/SCP-CBM-RCE/tree/main | exploit |
| https://steamdb.info/patchnotes/25701366/ | broken-linkpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fusion Creators Studio | SCP Containment Breach Multiplayer |
Affected:
1.295
Unaffected: 1.3R cpe:2.3:a:fusion_creators_studio:scp_containment_breach_multiplayer:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fusion_creators_studio:scp_containment_breach_multiplayer:*:*:*:*:*:*:*:*"
],
"modules": [
"Skynet++ Virtual Machine"
],
"product": "SCP Containment Breach Multiplayer",
"vendor": "Fusion Creators Studio",
"versions": [
{
"status": "affected",
"version": "1.295"
},
{
"status": "unaffected",
"version": "1.3R"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual Machine. Executing a manipulation can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 1.3R is capable of addressing this issue. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T23:45:16.547Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426167 | Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426167"
},
{
"name": "VDB-426167 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426167/cti"
},
{
"name": "CVE-2026-116099 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116099"
},
{
"name": "Submit #1001276 | Fusion Creators Studio SCP: Containment Breach Multiplayer 24934269 Out-of-bounds Write",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1001276"
},
{
"tags": [
"related"
],
"url": "https://drbloop.dev/blog/one-click-remote-code-execution-in-scp-containment-breach-mutiplayer"
},
{
"tags": [
"related"
],
"url": "https://store.steampowered.com/news/app/1782380/view/670629296167978253"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/drbloop2000/SCP-CBM-RCE/tree/main"
},
{
"tags": [
"broken-link",
"patch"
],
"url": "https://steamdb.info/patchnotes/25701366/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T16:23:30.000Z",
"value": "VulDB entry last update"
}
],
"title": "Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116099",
"datePublished": "2026-10-25T23:45:16.547Z",
"dateReserved": "2026-10-25T07:16:43.544Z",
"dateUpdated": "2026-10-25T23:45:16.547Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116098 (GCVE-0-2026-116098)
Vulnerability from cvelistv5 – Published: 2026-10-25 23:30 – Updated: 2026-10-25 23:30
VLAI
EPSS
VEX
Title
SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization
Summary
A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426166 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426166/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116098 | third-party-advisory |
| https://vuldb.com/submit/1001274 | third-party-advisory |
| https://drbloop.dev/blog/9-year-old-one-click-rem… | related |
| https://steamcommunity.com/app/636480/events/5906… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SteelRaven7 | Ravenfield |
Affected:
25407073
cpe:2.3:a:steelraven7:ravenfield:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:steelraven7:ravenfield:*:*:*:*:*:*:*:*"
],
"modules": [
"RFL Custom Map Handler/RFLD Custom Map Handler"
],
"product": "Ravenfield",
"vendor": "SteelRaven7",
"versions": [
{
"status": "affected",
"version": "25407073"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T23:30:20.866Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426166 | SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426166"
},
{
"name": "VDB-426166 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426166/cti"
},
{
"name": "CVE-2026-116098 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116098"
},
{
"name": "Submit #1001274 | SteelRaven7 Ravenfield 25407073 Deserialization of Untrusted Data",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1001274"
},
{
"tags": [
"related"
],
"url": "https://drbloop.dev/blog/9-year-old-one-click-remote-code-execution-in-ravenfield"
},
{
"tags": [
"patch"
],
"url": "https://steamcommunity.com/app/636480/events/590690402783479125"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-19T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T16:44:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116098",
"datePublished": "2026-10-25T23:30:20.866Z",
"dateReserved": "2026-10-25T07:12:20.730Z",
"dateUpdated": "2026-10-25T23:30:20.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116097 (GCVE-0-2026-116097)
Vulnerability from cvelistv5 – Published: 2026-10-25 23:15 – Updated: 2026-10-25 23:15
VLAI
EPSS
VEX
Title
CloudClassroom-PHP-Project addnewstudent.php cross site scripting
Summary
A security vulnerability has been detected in CloudClassroom-PHP-Project. This affects an unknown part of the file addnewstudent.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426165 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426165/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116097 | third-party-advisory |
| https://vuldb.com/submit/1001271 | third-party-advisory |
| https://github.com/vinniboy021-blip/Advisory/blob… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | CloudClassroom-PHP-Project |
Affected:
5dadec098bfbbf3300d60c3494db3fb95b66e7be
Affected: c46ce5736007d9d6e51a8feeb9250729fe85f139 Affected: dae0c5961a35a4faf28cde9e02117538f09f81c1 cpe:2.3:a:cloudclassroom-php-project:cloudclassroom-php-project:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:cloudclassroom-php-project:cloudclassroom-php-project:*:*:*:*:*:*:*:*"
],
"product": "CloudClassroom-PHP-Project",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "5dadec098bfbbf3300d60c3494db3fb95b66e7be"
},
{
"status": "affected",
"version": "c46ce5736007d9d6e51a8feeb9250729fe85f139"
},
{
"status": "affected",
"version": "dae0c5961a35a4faf28cde9e02117538f09f81c1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "vinniboy021 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in CloudClassroom-PHP-Project. This affects an unknown part of the file addnewstudent.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T23:15:07.201Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426165 | CloudClassroom-PHP-Project addnewstudent.php cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426165"
},
{
"name": "VDB-426165 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426165/cti"
},
{
"name": "CVE-2026-116097 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116097"
},
{
"name": "Submit #1001271 | https://github.com/mathurvishal/CloudClassroom-PHP-Project CloudClassroom-PHP-Project 5dadec098bfbbf3300d60c3494db3fb95b66e7be Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1001271"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/vinniboy021-blip/Advisory/blob/main/addnewstudent-stored-xss.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T08:02:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "CloudClassroom-PHP-Project addnewstudent.php cross site scripting",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116097",
"datePublished": "2026-10-25T23:15:07.201Z",
"dateReserved": "2026-10-25T06:56:55.179Z",
"dateUpdated": "2026-10-25T23:15:07.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116096 (GCVE-0-2026-116096)
Vulnerability from cvelistv5 – Published: 2026-10-25 23:00 – Updated: 2026-10-25 23:00 X_Open Source
VLAI
EPSS
VEX
Title
ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write
Summary
A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version b11796 can resolve this issue. Patch name: 0a1ef309cdbb9f2024f58a38fb4c42352c5db569. The affected component should be upgraded. The reported heap out‑of‑bounds write (gen‑audio / pocket‑tts state_out path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release‑active GGML_ASSERT and aborts. But the submitter's recommended by‑construction fix (PR #29360 "prevent OOB accesses from malformed mmproj files") is still open. So the root cause is detected‑and‑aborted, not prevented‑by‑design.
Severity
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426164 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426164/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116096 | third-party-advisory |
| https://vuldb.com/submit/1000891 | third-party-advisory |
| https://github.com/3em0/cve_repo/tree/main/2026/l… | exploit |
| https://github.com/ggml-org/llama.cpp/pull/30902 | issue-trackingpatch |
| https://github.com/3em0/cve_repo/tree/main/2026/l… | exploit |
| https://github.com/ggml-org/llama.cpp/commit/0a1e… | patch |
| https://github.com/ggml-org/llama.cpp/releases/ta… | patch |
| https://github.com/ggml-org/llama.cpp/ | product |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:*"
],
"modules": [
"Pocket-TTS"
],
"product": "llama.cpp",
"vendor": "ggml-org",
"versions": [
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "affected",
"version": "0.17.1"
},
{
"status": "affected",
"version": "55abc39"
},
{
"status": "affected",
"version": "55d4206c8"
},
{
"status": "affected",
"version": "b5693"
},
{
"status": "affected",
"version": "b7445"
},
{
"status": "affected",
"version": "b7824"
},
{
"status": "affected",
"version": "b8492"
},
{
"status": "affected",
"version": "b8585"
},
{
"status": "affected",
"version": "b9058"
},
{
"status": "affected",
"version": "b9060"
},
{
"status": "unaffected",
"version": "b11796"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem00000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version b11796 can resolve this issue. Patch name: 0a1ef309cdbb9f2024f58a38fb4c42352c5db569. The affected component should be upgraded. The reported heap out\u2011of\u2011bounds write (gen\u2011audio / pocket\u2011tts state_out path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release\u2011active GGML_ASSERT and aborts. But the submitter\u0027s recommended by\u2011construction fix (PR #29360 \"prevent OOB accesses from malformed mmproj files\") is still open. So the root cause is detected\u2011and\u2011aborted, not prevented\u2011by\u2011design."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T23:00:24.282Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426164 | ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426164"
},
{
"name": "VDB-426164 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426164/cti"
},
{
"name": "CVE-2026-116096 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116096"
},
{
"name": "Submit #1000891 | ggml-org xxxxxxxxxx\u00a0llama.cpp up to main commit 8212c7802455255460ab8e18fc34754560031b34 (latest release b11160, 2026-09-24) Out-of-Bounds Write (CWE-787)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1000891"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/3em0/cve_repo/tree/main/2026/llama.cpp.pockettts_state_heap_oob_rce"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/ggml-org/llama.cpp/pull/30902"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/3em0/cve_repo/tree/main/2026/llama.cpp.pockettts_state_heap_oob_rce/poc"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ggml-org/llama.cpp/commit/0a1ef309cdbb9f2024f58a38fb4c42352c5db569"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ggml-org/llama.cpp/releases/tag/b11796"
},
{
"tags": [
"product"
],
"url": "https://github.com/ggml-org/llama.cpp/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T08:00:36.000Z",
"value": "VulDB entry last update"
}
],
"title": "ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116096",
"datePublished": "2026-10-25T23:00:24.282Z",
"dateReserved": "2026-10-25T06:55:29.373Z",
"dateUpdated": "2026-10-25T23:00:24.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116095 (GCVE-0-2026-116095)
Vulnerability from cvelistv5 – Published: 2026-10-25 22:45 – Updated: 2026-10-25 22:45 X_Open Source
VLAI
EPSS
VEX
Title
smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation
Summary
A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component.
Severity
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426162 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426162/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116095 | third-party-advisory |
| https://vuldb.com/submit/1000796 | third-party-advisory |
| https://github.com/smg-project/smg/issues/2361 | issue-tracking |
| https://github.com/smg-project/smg/pull/2569 | issue-trackingpatch |
| https://gist.github.com/Yunzez/24a1bf4c226fbc324e… | exploit |
| https://github.com/smg-project/smg/commit/8f51b57… | patch |
| https://github.com/smg-project/smg/releases/tag/v1.11.0 | patch |
| https://github.com/smg-project/smg/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| smg-project | smg |
Affected:
1.7.0
Affected: 1.8.0 Affected: 1.9.0 Affected: 1.10.0 Affected: 1.10.1 Unaffected: 1.11.0 cpe:2.3:a:smg-project:smg:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:smg-project:smg:*:*:*:*:*:*:*:*"
],
"modules": [
"llm-multimodal"
],
"product": "smg",
"vendor": "smg-project",
"versions": [
{
"status": "affected",
"version": "1.7.0"
},
{
"status": "affected",
"version": "1.8.0"
},
{
"status": "affected",
"version": "1.9.0"
},
{
"status": "affected",
"version": "1.10.0"
},
{
"status": "affected",
"version": "1.10.1"
},
{
"status": "unaffected",
"version": "1.11.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zyz3366 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "Uncontrolled Memory Allocation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T22:45:20.931Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426162 | smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426162"
},
{
"name": "VDB-426162 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426162/cti"
},
{
"name": "CVE-2026-116095 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116095"
},
{
"name": "Submit #1000796 | SMG Project (smg-project) Shepherd Model Gateway (SMG), llm-multimodal Rust crate v1.7.0, v1.8.0, v1.9.0, v1.10.0, and v1.10.1 Memory Allocation with Excessive Size Value",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1000796"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/smg-project/smg/issues/2361"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/smg-project/smg/pull/2569"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/Yunzez/24a1bf4c226fbc324ea8da1d202c6d9b"
},
{
"tags": [
"patch"
],
"url": "https://github.com/smg-project/smg/commit/8f51b57e219a914089e345b704c3c8de37a3bb8e"
},
{
"tags": [
"patch"
],
"url": "https://github.com/smg-project/smg/releases/tag/v1.11.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/smg-project/smg/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T07:46:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116095",
"datePublished": "2026-10-25T22:45:20.931Z",
"dateReserved": "2026-10-25T06:41:29.349Z",
"dateUpdated": "2026-10-25T22:45:20.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116094 (GCVE-0-2026-116094)
Vulnerability from cvelistv5 – Published: 2026-10-25 21:45 – Updated: 2026-10-25 21:45
VLAI
EPSS
VEX
Title
EyouCMS function.php remote_file_to_local server-side request forgery
Summary
A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426161 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426161/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116094 | third-party-advisory |
| https://vuldb.com/submit/1000661 | third-party-advisory |
| https://github.com/yy-t1/security-reports/tree/ma… | exploit |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:eyoucms:eyoucms:*:*:*:*:*:*:*:*"
],
"product": "EyouCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "1.8.0"
},
{
"status": "affected",
"version": "1.8.1"
},
{
"status": "affected",
"version": "1.8.2"
},
{
"status": "affected",
"version": "1.8.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "bsahfm (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T21:45:13.041Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426161 | EyouCMS function.php remote_file_to_local server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426161"
},
{
"name": "VDB-426161 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426161/cti"
},
{
"name": "CVE-2026-116094 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116094"
},
{
"name": "Submit #1000661 | \u6613\u4f18CMS EyouCMS 1.8.2 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1000661"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/yy-t1/security-reports/tree/main/web/EyouCMS1.8.2/remote_file_to_local()%E7%BC%BA%E5%A4%B1%20SSRF%20%E6%A0%A1%E9%AA%8C%E5%AF%BC%E8%87%B4%E5%89%8D%E5%8F%B0%20SSRF"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-25T07:46:36.000Z",
"value": "VulDB entry last update"
}
],
"title": "EyouCMS function.php remote_file_to_local server-side request forgery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116094",
"datePublished": "2026-10-25T21:45:13.041Z",
"dateReserved": "2026-10-25T06:41:25.593Z",
"dateUpdated": "2026-10-25T21:45:13.041Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115627 (GCVE-0-2026-115627)
Vulnerability from cvelistv5 – Published: 2026-10-25 19:49 – Updated: 2026-10-25 19:49
VLAI
EPSS
VEX
Title
AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows
Summary
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows.
When a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource's read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller's tenant is not related to.
This issue affects ash_postgres: from 0.38.0 before 2.15.2.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-115627.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-115627 | related |
| https://github.com/ash-project/ash_postgres/commi… | related |
| https://github.com/ash-project/ash_postgres/commi… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_postgres |
Affected:
0.38.0 , < 2.15.2
(semver)
cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
|
| ash-project | ash_postgres |
Affected:
7115bec58678f13b1ac2fb4822a0ba1aea9dbec5 , < 8c25c945c39a45299193fe70b09fc2fa2aacac7b
(git)
cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash_postgres",
"packageURL": "pkg:hex/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:lateral_join_query/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:through_step_queries/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:run_query_with_lateral_join/4"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.15.2",
"status": "affected",
"version": "0.38.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash-project/ash_postgres",
"packageURL": "pkg:github/ash-project/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:lateral_join_query/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:through_step_queries/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:run_query_with_lateral_join/4"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8c25c945c39a45299193fe70b09fc2fa2aacac7b",
"status": "affected",
"version": "7115bec58678f13b1ac2fb4822a0ba1aea9dbec5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable when the join resource of a \u003ccode\u003emany_to_many\u003c/code\u003e relationship, or a resource along a \u003ccode\u003ethrough\u003c/code\u003e path, uses attribute multitenancy and holds rows from several tenants, and the relationship is loaded with a lateral join (for example with a limit, offset or sort on the relationship).\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable when the join resource of a `many_to_many` relationship, or a resource along a `through` path, uses attribute multitenancy and holds rows from several tenants, and the relationship is loaded with a lateral join (for example with a limit, offset or sort on the relationship)."
}
],
"value": "Reachable when the join resource of a many_to_many relationship, or a resource along a through path, uses attribute multitenancy and holds rows from several tenants, and the relationship is loaded with a lateral join (for example with a limit, offset or sort on the relationship)."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.2",
"versionStartIncluding": "0.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "reporter",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-25T17:27:14.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant\u0027s join rows.\u003c/p\u003e\n\u003cp\u003eWhen a \u003ccode\u003emany_to_many\u003c/code\u003e relationship, or a \u003ccode\u003ethrough\u003c/code\u003e relationship, is loaded with a lateral join (for example with a per-record limit or sort), \u003ccode\u003eAshPostgres.DataLayer\u003c/code\u003e builds the query for the join resource, and for each resource along a \u003ccode\u003ethrough\u003c/code\u003e path, in \u003ccode\u003elateral_join_query/3\u003c/code\u003e and \u003ccode\u003ethrough_step_queries/4\u003c/code\u003e without running that resource\u0027s read action, which is where attribute multitenancy is applied. When those resources use \u003ccode\u003estrategy :attribute\u003c/code\u003e multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller\u0027s tenant is not related to.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_postgres: from 0.38.0 before 2.15.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant\u0027s join rows.\n\nWhen a `many_to_many` relationship, or a `through` relationship, is loaded with a lateral join (for example with a per-record limit or sort), `AshPostgres.DataLayer` builds the query for the join resource, and for each resource along a `through` path, in `lateral_join_query/3` and `through_step_queries/4` without running that resource\u0027s read action, which is where attribute multitenancy is applied. When those resources use `strategy :attribute` multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller\u0027s tenant is not related to.\n\nThis issue affects ash_postgres: from 0.38.0 before 2.15.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant\u0027s join rows.\n\nWhen a many_to_many relationship, or a through relationship, is loaded with a lateral join (for example with a per-record limit or sort), AshPostgres.DataLayer builds the query for the join resource, and for each resource along a through path, in lateral_join_query/3 and through_step_queries/4 without running that resource\u0027s read action, which is where attribute multitenancy is applied. When those resources use strategy :attribute multitenancy, rows belonging to other tenants were joined, so the load returned destination records that the caller\u0027s tenant is not related to.\n\nThis issue affects ash_postgres: from 0.38.0 before 2.15.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA user of one tenant loading a many_to_many or through relationship receives destination records linked only through another tenant\u0027s join rows.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A user of one tenant loading a many_to_many or through relationship receives destination records linked only through another tenant\u0027s join rows."
}
],
"value": "A user of one tenant loading a many_to_many or through relationship receives destination records linked only through another tenant\u0027s join rows."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T19:49:50.510Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "AshPostgres ignores attribute multitenancy on the join resource when loading `many_to_many` and `through` relationships, returning records related through other tenants\u0027 rows",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-gr2r-f49c-9gm2"
},
{
"name": "EEF CNA record for CVE-2026-115627",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-115627.html"
},
{
"name": "OSV record EEF-CVE-2026-115627",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-115627"
},
{
"name": "Introducing commit 7115bec in ash-project/ash_postgres",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_postgres/commit/7115bec58678f13b1ac2fb4822a0ba1aea9dbec5"
},
{
"name": "Fix commit 8c25c94 in ash-project/ash_postgres",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_postgres/commit/8c25c945c39a45299193fe70b09fc2fa2aacac7b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants\u0027 rows"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-115627",
"datePublished": "2026-10-25T19:49:50.510Z",
"dateReserved": "2026-10-23T13:00:02.154Z",
"dateUpdated": "2026-10-25T19:49:50.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115635 (GCVE-0-2026-115635)
Vulnerability from cvelistv5 – Published: 2026-10-25 19:48 – Updated: 2026-10-25 19:48
VLAI
EPSS
VEX
Title
AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
Summary
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert.
When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource's attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.
This issue affects ash_postgres: from 2.6.22 before 2.15.2.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-115635.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-115635 | related |
| https://github.com/ash-project/ash_postgres/commi… | related |
| https://github.com/ash-project/ash_postgres/commi… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_postgres |
Affected:
2.6.22 , < 2.15.2
(semver)
cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
|
| ash-project | ash_postgres |
Affected:
af0903f1380468bbe1b61fe65acb33772b5e24a5 , < 8aa81220c401cae412d21078d11b3519ea25d3a9
(git)
cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash_postgres",
"packageURL": "pkg:hex/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:do_bulk_create/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:upsert/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:bulk_create/3"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.15.2",
"status": "affected",
"version": "2.6.22",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPostgres.DataLayer\u0027"
],
"packageName": "ash-project/ash_postgres",
"packageURL": "pkg:github/ash-project/ash_postgres",
"product": "ash_postgres",
"programFiles": [
"lib/data_layer.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:do_bulk_create/3"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:upsert/4"
},
{
"name": "\u0027Elixir.AshPostgres.DataLayer\u0027:bulk_create/3"
}
],
"repo": "https://github.com/ash-project/ash_postgres",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8aa81220c401cae412d21078d11b3519ea25d3a9",
"status": "affected",
"version": "af0903f1380468bbe1b61fe65acb33772b5e24a5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable when a resource uses attribute multitenancy, an action performs upserts with \u003ccode\u003ereturn_skipped_upsert?: true\u003c/code\u003e, and a caller can supply identity values that another tenant also uses.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable when a resource uses attribute multitenancy, an action performs upserts with `return_skipped_upsert?: true`, and a caller can supply identity values that another tenant also uses."
}
],
"value": "Reachable when a resource uses attribute multitenancy, an action performs upserts with return_skipped_upsert?: true, and a caller can supply identity values that another tenant also uses."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_postgres:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.2",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "reporter",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-25T17:27:42.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant\u0027s record through a skipped upsert.\u003c/p\u003e\n\u003cp\u003eWhen \u003ccode\u003eAsh.bulk_create/4\u003c/code\u003e or a single create runs as an upsert with \u003ccode\u003ereturn_skipped_upsert?: true\u003c/code\u003e and the upsert is skipped (for example because its \u003ccode\u003eupsert_condition\u003c/code\u003e does not hold), \u003ccode\u003eAshPostgres.DataLayer\u003c/code\u003e reads the existing row back by the upsert identity in \u003ccode\u003edo_bulk_create/3\u003c/code\u003e and \u003ccode\u003eupsert/4\u003c/code\u003e. That lookup did not apply the resource\u0027s attribute multitenancy, so on a resource using \u003ccode\u003estrategy :attribute\u003c/code\u003e it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_postgres: from 2.6.22 before 2.15.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant\u0027s record through a skipped upsert.\n\nWhen `Ash.bulk_create/4` or a single create runs as an upsert with `return_skipped_upsert?: true` and the upsert is skipped (for example because its `upsert_condition` does not hold), `AshPostgres.DataLayer` reads the existing row back by the upsert identity in `do_bulk_create/3` and `upsert/4`. That lookup did not apply the resource\u0027s attribute multitenancy, so on a resource using `strategy :attribute` it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.\n\nThis issue affects ash_postgres: from 2.6.22 before 2.15.2."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant\u0027s record through a skipped upsert.\n\nWhen Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped (for example because its upsert_condition does not hold), AshPostgres.DataLayer reads the existing row back by the upsert identity in do_bulk_create/3 and upsert/4. That lookup did not apply the resource\u0027s attribute multitenancy, so on a resource using strategy :attribute it could match and return the row of another tenant with the same identity values, exposing its fields to the caller.\n\nThis issue affects ash_postgres: from 2.6.22 before 2.15.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA user of one tenant whose upsert is skipped receives another tenant\u0027s record with the same identity values.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A user of one tenant whose upsert is skipped receives another tenant\u0027s record with the same identity values."
}
],
"value": "A user of one tenant whose upsert is skipped receives another tenant\u0027s record with the same identity values."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T19:48:43.829Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "`Ash.bulk_create` with `return_skipped_upsert?: true` in AshPostgres returns another tenant\u0027s record for a skipped upsert",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-36hg-wwp2-fg8w"
},
{
"name": "EEF CNA record for CVE-2026-115635",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-115635.html"
},
{
"name": "OSV record EEF-CVE-2026-115635",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-115635"
},
{
"name": "Introducing commit af0903f in ash-project/ash_postgres",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_postgres/commit/af0903f1380468bbe1b61fe65acb33772b5e24a5"
},
{
"name": "Fix commit 8aa8122 in ash-project/ash_postgres",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_postgres/commit/8aa81220c401cae412d21078d11b3519ea25d3a9"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshPostgres returns another tenant\u0027s record for a skipped upsert when return_skipped_upsert? is set"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-115635",
"datePublished": "2026-10-25T19:48:43.829Z",
"dateReserved": "2026-10-23T13:00:02.145Z",
"dateUpdated": "2026-10-25T19:48:43.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114214 (GCVE-0-2026-114214)
Vulnerability from cvelistv5 – Published: 2026-10-25 19:47 – Updated: 2026-10-25 19:47
VLAI
EPSS
VEX
Title
Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records
Summary
Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.
When a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination's policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.
This issue affects ash: from 3.24.0 before 3.37.1.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-114214.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-114214 | related |
| https://github.com/ash-project/ash/commit/24f41e2… | related |
| https://github.com/ash-project/ash/commit/e374633… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.24.0 , < 3.37.1
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
24f41e23dcbd9d07cde270a8141490e8f79251f5 , < e37463307304b26bc8fd606322e5c4d8f7f060e5
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/relationships.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:lateral_join?/4"
},
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:load/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.37.1",
"status": "affected",
"version": "3.24.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Read.Relationships\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/read/relationships.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:lateral_join?/4"
},
{
"name": "\u0027Elixir.Ash.Actions.Read.Relationships\u0027:load/4"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "e37463307304b26bc8fd606322e5c4d8f7f060e5",
"status": "affected",
"version": "24f41e23dcbd9d07cde270a8141490e8f79251f5",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eReachable when a \u003ccode\u003ethrough\u003c/code\u003e relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (\u003ccode\u003eaccessing_from\u003c/code\u003e) or are otherwise open to the caller.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Reachable when a `through` relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (`accessing_from`) or are otherwise open to the caller."
}
],
"value": "Reachable when a through relationship is loaded for a single record with a caller-controlled limit of 1 (and optionally an offset), for example through AshGraphql relationship field arguments, and the destination resource\u0027s read policies rely on the relationship (accessing_from) or are otherwise open to the caller."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.37.1",
"versionStartIncluding": "3.24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "reporter",
"value": "Will Townsend"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
}
],
"dateAssigned": "2026-10-25T17:24:26.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a \u003ccode\u003ethrough\u003c/code\u003e relationship.\u003c/p\u003e\n\u003cp\u003eWhen a \u003ccode\u003ehas_many\u003c/code\u003e relationship declared with \u003ccode\u003ethrough:\u003c/code\u003e was loaded for a single record with a limit of 1, or an unsorted \u003ccode\u003ehas_one\u003c/code\u003e \u003ccode\u003ethrough\u003c/code\u003e relationship was loaded with a limit of 1, \u003ccode\u003elateral_join?/4\u003c/code\u003e in \u003ccode\u003elib/ash/actions/read/relationships.ex\u003c/code\u003e chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an \u003ccode\u003eoffset\u003c/code\u003e. The read still runs the destination\u0027s policies but carries the relationship as \u003ccode\u003eaccessing_from\u003c/code\u003e, so a client paging such a field (for example \u003ccode\u003eteachers(limit: 1, offset: n)\u003c/code\u003e through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.24.0 before 3.37.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a `through` relationship.\n\nWhen a `has_many` relationship declared with `through:` was loaded for a single record with a limit of 1, or an unsorted `has_one` `through` relationship was loaded with a limit of 1, `lateral_join?/4` in `lib/ash/actions/read/relationships.ex` chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an `offset`. The read still runs the destination\u0027s policies but carries the relationship as `accessing_from`, so a client paging such a field (for example `teachers(limit: 1, offset: n)` through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\n\nThis issue affects ash: from 3.24.0 before 3.37.1."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.\n\nWhen a has_many relationship declared with through: was loaded for a single record with a limit of 1, or an unsorted has_one through relationship was loaded with a limit of 1, lateral_join?/4 in lib/ash/actions/read/relationships.ex chose the path that reads the destination without any filter linking it to the source. The load returned the first destination record by sort, or any other record with an offset. The read still runs the destination\u0027s policies but carries the relationship as accessing_from, so a client paging such a field (for example teachers(limit: 1, offset: n) through AshGraphql) can enumerate destination records that policies allow only when reached through that relationship.\n\nThis issue affects ash: from 3.24.0 before 3.37.1."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship."
}
],
"value": "A client paging a through relationship field with a limit of 1 reads destination records that should only be reachable through that relationship."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T19:47:30.612Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Loading a `through` relationship on a single record with `limit: 1` ignores the through path and returns arbitrary destination records",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-g2h4-xp57-q863"
},
{
"name": "EEF CNA record for CVE-2026-114214",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-114214.html"
},
{
"name": "OSV record EEF-CVE-2026-114214",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-114214"
},
{
"name": "Introducing commit 24f41e2 in ash-project/ash",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash/commit/24f41e23dcbd9d07cde270a8141490e8f79251f5"
},
{
"name": "Fix commit e374633 in ash-project/ash",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/e37463307304b26bc8fd606322e5c4d8f7f060e5"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-114214",
"datePublished": "2026-10-25T19:47:30.612Z",
"dateReserved": "2026-10-25T14:30:01.870Z",
"dateUpdated": "2026-10-25T19:47:30.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116063 (GCVE-0-2026-116063)
Vulnerability from cvelistv5 – Published: 2026-10-25 17:45 – Updated: 2026-10-25 17:45
VLAI
EPSS
VEX
Title
DedeCMS update_guide.php require_once code injection
Summary
A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426146 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426146/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116063 | third-party-advisory |
| https://vuldb.com/submit/999433 | third-party-advisory |
| https://github.com/SDshadow/cve | related |
| https://github.com/SDshadow/cve/tree/main/DedeCMS… | exploitpatch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dedecms:dedecms:*:*:*:*:*:*:*:*"
],
"product": "DedeCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "5.7.118"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Fantiane (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T17:45:12.345Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426146 | DedeCMS update_guide.php require_once code injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426146"
},
{
"name": "VDB-426146 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426146/cti"
},
{
"name": "CVE-2026-116063 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116063"
},
{
"name": "Submit #999433 | DedeCMS 5.7.118 Code Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/999433"
},
{
"tags": [
"related"
],
"url": "https://github.com/SDshadow/cve"
},
{
"tags": [
"exploit",
"patch"
],
"url": "https://github.com/SDshadow/cve/tree/main/DedeCMS/V5.7.118-update_guide-RCE/poc"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-24T23:51:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "DedeCMS update_guide.php require_once code injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116063",
"datePublished": "2026-10-25T17:45:12.345Z",
"dateReserved": "2026-10-24T21:46:16.650Z",
"dateUpdated": "2026-10-25T17:45:12.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116062 (GCVE-0-2026-116062)
Vulnerability from cvelistv5 – Published: 2026-10-25 17:30 – Updated: 2026-10-25 17:30 X_Freeware
VLAI
EPSS
VEX
Title
SourceCodester Performance Indicator System save_profile.php sql injection
Summary
A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The manipulation of the argument Contact results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426145 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426145/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116062 | third-party-advisory |
| https://vuldb.com/submit/999430 | third-party-advisory |
| https://github.com/hubdk01/cve/issues/13 | exploitissue-tracking |
| https://www.sourcecodester.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SourceCodester | Performance Indicator System |
Affected:
1.0
cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:*"
],
"product": "Performance Indicator System",
"vendor": "SourceCodester",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hubdk01 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The manipulation of the argument Contact results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T17:30:15.803Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426145 | SourceCodester Performance Indicator System save_profile.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426145"
},
{
"name": "VDB-426145 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426145/cti"
},
{
"name": "CVE-2026-116062 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116062"
},
{
"name": "Submit #999430 | SourceCodester Performance Indicator System 1.0 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/999430"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/hubdk01/cve/issues/13"
},
{
"tags": [
"product"
],
"url": "https://www.sourcecodester.com/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-24T23:48:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "SourceCodester Performance Indicator System save_profile.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116062",
"datePublished": "2026-10-25T17:30:15.803Z",
"dateReserved": "2026-10-24T21:42:57.826Z",
"dateUpdated": "2026-10-25T17:30:15.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116061 (GCVE-0-2026-116061)
Vulnerability from cvelistv5 – Published: 2026-10-25 17:15 – Updated: 2026-10-25 17:15 X_Freeware
VLAI
EPSS
VEX
Title
SourceCodester Performance Indicator System edit_dealer.php sql injection
Summary
A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426144 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426144/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116061 | third-party-advisory |
| https://vuldb.com/submit/999428 | third-party-advisory |
| https://github.com/hubdk01/cve/issues/12 | exploitissue-tracking |
| https://www.sourcecodester.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SourceCodester | Performance Indicator System |
Affected:
1.0
cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:*"
],
"product": "Performance Indicator System",
"vendor": "SourceCodester",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hubdk01 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T17:15:16.161Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426144 | SourceCodester Performance Indicator System edit_dealer.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426144"
},
{
"name": "VDB-426144 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426144/cti"
},
{
"name": "CVE-2026-116061 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116061"
},
{
"name": "Submit #999428 | SourceCodester Performance Indicator System 1.0 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/999428"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/hubdk01/cve/issues/12"
},
{
"tags": [
"product"
],
"url": "https://www.sourcecodester.com/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-24T23:48:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "SourceCodester Performance Indicator System edit_dealer.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116061",
"datePublished": "2026-10-25T17:15:16.161Z",
"dateReserved": "2026-10-24T21:42:51.018Z",
"dateUpdated": "2026-10-25T17:15:16.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115825 (GCVE-0-2026-115825)
Vulnerability from cvelistv5 – Published: 2026-10-25 16:51 – Updated: 2026-10-25 16:51
VLAI
EPSS
VEX
Title
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length
Summary
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.
The request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares.
A remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted.
Severity
No CVSS data available.
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/plack/Plack/commit/11545871cad… | patch |
| https://metacpan.org/release/MIYAGAWA/Plack-1.005… | release-notes |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"HTTP::Server::PSGI"
],
"packageName": "Plack",
"packageURL": "pkg:cpan/Plack",
"programFiles": [
"lib/HTTP/Server/PSGI.pm"
],
"programRoutines": [
{
"name": "HTTP::Server::PSGI::handle_connection"
}
],
"repo": "https://github.com/plack/Plack",
"versions": [
{
"lessThan": "1.0056",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.\n\nThe request body is read with sysread() calls sized by the remaining Content-Length. Perl grows the read buffer to the requested length before any data arrives, so the server tries to allocate as much memory as the client declares.\n\nA remote attacker can send one request with a large Content-Length and a few body bytes, and perl exits with an out-of-memory error before the application is called. HTTP::Server::PSGI runs as a single process, so the server stays down until restarted."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T16:51:54.897Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/MIYAGAWA/Plack-1.0056/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Plack 1.0057 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-115825",
"datePublished": "2026-10-25T16:51:54.897Z",
"dateReserved": "2026-10-23T16:47:20.192Z",
"dateUpdated": "2026-10-25T16:51:54.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115824 (GCVE-0-2026-115824)
Vulnerability from cvelistv5 – Published: 2026-10-25 16:51 – Updated: 2026-10-25 16:51
VLAI
EPSS
VEX
Title
Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies
Summary
Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.
The chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending.
A remote attacker can exhaust worker memory with a single connection.
Severity
No CVSS data available.
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Starman"
],
"packageName": "Starman",
"packageURL": "pkg:cpan/Starman",
"programFiles": [
"lib/Starman/Server.pm"
],
"programRoutines": [
{
"name": "Starman::Server::_prepare_env"
}
],
"repo": "https://github.com/miyagawa/Starman",
"versions": [
{
"lessThan": "0.4019",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.\n\nThe chunked body decoder keeps each chunk in memory until the whole chunk and its CRLF have arrived, and sets no limit on the length of a chunk-size line. A client that declares a huge chunk size and streams data, or sends a chunk-size line that never ends, grows the buffer for as long as it keeps sending.\n\nA remote attacker can exhaust worker memory with a single connection."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T16:51:39.510Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/miyagawa/Starman/commit/d789a02dbe5408ef5f7a4659078d0008dd84c308.patch"
},
{
"tags": [
"patch"
],
"url": "https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Starman 0.4019 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-115824",
"datePublished": "2026-10-25T16:51:39.510Z",
"dateReserved": "2026-10-23T16:47:20.192Z",
"dateUpdated": "2026-10-25T16:51:39.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115823 (GCVE-0-2026-115823)
Vulnerability from cvelistv5 – Published: 2026-10-25 16:51 – Updated: 2026-10-25 16:51
VLAI
EPSS
VEX
Title
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections
Summary
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.
For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.
On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.
Severity
No CVSS data available.
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/miyagawa/Starman/commit/91c47c… | patch |
| https://metacpan.org/release/MIYAGAWA/Starman-0.4… | release-notes |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Starman"
],
"packageName": "Starman",
"packageURL": "pkg:cpan/Starman",
"programFiles": [
"lib/Starman/Server.pm"
],
"programRoutines": [
{
"name": "Starman::Server::_finalize_response"
}
],
"repo": "https://github.com/miyagawa/Starman",
"versions": [
{
"lessThan": "0.4019",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.\n\nFor a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body.\n\nOn a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T16:51:19.961Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Starman 0.4019 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections",
"workarounds": [
{
"lang": "en",
"value": "For deployments that cannot upgrade to 0.4019, enable Plack::Middleware::Head, which removes the body from HEAD responses."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-115823",
"datePublished": "2026-10-25T16:51:19.961Z",
"dateReserved": "2026-10-23T16:47:20.192Z",
"dateUpdated": "2026-10-25T16:51:19.961Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115822 (GCVE-0-2026-115822)
Vulnerability from cvelistv5 – Published: 2026-10-25 16:51 – Updated: 2026-10-25 16:51
VLAI
EPSS
VEX
Title
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies
Summary
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.
Starman decodes chunked request bodies before calling the application, matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\015\012)//`. A line of hex digits followed by a bare LF and then CRLF never matches, because `.` does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line.
A remote attacker can exhaust worker CPU by sending such requests to any route.
Severity
No CVSS data available.
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/miyagawa/Starman/commit/0f33f9… | patch |
| https://metacpan.org/release/MIYAGAWA/Starman-0.4… | release-notes |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Starman"
],
"packageName": "Starman",
"packageURL": "pkg:cpan/Starman",
"programFiles": [
"lib/Starman/Server.pm"
],
"programRoutines": [
{
"name": "Starman::Server::_prepare_env"
}
],
"repo": "https://github.com/miyagawa/Starman",
"versions": [
{
"lessThan": "0.4019",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.\n\nStarman decodes chunked request bodies before calling the application, matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\\015\\012)//`. A line of hex digits followed by a bare LF and then CRLF never matches, because `.` does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line.\n\nA remote attacker can exhaust worker CPU by sending such requests to any route."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333 Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T16:51:00.241Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Starman 0.4019 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-115822",
"datePublished": "2026-10-25T16:51:00.241Z",
"dateReserved": "2026-10-23T16:47:20.192Z",
"dateUpdated": "2026-10-25T16:51:00.241Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115817 (GCVE-0-2026-115817)
Vulnerability from cvelistv5 – Published: 2026-10-25 16:50 – Updated: 2026-10-25 16:50
VLAI
EPSS
VEX
Title
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers
Summary
Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.
Content-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.
A remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.
Version 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body.
Severity
No CVSS data available.
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
3 references
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Starman"
],
"packageName": "Starman",
"packageURL": "pkg:cpan/Starman",
"programFiles": [
"lib/Starman/Server.pm"
],
"programRoutines": [
{
"name": "Starman::Server::_prepare_env"
}
],
"repo": "https://github.com/miyagawa/Starman",
"versions": [
{
"lessThan": "0.4019",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.\n\nContent-Length and chunked request bodies are read with blocking reads and no deadline. A client that sends complete headers and then stalls or trickles the body keeps the worker waiting until it disconnects.\n\nA remote attacker can take every worker with a few such connections, five with the default worker count, so the server stops answering requests.\n\nVersion 0.4019 applies read_timeout to each wait for body data and adds a body_timeout limit, 300 seconds by default, on the total time to read a body."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T16:50:33.914Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558.patch"
},
{
"tags": [
"patch"
],
"url": "https://github.com/miyagawa/Starman/commit/a30533c03051502d6b67cd48b3a95a61e129691b.patch"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Starman 0.4019 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-115817",
"datePublished": "2026-10-25T16:50:33.914Z",
"dateReserved": "2026-10-23T16:22:27.039Z",
"dateUpdated": "2026-10-25T16:50:33.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116060 (GCVE-0-2026-116060)
Vulnerability from cvelistv5 – Published: 2026-10-25 16:30 – Updated: 2026-10-25 16:30 X_Freeware
VLAI
EPSS
VEX
Title
SourceCodester Performance Indicator System adddealer.php sql injection
Summary
A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426143 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426143/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116060 | third-party-advisory |
| https://vuldb.com/submit/999167 | third-party-advisory |
| https://github.com/hubdk01/cve/issues/11 | exploitissue-tracking |
| https://www.sourcecodester.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SourceCodester | Performance Indicator System |
Affected:
1.0
cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:*"
],
"product": "Performance Indicator System",
"vendor": "SourceCodester",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hubdk01 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T16:30:18.104Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426143 | SourceCodester Performance Indicator System adddealer.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426143"
},
{
"name": "VDB-426143 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426143/cti"
},
{
"name": "CVE-2026-116060 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116060"
},
{
"name": "Submit #999167 | SourceCodester Performance Indicator System 1.0 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/999167"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/hubdk01/cve/issues/11"
},
{
"tags": [
"product"
],
"url": "https://www.sourcecodester.com/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-24T23:48:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "SourceCodester Performance Indicator System adddealer.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116060",
"datePublished": "2026-10-25T16:30:18.104Z",
"dateReserved": "2026-10-24T21:42:46.189Z",
"dateUpdated": "2026-10-25T16:30:18.104Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116058 (GCVE-0-2026-116058)
Vulnerability from cvelistv5 – Published: 2026-10-25 16:00 – Updated: 2026-10-25 16:00
VLAI
EPSS
VEX
Title
Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection
Summary
A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the file JuelScriptEngine.java. Performing a manipulation results in code injection. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426142 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426142/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116058 | third-party-advisory |
| https://vuldb.com/submit/997843 | third-party-advisory |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:alfresco:activiti:*:*:*:*:*:*:*:*"
],
"product": "Activiti",
"vendor": "Alfresco",
"versions": [
{
"status": "affected",
"version": "7.21.0-rc.692"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "onlyeagle (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the file JuelScriptEngine.java. Performing a manipulation results in code injection. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T16:00:08.867Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426142 | Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426142"
},
{
"name": "VDB-426142 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426142/cti"
},
{
"name": "CVE-2026-116058 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116058"
},
{
"name": "Submit #997843 | Alfresco Software (Apache-2.0 open-source) Activiti (Alfresco BPMN / Workflow Engine) 7.21.0-rc Activiti JUEL Reflection Bypass \u2192 RCE",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/997843"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-24T23:45:55.000Z",
"value": "VulDB entry last update"
}
],
"title": "Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116058",
"datePublished": "2026-10-25T16:00:08.867Z",
"dateReserved": "2026-10-24T21:40:47.367Z",
"dateUpdated": "2026-10-25T16:00:08.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116057 (GCVE-0-2026-116057)
Vulnerability from cvelistv5 – Published: 2026-10-25 15:30 – Updated: 2026-10-25 15:30
VLAI
EPSS
VEX
Title
KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload
Summary
A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor Save Endpoint. Such manipulation of the argument path/filestr leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426141 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426141/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116057 | third-party-advisory |
| https://vuldb.com/submit/997520 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| KodCloud | KodExplorer |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 Affected: 4.9 Affected: 4.10 Affected: 4.11 Affected: 4.12 Affected: 4.13 Affected: 4.14 Affected: 4.15 Affected: 4.16 Affected: 4.17 Affected: 4.18 Affected: 4.19 Affected: 4.20 Affected: 4.21 Affected: 4.22 Affected: 4.23 Affected: 4.24 Affected: 4.25 Affected: 4.26 Affected: 4.27 Affected: 4.28 Affected: 4.29 Affected: 4.30 Affected: 4.31 Affected: 4.32 Affected: 4.33 Affected: 4.34 Affected: 4.35 Affected: 4.36 Affected: 4.37 Affected: 4.38 Affected: 4.39 Affected: 4.40 Affected: 4.41 Affected: 4.42 Affected: 4.43 Affected: 4.44 Affected: 4.45 Affected: 4.46 Affected: 4.47 Affected: 4.48 Affected: 4.49 Affected: 4.50 Affected: 4.51 Affected: 4.52 Affected: 4.53 Affected: 4.54 Affected: 4.55 cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:*"
],
"modules": [
"Online Editor Save Endpoint"
],
"product": "KodExplorer",
"vendor": "KodCloud",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
},
{
"status": "affected",
"version": "4.9"
},
{
"status": "affected",
"version": "4.10"
},
{
"status": "affected",
"version": "4.11"
},
{
"status": "affected",
"version": "4.12"
},
{
"status": "affected",
"version": "4.13"
},
{
"status": "affected",
"version": "4.14"
},
{
"status": "affected",
"version": "4.15"
},
{
"status": "affected",
"version": "4.16"
},
{
"status": "affected",
"version": "4.17"
},
{
"status": "affected",
"version": "4.18"
},
{
"status": "affected",
"version": "4.19"
},
{
"status": "affected",
"version": "4.20"
},
{
"status": "affected",
"version": "4.21"
},
{
"status": "affected",
"version": "4.22"
},
{
"status": "affected",
"version": "4.23"
},
{
"status": "affected",
"version": "4.24"
},
{
"status": "affected",
"version": "4.25"
},
{
"status": "affected",
"version": "4.26"
},
{
"status": "affected",
"version": "4.27"
},
{
"status": "affected",
"version": "4.28"
},
{
"status": "affected",
"version": "4.29"
},
{
"status": "affected",
"version": "4.30"
},
{
"status": "affected",
"version": "4.31"
},
{
"status": "affected",
"version": "4.32"
},
{
"status": "affected",
"version": "4.33"
},
{
"status": "affected",
"version": "4.34"
},
{
"status": "affected",
"version": "4.35"
},
{
"status": "affected",
"version": "4.36"
},
{
"status": "affected",
"version": "4.37"
},
{
"status": "affected",
"version": "4.38"
},
{
"status": "affected",
"version": "4.39"
},
{
"status": "affected",
"version": "4.40"
},
{
"status": "affected",
"version": "4.41"
},
{
"status": "affected",
"version": "4.42"
},
{
"status": "affected",
"version": "4.43"
},
{
"status": "affected",
"version": "4.44"
},
{
"status": "affected",
"version": "4.45"
},
{
"status": "affected",
"version": "4.46"
},
{
"status": "affected",
"version": "4.47"
},
{
"status": "affected",
"version": "4.48"
},
{
"status": "affected",
"version": "4.49"
},
{
"status": "affected",
"version": "4.50"
},
{
"status": "affected",
"version": "4.51"
},
{
"status": "affected",
"version": "4.52"
},
{
"status": "affected",
"version": "4.53"
},
{
"status": "affected",
"version": "4.54"
},
{
"status": "affected",
"version": "4.55"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "xiaochengqingjun (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor Save Endpoint. Such manipulation of the argument path/filestr leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T15:30:13.590Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426141 | KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426141"
},
{
"name": "VDB-426141 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426141/cti"
},
{
"name": "CVE-2026-116057 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116057"
},
{
"name": "Submit #997520 | KodCloud KodExplorer (KODExplorer) v4.31 - v4.54 Remote Code Execution (CWE-434 Arbitrary File Upload / Write)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/997520"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-24T23:40:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116057",
"datePublished": "2026-10-25T15:30:13.590Z",
"dateReserved": "2026-10-24T21:35:47.642Z",
"dateUpdated": "2026-10-25T15:30:13.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116056 (GCVE-0-2026-116056)
Vulnerability from cvelistv5 – Published: 2026-10-25 15:15 – Updated: 2026-10-25 15:15
VLAI
EPSS
VEX
Title
KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery
Summary
A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426140 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426140/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116056 | third-party-advisory |
| https://vuldb.com/submit/997517 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| KodCloud | KodExplorer |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 Affected: 4.9 Affected: 4.10 Affected: 4.11 Affected: 4.12 Affected: 4.13 Affected: 4.14 Affected: 4.15 Affected: 4.16 Affected: 4.17 Affected: 4.18 Affected: 4.19 Affected: 4.20 Affected: 4.21 Affected: 4.22 Affected: 4.23 Affected: 4.24 Affected: 4.25 Affected: 4.26 Affected: 4.27 Affected: 4.28 Affected: 4.29 Affected: 4.30 Affected: 4.31 Affected: 4.32 Affected: 4.33 Affected: 4.34 Affected: 4.35 Affected: 4.36 Affected: 4.37 Affected: 4.38 Affected: 4.39 Affected: 4.40 Affected: 4.41 Affected: 4.42 Affected: 4.43 Affected: 4.44 Affected: 4.45 Affected: 4.46 Affected: 4.47 Affected: 4.48 Affected: 4.49 Affected: 4.50 Affected: 4.51 Affected: 4.52 Affected: 4.53 Affected: 4.54 Affected: 4.55 Affected: 4.56 cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kodcloud:kodexplorer:*:*:*:*:*:*:*:*"
],
"modules": [
"Remote Download"
],
"product": "KodExplorer",
"vendor": "KodCloud",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
},
{
"status": "affected",
"version": "4.9"
},
{
"status": "affected",
"version": "4.10"
},
{
"status": "affected",
"version": "4.11"
},
{
"status": "affected",
"version": "4.12"
},
{
"status": "affected",
"version": "4.13"
},
{
"status": "affected",
"version": "4.14"
},
{
"status": "affected",
"version": "4.15"
},
{
"status": "affected",
"version": "4.16"
},
{
"status": "affected",
"version": "4.17"
},
{
"status": "affected",
"version": "4.18"
},
{
"status": "affected",
"version": "4.19"
},
{
"status": "affected",
"version": "4.20"
},
{
"status": "affected",
"version": "4.21"
},
{
"status": "affected",
"version": "4.22"
},
{
"status": "affected",
"version": "4.23"
},
{
"status": "affected",
"version": "4.24"
},
{
"status": "affected",
"version": "4.25"
},
{
"status": "affected",
"version": "4.26"
},
{
"status": "affected",
"version": "4.27"
},
{
"status": "affected",
"version": "4.28"
},
{
"status": "affected",
"version": "4.29"
},
{
"status": "affected",
"version": "4.30"
},
{
"status": "affected",
"version": "4.31"
},
{
"status": "affected",
"version": "4.32"
},
{
"status": "affected",
"version": "4.33"
},
{
"status": "affected",
"version": "4.34"
},
{
"status": "affected",
"version": "4.35"
},
{
"status": "affected",
"version": "4.36"
},
{
"status": "affected",
"version": "4.37"
},
{
"status": "affected",
"version": "4.38"
},
{
"status": "affected",
"version": "4.39"
},
{
"status": "affected",
"version": "4.40"
},
{
"status": "affected",
"version": "4.41"
},
{
"status": "affected",
"version": "4.42"
},
{
"status": "affected",
"version": "4.43"
},
{
"status": "affected",
"version": "4.44"
},
{
"status": "affected",
"version": "4.45"
},
{
"status": "affected",
"version": "4.46"
},
{
"status": "affected",
"version": "4.47"
},
{
"status": "affected",
"version": "4.48"
},
{
"status": "affected",
"version": "4.49"
},
{
"status": "affected",
"version": "4.50"
},
{
"status": "affected",
"version": "4.51"
},
{
"status": "affected",
"version": "4.52"
},
{
"status": "affected",
"version": "4.53"
},
{
"status": "affected",
"version": "4.54"
},
{
"status": "affected",
"version": "4.55"
},
{
"status": "affected",
"version": "4.56"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "xiaochengqingjun (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T15:15:13.191Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426140 | KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426140"
},
{
"name": "VDB-426140 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426140/cti"
},
{
"name": "CVE-2026-116056 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116056"
},
{
"name": "Submit #997517 | KodCloud KODExplorer Personal v4.45 - v4.54 Server-Side Request Forgery (CWE-918) \u2014 do NOT use \"Memory corru",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/997517"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-24T23:40:53.000Z",
"value": "VulDB entry last update"
}
],
"title": "KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116056",
"datePublished": "2026-10-25T15:15:13.191Z",
"dateReserved": "2026-10-24T21:35:43.981Z",
"dateUpdated": "2026-10-25T15:15:13.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116055 (GCVE-0-2026-116055)
Vulnerability from cvelistv5 – Published: 2026-10-25 14:45 – Updated: 2026-10-25 14:45 X_Freeware
VLAI
EPSS
VEX
Title
SourceCodester Performance Indicator System deleteproduct.php sql injection
Summary
A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426139 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426139/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116055 | third-party-advisory |
| https://vuldb.com/submit/997518 | third-party-advisory |
| https://github.com/hubdk01/cve/issues/5 | exploitissue-tracking |
| https://www.sourcecodester.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SourceCodester | Performance Indicator System |
Affected:
1.0
cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sourcecodester:performance_indicator_system:*:*:*:*:*:*:*:*"
],
"product": "Performance Indicator System",
"vendor": "SourceCodester",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hubdk01 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "SQL Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T14:45:17.375Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426139 | SourceCodester Performance Indicator System deleteproduct.php sql injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426139"
},
{
"name": "VDB-426139 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426139/cti"
},
{
"name": "CVE-2026-116055 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116055"
},
{
"name": "Submit #997518 | SourceCodester Performance Indicator System using PHP/MySQLi with Source Code 1.0 SQL Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/997518"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/hubdk01/cve/issues/5"
},
{
"tags": [
"product"
],
"url": "https://www.sourcecodester.com/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-24T23:38:02.000Z",
"value": "VulDB entry last update"
}
],
"title": "SourceCodester Performance Indicator System deleteproduct.php sql injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116055",
"datePublished": "2026-10-25T14:45:17.375Z",
"dateReserved": "2026-10-24T21:32:57.348Z",
"dateUpdated": "2026-10-25T14:45:17.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116054 (GCVE-0-2026-116054)
Vulnerability from cvelistv5 – Published: 2026-10-25 14:15 – Updated: 2026-10-25 14:15
VLAI
EPSS
VEX
Title
SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash
Summary
A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.0.2.0 mitigates this issue. Upgrading the affected component is recommended.
Severity
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426138 | vdb-entry |
| https://vuldb.com/vuln/426138/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116054 | third-party-advisory |
| https://vuldb.com/submit/997072 | third-party-advisory |
| https://medium.com/@warlleyfreire/sh3-public-mana… | broken-linkexploit |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sh3:sh3:*:*:*:*:*:*:*:*"
],
"modules": [
"M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o"
],
"product": "SH3",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "0x5ea3o1f (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in SH3. This affects an unknown function of the component M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o. The manipulation leads to password hash with insufficient computational effort. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.0.2.0 mitigates this issue. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:N/AC:H/Au:M/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-916",
"description": "Password Hash With Insufficient Computational Effort",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-326",
"description": "Inadequate Encryption Strength",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T14:15:11.104Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426138 | SH3 M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o weak password hash",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/426138"
},
{
"name": "VDB-426138 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426138/cti"
},
{
"name": "CVE-2026-116054 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116054"
},
{
"name": "Submit #997072 | SH3 Inform\u00e1tica Ltda M\u00f3dulo de Gest\u00e3o, M\u00f3dulo de Arrecada\u00e7\u00e3o \u003c2026.0.2.0 Storing Passwords in a Recoverable Format",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/997072"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "https://medium.com/@warlleyfreire/sh3-public-management-system-stored-user-credentials-using-a-reversible-xor-based-mechanism-6aa3793804a2?postPublishedType=initial"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-24T23:35:43.000Z",
"value": "VulDB entry last update"
}
],
"title": "SH3 M\u00f3dulo de Gest\u00e3o/M\u00f3dulo de Arrecada\u00e7\u00e3o weak password hash",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116054",
"datePublished": "2026-10-25T14:15:11.104Z",
"dateReserved": "2026-10-24T21:30:36.601Z",
"dateUpdated": "2026-10-25T14:15:11.104Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116053 (GCVE-0-2026-116053)
Vulnerability from cvelistv5 – Published: 2026-10-25 13:30 – Updated: 2026-10-25 13:30
VLAI
EPSS
VEX
Title
dbcli mycli Whitelist source.py source_special_command_is_safe os command injection
Summary
A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function source_special_command_is_safe of the file mycli/packages/special/source.py of the component Whitelist. Executing a manipulation can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426137 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426137/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116053 | third-party-advisory |
| https://vuldb.com/submit/995818 | third-party-advisory |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dbcli:mycli:*:*:*:*:*:*:*:*"
],
"modules": [
"Whitelist"
],
"product": "mycli",
"vendor": "dbcli",
"versions": [
{
"status": "affected",
"version": "2.29.0"
},
{
"status": "affected",
"version": "2.29.1"
},
{
"status": "affected",
"version": "2.29.2"
},
{
"status": "affected",
"version": "2.29.3"
},
{
"status": "affected",
"version": "2.29.4"
},
{
"status": "affected",
"version": "2.30.0"
},
{
"status": "affected",
"version": "2.30.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function source_special_command_is_safe of the file mycli/packages/special/source.py of the component Whitelist. Executing a manipulation can lead to os command injection. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T13:30:09.456Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426137 | dbcli mycli Whitelist source.py source_special_command_is_safe os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426137"
},
{
"name": "VDB-426137 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426137/cti"
},
{
"name": "CVE-2026-116053 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116053"
},
{
"name": "Submit #995818 | dbcli mycli v2.25.3/ main @ b57e676 (as of 2026-09-23) mycli/packages/special/source.py whitelist asymmetry \u2192 persisten",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/995818"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-24T23:29:25.000Z",
"value": "VulDB entry last update"
}
],
"title": "dbcli mycli Whitelist source.py source_special_command_is_safe os command injection",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116053",
"datePublished": "2026-10-25T13:30:09.456Z",
"dateReserved": "2026-10-24T21:23:53.601Z",
"dateUpdated": "2026-10-25T13:30:09.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116186 (GCVE-0-2026-116186)
Vulnerability from cvelistv5 – Published: 2026-10-25 13:22 – Updated: 2026-10-25 13:22
VLAI
EPSS
VEX
Title
OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId
Summary
OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openremote/core/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/openremote-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openremote | core |
Affected:
0 , < 1.31.0
(semver)
Unaffected: 1.31.0 (semver) cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:* |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/io.openremote/openremote-manager",
"product": "core",
"vendor": "openremote",
"versions": [
{
"lessThan": "1.31.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.31.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Pig-Tail"
},
{
"lang": "en",
"type": "reporter",
"value": "hongshengy"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T13:22:10.154Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8pjc-wq2p-3xr4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openremote/core/security/advisories/GHSA-8pjc-wq2p-3xr4"
},
{
"name": "VulnCheck Advisory: OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openremote-before-1.31.0-gateway-authorization-bypass-via-reversible-mapassetid"
}
],
"title": "OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116186",
"datePublished": "2026-10-25T13:22:10.154Z",
"dateReserved": "2026-10-25T12:26:13.488Z",
"dateUpdated": "2026-10-25T13:22:10.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116185 (GCVE-0-2026-116185)
Vulnerability from cvelistv5 – Published: 2026-10-25 13:22 – Updated: 2026-10-25 13:22
VLAI
EPSS
VEX
Title
OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos
Summary
OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openremote/core/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/openremote-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openremote | core |
Affected:
0 , < 1.31.0
(semver)
Unaffected: 1.31.0 (semver) cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:* |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/io.openremote/openremote-manager",
"product": "core",
"vendor": "openremote",
"versions": [
{
"lessThan": "1.31.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.31.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Pig-Tail"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms\u0027 gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T13:22:09.474Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-p5wh-9wx4-w5f3)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openremote/core/security/advisories/GHSA-p5wh-9wx4-w5f3"
},
{
"name": "VulnCheck Advisory: OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openremote-before-1.31.0-cross-realm-information-disclosure-via-getgatewayactivetunnelinfos"
}
],
"title": "OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116185",
"datePublished": "2026-10-25T13:22:09.474Z",
"dateReserved": "2026-10-25T12:26:13.488Z",
"dateUpdated": "2026-10-25T13:22:09.474Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116184 (GCVE-0-2026-116184)
Vulnerability from cvelistv5 – Published: 2026-10-25 13:22 – Updated: 2026-10-25 13:22
VLAI
EPSS
VEX
Title
OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
Summary
OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openremote/core/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/openremote-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openremote | core |
Affected:
0 , < 1.31.0
(semver)
Unaffected: 1.31.0 (semver) cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:* |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/io.openremote/openremote-manager",
"product": "core",
"vendor": "openremote",
"versions": [
{
"lessThan": "1.31.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.31.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "richturner"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm\u0027s gateway ID to overwrite its descendant assets and open SSH tunnels into its local network."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T13:22:08.792Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2j4x-qh6q-q8mm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openremote/core/security/advisories/GHSA-2j4x-qh6q-q8mm"
},
{
"name": "VulnCheck Advisory: OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openremote-before-1.31.0-cross-realm-gateway-impersonation-via-websocket"
}
],
"title": "OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116184",
"datePublished": "2026-10-25T13:22:08.792Z",
"dateReserved": "2026-10-25T12:26:13.488Z",
"dateUpdated": "2026-10-25T13:22:08.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116211 (GCVE-0-2026-116211)
Vulnerability from cvelistv5 – Published: 2026-10-25 13:20 – Updated: 2026-10-25 13:20
VLAI
EPSS
VEX
Title
YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create
Summary
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes.
Severity
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/YesWiki/yeswiki/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/yeswiki-4.5.… | third-party-advisory |
Impacted products
Date Public
2026-10-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "yeswiki",
"vendor": "YesWiki",
"versions": [
{
"lessThan": "4.7.0",
"status": "affected",
"version": "4.5.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.0",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-use"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T13:20:38.819Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wjf7-hrf3-9gcx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wjf7-hrf3-9gcx"
},
{
"name": "VulnCheck Advisory: YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/yeswiki-4.5.0-before-4.7.0-sql-injection-via-date-maj-fiche-in-bazar-entry-create"
}
],
"title": "YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116211",
"datePublished": "2026-10-25T13:20:38.819Z",
"dateReserved": "2026-10-25T12:28:44.091Z",
"dateUpdated": "2026-10-25T13:20:38.819Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116208 (GCVE-0-2026-116208)
Vulnerability from cvelistv5 – Published: 2026-10-25 13:20 – Updated: 2026-10-25 13:20
VLAI
EPSS
VEX
Title
YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts
Summary
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/YesWiki/yeswiki/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/yeswiki-4.6.… | third-party-advisory |
Impacted products
Date Public
2026-10-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "yeswiki",
"vendor": "YesWiki",
"versions": [
{
"lessThan": "4.7.0",
"status": "affected",
"version": "4.6.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.0",
"versionStartIncluding": "4.6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-use"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors\u0027 mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T13:20:38.152Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cr64-h6xp-9g2j)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cr64-h6xp-9g2j"
},
{
"name": "VulnCheck Advisory: YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/yeswiki-4.6.2-before-4.7.0-missing-authorization-in-activitypub-syncactorposts"
}
],
"title": "YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116208",
"datePublished": "2026-10-25T13:20:38.152Z",
"dateReserved": "2026-10-25T12:27:58.644Z",
"dateUpdated": "2026-10-25T13:20:38.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116207 (GCVE-0-2026-116207)
Vulnerability from cvelistv5 – Published: 2026-10-25 13:20 – Updated: 2026-10-25 13:20
VLAI
EPSS
VEX
Title
YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
Summary
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().
Severity
9.1 (Critical)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/YesWiki/yeswiki/security/advis… | vendor-advisory |
| https://github.com/YesWiki/yeswiki/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/yeswiki-4.6.… | third-party-advisory |
Impacted products
Date Public
2026-10-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "yeswiki",
"vendor": "YesWiki",
"versions": [
{
"lessThan": "4.7.0",
"status": "affected",
"version": "4.6.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.7.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "yeswiki",
"vendor": "YesWiki",
"versions": [
{
"lessThan": "5.0.0-alpha4",
"status": "affected",
"version": "5.0.0-alpha1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.0.0-alpha4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.0",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.0.0-alpha4",
"versionStartIncluding": "5.0.0-alpha1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-pi"
},
{
"lang": "en",
"type": "reporter",
"value": "manus-use"
},
{
"lang": "en",
"type": "reporter",
"value": "bp0lr"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP()."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-25T13:20:37.473Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-ccp2-6q93-hggh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh"
},
{
"name": "GitHub Security Advisory (GHSA-hgxv-w4r8-8877)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hgxv-w4r8-8877"
},
{
"name": "VulnCheck Advisory: YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/yeswiki-4.6.0-before-4.7.0-sql-injection-via-bazar-entries-search-api"
}
],
"title": "YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116207",
"datePublished": "2026-10-25T13:20:37.473Z",
"dateReserved": "2026-10-25T12:27:58.644Z",
"dateUpdated": "2026-10-25T13:20:37.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}