Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-71519 (GCVE-0-2026-71519)

Vulnerability from cvelistv5 – Published: 2026-11-13 22:33 – Updated: 2026-11-13 22:33 X_Open Source

Title

PrestaShop Webservice API Broken Access Control via Customer Endpoint

Summary

PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API key holder to read and modify customer records belonging to any shop in a multi-shop installation. Attackers can exploit the missing record-level shop ownership check in shopHasRight() and saveEntityFromXml() to read sensitive customer data such as password hashes and secure keys, and change a customer's email and password via create, update, and delete requests, resulting in account takeover.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/PrestaShop/PrestaShop/security…	vendor-advisory
https://github.com/PrestaShop/PrestaShop/releases…	release-notespatch
https://github.com/PrestaShop/PrestaShop/releases…	release-notespatch
https://www.vulncheck.com/advisories/prestashop-w…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
PrestaShop	PrestaShop	Affected: 0 , < 8.2.9 (semver) Affected: 9.0.0 , < 9.2.1 (semver)

Date Public

2026-11-09 00:00

Credits

CodeAnt AI Security Research Team boo-code Gurvir Bajwa

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/PrestaShop/PrestaShop",
          "product": "PrestaShop",
          "repo": "https://github.com/PrestaShop/PrestaShop",
          "vendor": "PrestaShop",
          "versions": [
            {
              "lessThan": "8.2.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.2.1",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "CodeAnt AI Security Research Team"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "boo-code"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Gurvir Bajwa"
        }
      ],
      "datePublic": "2026-11-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API key holder to read and modify customer records belonging to any shop in a multi-shop installation. Attackers can exploit the missing record-level shop ownership check in shopHasRight() and saveEntityFromXml() to read sensitive customer data such as password hashes and secure keys, and change a customer\u0027s email and password via create, update, and delete requests, resulting in account takeover."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T22:33:25.305Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-hjwq-7qvv-qxj4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hjwq-7qvv-qxj4"
        },
        {
          "name": "9.2.1 Release Tag",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/PrestaShop/PrestaShop/releases/tag/9.2.1"
        },
        {
          "name": "8.2.9 Release Tag",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.9"
        },
        {
          "name": "VulnCheck Advisory: PrestaShop Webservice API Authorization Bypass via id_shop Parameter",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/prestashop-webservice-api-authorization-bypass-via-id-shop-parameter"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "PrestaShop Webservice API Broken Access Control via Customer Endpoint",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-71519",
    "datePublished": "2026-11-13T22:33:25.305Z",
    "dateReserved": "2026-08-06T20:42:17.835Z",
    "dateUpdated": "2026-11-13T22:33:25.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-71531 (GCVE-0-2026-71531)

Vulnerability from cvelistv5 – Published: 2026-11-13 22:32 – Updated: 2026-11-13 22:32 X_Open Source

Title

PrestaShop Webservice API Authorization Bypass via id_shop Parameter

Summary

PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key restricted to one shop to act on data of every shop by submitting requests with id_shop=all or id_shop_group=N, which expand the shop context without validating the key's actual shop associations and cause shopHasRight() to evaluate the expanded set as a disjunction. Attackers can exploit this flaw via classes/webservice/WebserviceRequest.php to read, modify, or delete data belonging to shops they are not authorized for, including full customer records such as email addresses, secure_key, and password hashes across the installation.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/PrestaShop/PrestaShop/security…	vendor-advisory
https://github.com/PrestaShop/PrestaShop/releases…	release-notespatch
https://github.com/PrestaShop/PrestaShop/releases…	release-notespatch
https://www.vulncheck.com/advisories/prestashop-w…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
PrestaShop	PrestaShop	Affected: 0 , < 8.2.9 (semver) Affected: 9.0.0 , < 9.2.1 (semver)

Date Public

2026-11-09 00:00

Credits

CodeAnt AI Security Research Team Sakil Ahamed Gayen Gurvir Bajwa

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/PrestaShop/PrestaShop",
          "product": "PrestaShop",
          "repo": "https://github.com/PrestaShop/PrestaShop",
          "vendor": "PrestaShop",
          "versions": [
            {
              "lessThan": "8.2.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.2.1",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "CodeAnt AI Security Research Team"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Sakil Ahamed Gayen"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Gurvir Bajwa"
        }
      ],
      "datePublic": "2026-11-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key restricted to one shop to act on data of every shop by submitting requests with id_shop=all or id_shop_group=N, which expand the shop context without validating the key\u0027s actual shop associations and cause shopHasRight() to evaluate the expanded set as a disjunction. Attackers can exploit this flaw via classes/webservice/WebserviceRequest.php to read, modify, or delete data belonging to shops they are not authorized for, including full customer records such as email addresses, secure_key, and password hashes across the installation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T22:32:06.723Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-3f36-4qv4-vfgh)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3f36-4qv4-vfgh"
        },
        {
          "name": "9.2.1 Release Tag",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/PrestaShop/PrestaShop/releases/tag/9.2.1"
        },
        {
          "name": "8.2.9 Release Tag",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.9"
        },
        {
          "name": "VulnCheck Advisory: PrestaShop Webservice API Authorization Bypass via id_shop Parameter",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/prestashop-webservice-api-authorization-bypass-via-id-shop-parameter"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "PrestaShop Webservice API Authorization Bypass via id_shop Parameter",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-71531",
    "datePublished": "2026-11-13T22:32:06.723Z",
    "dateReserved": "2026-08-06T20:42:17.836Z",
    "dateUpdated": "2026-11-13T22:32:06.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124021 (GCVE-0-2026-124021)

Vulnerability from cvelistv5 – Published: 2026-11-13 21:43 – Updated: 2026-11-13 21:43

Title

Control Web Panel < 1.30.6 Authorization Bypass via oauth_authorization_codes

Summary

Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid remote-API authorization without a proper API key. Attackers can exploit this flaw via the POST /cronjobsusers/ endpoint to add arbitrary cron commands and achieve command execution as the affected hosting account, and can also abuse the same token to access global account-list and account-detail routes exposing usernames, contact emails, and password hashes.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

2 references

URL	Tags
https://control-webpanel.com/changelog	release-notespatch
https://www.vulncheck.com/advisories/control-web-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Control Web Panel	Control Web Panel	Affected: 0 , < 1.30.6 (semver)

Date Public

2026-11-10 00:00

Credits

Valentin Lobstein (Chocapikk)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Control Web Panel",
          "vendor": "Control Web Panel",
          "versions": [
            {
              "lessThan": "1.30.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Valentin Lobstein (Chocapikk)"
        }
      ],
      "datePublic": "2026-11-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid remote-API authorization without a proper API key. Attackers can exploit this flaw via the POST /cronjobsusers/ endpoint to add arbitrary cron commands and achieve command execution as the affected hosting account, and can also abuse the same token to access global account-list and account-detail routes exposing usernames, contact emails, and password hashes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T21:43:13.762Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "CWP Changelog",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://control-webpanel.com/changelog"
        },
        {
          "name": "VulnCheck Advisory: Control Web Panel \u003c 1.30.6 Authorization Bypass via oauth_authorization_codes",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/control-web-panel-authorization-bypass-via-oauth-authorization-codes"
        }
      ],
      "title": "Control Web Panel \u003c 1.30.6 Authorization Bypass via oauth_authorization_codes",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124021",
    "datePublished": "2026-11-13T21:43:13.762Z",
    "dateReserved": "2026-11-06T18:38:38.544Z",
    "dateUpdated": "2026-11-13T21:43:13.762Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124020 (GCVE-0-2026-124020)

Vulnerability from cvelistv5 – Published: 2026-11-13 21:43 – Updated: 2026-11-13 21:43

Title

Control Web Panel < 1.30.6 Host Header Password Reset Poisoning

Summary

Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token generation process. Attackers can lure an automated mail-security scanner into visiting the poisoned reset link to exfiltrate the live recovery token, replay it at /login/index.php?acc=newpass to set a new password, and subsequently abuse the File Manager and Crontab modules to achieve command execution as the targeted hosting account.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

2 references

URL	Tags
https://control-webpanel.com/changelog	release-notespatch
https://www.vulncheck.com/advisories/control-web-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Control Web Panel	Control Web Panel	Affected: 0 , < 1.30.6 (semver)

Date Public

2026-11-10 00:00

Credits

Valentin Lobstein (Chocapikk)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Control Web Panel",
          "vendor": "Control Web Panel",
          "versions": [
            {
              "lessThan": "1.30.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Valentin Lobstein (Chocapikk)"
        }
      ],
      "datePublic": "2026-11-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route\u0027s token generation process. Attackers can lure an automated mail-security scanner into visiting the poisoned reset link to exfiltrate the live recovery token, replay it at /login/index.php?acc=newpass to set a new password, and subsequently abuse the File Manager and Crontab modules to achieve command execution as the targeted hosting account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-640",
              "description": "Weak Password Recovery Mechanism for Forgotten Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T21:43:00.963Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "CWP Changelog",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://control-webpanel.com/changelog"
        },
        {
          "name": "VulnCheck Advisory: Control Web Panel \u003c 1.30.6 Host Header Password Reset Poisoning",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/control-web-panel-host-header-password-reset-poisoning"
        }
      ],
      "title": "Control Web Panel \u003c 1.30.6 Host Header Password Reset Poisoning",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124020",
    "datePublished": "2026-11-13T21:43:00.963Z",
    "dateReserved": "2026-11-06T18:38:38.544Z",
    "dateUpdated": "2026-11-13T21:43:00.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9661 (GCVE-0-2026-9661)

Vulnerability from cvelistv5 – Published: 2026-11-13 21:40 – Updated: 2026-11-13 22:10

Title

Postecert FIRMAOK! 1.6.29 Local Privilege Escalation via OpenSSL Search Path

Summary

Poste Italiane Postecert FIRMAOK! 1.6.29 on Windows contains a local privilege escalation vulnerability caused by an uncontrolled OpenSSL search path, where launcher.exe and dependent executables such as updater.exe and tslupdater.exe load OpenSSL configuration and library files from a hardcoded, user-writable directory that does not exist by default. A low-privileged local attacker can create this missing directory and place malicious OpenSSL configuration or library files inside it, causing the application to load and execute attacker-controlled code with the privileges of the user running it, enabling horizontal or, when a higher-privileged user runs the application, vertical privilege escalation up to full system compromise.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-427 - Uncontrolled Search Path Element

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

4 references

URL	Tags
https://seclists.org/fulldisclosure/2026/Nov/14	technical-descriptionexploit
https://postecert.poste.it/firma/download.shtml	product
https://www.vulncheck.com/advisories/postecert-fi…	third-party-advisory
http://seclists.org/fulldisclosure/2026/Nov/14

Impacted products

1 product

Vendor	Product	Version
Poste Italiane	Postecert FIRMAOK!	Affected: 1.6.29 (semver)

Date Public

2026-11-13 00:00

Credits

Andrea Intilangelo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-11-13T22:10:14.165Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://seclists.org/fulldisclosure/2026/Nov/14"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Postecert FIRMAOK!",
          "vendor": "Poste Italiane",
          "versions": [
            {
              "status": "affected",
              "version": "1.6.29",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrea Intilangelo"
        }
      ],
      "datePublic": "2026-11-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Poste Italiane Postecert FIRMAOK! 1.6.29 on Windows contains a local privilege escalation vulnerability caused by an uncontrolled OpenSSL search path, where launcher.exe and dependent executables such as updater.exe and tslupdater.exe load OpenSSL configuration and library files from a hardcoded, user-writable directory that does not exist by default. A low-privileged local attacker can create this missing directory and place malicious OpenSSL configuration or library files inside it, causing the application to load and execute attacker-controlled code with the privileges of the user running it, enabling horizontal or, when a higher-privileged user runs the application, vertical privilege escalation up to full system compromise."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T21:41:13.780Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Researcher Disclosure",
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Nov/14"
        },
        {
          "name": "Product Download",
          "tags": [
            "product"
          ],
          "url": "https://postecert.poste.it/firma/download.shtml"
        },
        {
          "name": "VulnCheck Advisory: Postecert FIRMAOK! 1.6.29 Local Privilege Escalation via OpenSSL Search Path",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/postecert-firmaok-local-privilege-escalation-via-openssl-search-path"
        }
      ],
      "title": "Postecert FIRMAOK! 1.6.29 Local Privilege Escalation via OpenSSL Search Path",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-9661",
    "datePublished": "2026-11-13T21:40:35.827Z",
    "dateReserved": "2026-05-26T21:50:46.277Z",
    "dateUpdated": "2026-11-13T22:10:14.165Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127217 (GCVE-0-2026-127217)

Vulnerability from cvelistv5 – Published: 2026-11-13 21:03 – Updated: 2026-11-13 21:03 X_Open Source

Title

Post to Google My Business WordPress Plugin < 3.5.7 SSRF via Preview REST Route

Summary

Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability that allows authenticated users with Contributor-level privileges or higher to make the server send requests to arbitrary hosts by supplying an unvalidated mbp_post_attachment URL that reaches a raw getimagesize() call in validate_external_image_size() via the preview REST route. Attackers can exploit this to perform internal port scanning, probe internal-only services and cloud metadata endpoints, and trigger GET-based side effects on internal systems, bypassing network perimeter controls since the request originates from the web server.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

2 references

URL	Tags
https://wordpress.org/plugins/post-to-google-my-b…	release-notespatch
https://www.vulncheck.com/advisories/post-to-goog…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Koen Reus	Post to Google My Business (Google Business Profile)	Affected: 0 , < 3.5.7 (semver)

Date Public

2026-11-12 00:00

Credits

buiih

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Post to Google My Business (Google Business Profile)",
          "vendor": "Koen Reus",
          "versions": [
            {
              "lessThan": "3.5.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "buiih"
        }
      ],
      "datePublic": "2026-11-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability that allows authenticated users with Contributor-level privileges or higher to make the server send requests to arbitrary hosts by supplying an unvalidated mbp_post_attachment URL that reaches a raw getimagesize() call in validate_external_image_size() via the preview REST route. Attackers can exploit this to perform internal port scanning, probe internal-only services and cloud metadata endpoints, and trigger GET-based side effects on internal systems, bypassing network perimeter controls since the request originates from the web server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T21:03:19.812Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "WordPress Changelog",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://wordpress.org/plugins/post-to-google-my-business/#developers"
        },
        {
          "name": "VulnCheck Advisory: Post to Google My Business WordPress Plugin \u003c 3.5.7 SSRF via Preview REST Route",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/post-to-google-my-business-wordpress-plugin-ssrf-via-preview-rest-route"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "Post to Google My Business WordPress Plugin \u003c 3.5.7 SSRF via Preview REST Route",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127217",
    "datePublished": "2026-11-13T21:03:19.812Z",
    "dateReserved": "2026-11-12T16:30:10.904Z",
    "dateUpdated": "2026-11-13T21:03:19.812Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82504 (GCVE-0-2026-82504)

Vulnerability from cvelistv5 – Published: 2026-11-13 20:45 – Updated: 2026-11-13 20:45

Title

VITEC EZ TV Platform Server Unauthenticated File Upload via UploadHandler.ashx

Summary

VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no authentication or file type validation required. Attackers can upload a malicious ASPX file directly to the web-accessible uploads directory, where it is immediately executable by the web server, achieving remote code execution in the context of the web server process. Patches are available for versions 8.3.0, 8.3.1, 8.4.0, and 8.4.1. Users running releases prior to 8.3.0 should upgrade to 8.5.0+.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type
CWE-306 - Missing Authentication for Critical Function

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

2 references

URL	Tags
https://www.vitec.com/dl/vitec-ez-tv-platform-datasheet	product
https://www.vulncheck.com/advisories/vitec-ez-tv-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
VITEC	EZ TV Platform Server	Affected: 0 , < 8.5.0 (semver) Unaffected: 8.5.0 (semver)

Date Public

2026-11-13 00:00

Credits

Daly Whyte (Solusec Ltd)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "EZ TV Platform Server",
          "vendor": "VITEC",
          "versions": [
            {
              "lessThan": "8.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Daly Whyte (Solusec Ltd)"
        }
      ],
      "datePublic": "2026-11-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no authentication or file type validation required. Attackers can upload a malicious ASPX file directly to the web-accessible uploads directory, where it is immediately executable by the web server, achieving remote code execution in the context of the web server process. Patches are available for versions 8.3.0, 8.3.1, 8.4.0, and 8.4.1. Users running releases prior to 8.3.0 should upgrade to 8.5.0+."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T20:45:22.836Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "VITEC Product Document",
          "tags": [
            "product"
          ],
          "url": "https://www.vitec.com/dl/vitec-ez-tv-platform-datasheet"
        },
        {
          "name": "VulnCheck Advisory: VITEC EZ TV Platform Server Unauthenticated File Upload via UploadHandler.ashx",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/vitec-ez-tv-platform-server-unauthenticated-file-upload-via-uploadhandler-ashx"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "All customers on an EZ TV Platform Server Version prior to 8.5.0 should contact the Vitec Helpdesk immediately to schedule patch or upgrade."
        }
      ],
      "title": "VITEC EZ TV Platform Server Unauthenticated File Upload via UploadHandler.ashx",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-82504",
    "datePublished": "2026-11-13T20:45:22.836Z",
    "dateReserved": "2026-08-29T17:20:57.079Z",
    "dateUpdated": "2026-11-13T20:45:22.836Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127216 (GCVE-0-2026-127216)

Vulnerability from cvelistv5 – Published: 2026-11-13 20:41 – Updated: 2026-11-13 21:25 X_Open Source

Title

Injection Guard WordPress Plugin < 1.4.0 CSRF Password Hash Disclosure

Summary

Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to trigger password hash export by tricking a logged-in administrator into loading a crafted link, since the ig_settings admin page in templates/dashboard.php processes GET parameters without nonce verification. Attackers can exploit this to cause the plugin to write WooCommerce customer email hashes and password hashes to an unprotected file at wp-content/plugins/injection-guard/ab-hash.dat, which can then be downloaded without authentication to obtain customer password hashes for offline cracking.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 21:25 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

2 references

URL	Tags
https://wordpress.org/plugins/injection-guard/#de…	release-notespatch
https://www.vulncheck.com/advisories/injection-gu…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Fahad Mahmood	Injection Guard	Affected: 0 , < 1.4.0 (semver)

Date Public

2026-11-13 00:00

Credits

buiih

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T21:25:31.200782Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T21:25:38.595Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Injection Guard",
          "vendor": "Fahad Mahmood",
          "versions": [
            {
              "lessThan": "1.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "buiih"
        }
      ],
      "datePublic": "2026-11-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to trigger password hash export by tricking a logged-in administrator into loading a crafted link, since the ig_settings admin page in templates/dashboard.php processes GET parameters without nonce verification. Attackers can exploit this to cause the plugin to write WooCommerce customer email hashes and password hashes to an unprotected file at wp-content/plugins/injection-guard/ab-hash.dat, which can then be downloaded without authentication to obtain customer password hashes for offline cracking."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T20:41:10.804Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "WordPress Changelog",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://wordpress.org/plugins/injection-guard/#developers"
        },
        {
          "name": "VulnCheck Advisory: Injection Guard WordPress Plugin \u003c 1.4.0 CSRF Password Hash Disclosure",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/injection-guard-wordpress-plugin-csrf-password-hash-disclosure"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "Injection Guard WordPress Plugin \u003c 1.4.0 CSRF Password Hash Disclosure",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127216",
    "datePublished": "2026-11-13T20:41:10.804Z",
    "dateReserved": "2026-11-12T16:30:10.904Z",
    "dateUpdated": "2026-11-13T21:25:38.595Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89037 (GCVE-0-2026-89037)

Vulnerability from cvelistv5 – Published: 2026-11-13 20:26 – Updated: 2026-11-13 20:26 X_Open Source

Title

Dolibarr < 24.0.2 IDOR via Ticket Documents API

Summary

Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the ticket module that allows authenticated API users to access ticket attachments belonging to other companies by omitting a company-scope check that is only applied via a session variable set during public ticket authentication, which REST API authentication never sets. Attackers with ticket read permission can enumerate predictable ticket identifiers and supply them to the documents endpoint or download path to retrieve sensitive attachments such as invoices and contracts belonging to other third parties.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/Dolibarr/dolibarr/releases/tag…	release-notes
https://github.com/Dolibarr/dolibarr/commit/f815d…	patchissue-tracking
https://www.vulncheck.com/advisories/dolibarr-ido…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Dolibarr	dolibarr	Affected: 0 , < 24.0.2 (semver)

Date Public

2026-09-15 00:00

Credits

ThuongTPH

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/Dolibarr/dolibarr",
          "product": "dolibarr",
          "repo": "https://github.com/Dolibarr/dolibarr",
          "vendor": "Dolibarr",
          "versions": [
            {
              "lessThan": "24.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ThuongTPH"
        }
      ],
      "datePublic": "2026-09-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the ticket module that allows authenticated API users to access ticket attachments belonging to other companies by omitting a company-scope check that is only applied via a session variable set during public ticket authentication, which REST API authentication never sets. Attackers with ticket read permission can enumerate predictable ticket identifiers and supply them to the documents endpoint or download path to retrieve sensitive attachments such as invoices and contracts belonging to other third parties."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T20:26:25.327Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/Dolibarr/dolibarr/releases/tag/24.0.2"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/Dolibarr/dolibarr/commit/f815deb1c234168a69623101a26ae71f8c384c46"
        },
        {
          "name": "VulnCheck Advisory: Dolibarr \u003c 24.0.2 IDOR via Ticket Documents API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dolibarr-idor-via-ticket-documents-api"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "Dolibarr \u003c 24.0.2 IDOR via Ticket Documents API",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-89037",
    "datePublished": "2026-11-13T20:26:25.327Z",
    "dateReserved": "2026-09-10T16:23:54.472Z",
    "dateUpdated": "2026-11-13T20:26:25.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127215 (GCVE-0-2026-127215)

Vulnerability from cvelistv5 – Published: 2026-11-13 20:10 – Updated: 2026-11-13 20:10 X_Open Source

Title

Kanbanz WordPress Plugin < 1.0.3 Broken Access Control via admin-ajax Handlers

Summary

Kanbanz by Softaculous plugin for WordPress before 1.0.3 contains a broken access control vulnerability that allows authenticated Kanban Staff users to access and modify boards they are not members of by exploiting admin-ajax handlers that fail to call kanbanz_user_can_access_board() or per-task edit checks on attacker-supplied board_id or task_id parameters. Attackers can supply arbitrary board IDs to read sensitive task data, overwrite status columns, subtasks, and labels, inject comments, upload or delete attachments, and create tasks or set WIP limits on boards owned by other teams.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

2 references

URL	Tags
https://wordpress.org/plugins/kanbanz/#developers	release-notespatch
https://www.vulncheck.com/advisories/kanbanz-word…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Softaculous	Kanbanz	Affected: 0 , < 1.0.3 (semver)

Date Public

2026-11-13 00:00

Credits

buiih

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kanbanz",
          "vendor": "Softaculous",
          "versions": [
            {
              "lessThan": "1.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "buiih"
        }
      ],
      "datePublic": "2026-11-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Kanbanz by Softaculous plugin for WordPress before 1.0.3 contains a broken access control vulnerability that allows authenticated Kanban Staff users to access and modify boards they are not members of by exploiting admin-ajax handlers that fail to call kanbanz_user_can_access_board() or per-task edit checks on attacker-supplied board_id or task_id parameters. Attackers can supply arbitrary board IDs to read sensitive task data, overwrite status columns, subtasks, and labels, inject comments, upload or delete attachments, and create tasks or set WIP limits on boards owned by other teams."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T20:10:05.135Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "WordPress Plugin",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://wordpress.org/plugins/kanbanz/#developers"
        },
        {
          "name": "VulnCheck Advisory: Kanbanz WordPress Plugin \u003c 1.0.3 Broken Access Control via admin-ajax Handlers",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/kanbanz-wordpress-plugin-broken-access-control-via-admin-ajax-handlers"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "Kanbanz WordPress Plugin \u003c 1.0.3 Broken Access Control via admin-ajax Handlers",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127215",
    "datePublished": "2026-11-13T20:10:05.135Z",
    "dateReserved": "2026-11-12T16:30:10.903Z",
    "dateUpdated": "2026-11-13T20:10:05.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127214 (GCVE-0-2026-127214)

Vulnerability from cvelistv5 – Published: 2026-11-13 19:27 – Updated: 2026-11-13 19:27 Unsupported When Assigned X_Open Source

Title

Flowise 3.1.4 SSRF Bypass via Custom Function Sandbox

Summary

Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers with chatflows or agentflows create/update permissions to bypass the Custom Function sandbox's SSRF protection by requiring a module subpath inside an allowlisted package, such as axios/dist/node/axios.cjs or node-fetch/lib/index.js, which evades the vm2 mock table and returns an unwrapped HTTP client that skips the checkDenyList validation. Attackers can issue arbitrary GET and POST requests with attacker-controlled bodies via POST /api/v1/node-custom-function to reach loopback and internal-network addresses or the cloud metadata endpoint, enabling network mapping, credential disclosure, and state changes on internal services.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/soovwv/cve/blob/main/research/…	technical-descriptionexploit
https://www.vulncheck.com/advisories/flowise-ssrf…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
FlowiseAI	Flowise	Affected: 0 , ≤ 3.1.4 (semver)

Date Public

2026-11-10 00:00

Credits

soovwv

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/FlowiseAI/Flowise",
          "product": "Flowise",
          "repo": "https://github.com/FlowiseAI/Flowise",
          "vendor": "FlowiseAI",
          "versions": [
            {
              "lessThanOrEqual": "3.1.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "soovwv"
        }
      ],
      "datePublic": "2026-11-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers with chatflows or agentflows create/update permissions to bypass the Custom Function sandbox\u0027s SSRF protection by requiring a module subpath inside an allowlisted package, such as axios/dist/node/axios.cjs or node-fetch/lib/index.js, which evades the vm2 mock table and returns an unwrapped HTTP client that skips the checkDenyList validation. Attackers can issue arbitrary GET and POST requests with attacker-controlled bodies via POST /api/v1/node-custom-function to reach loopback and internal-network addresses or the cloud metadata endpoint, enabling network mapping, credential disclosure, and state changes on internal services."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T19:27:24.723Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Researcher Disclosure",
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://github.com/soovwv/cve/blob/main/research/flowise-ssrf-bypass-via-subpath-import.md"
        },
        {
          "name": "VulnCheck Advisory: Flowise 3.1.4 SSRF Bypass via Custom Function Sandbox",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/flowise-ssrf-bypass-via-custom-function-sandbox"
        }
      ],
      "tags": [
        "unsupported-when-assigned",
        "x_open-source"
      ],
      "title": "Flowise 3.1.4 SSRF Bypass via Custom Function Sandbox",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127214",
    "datePublished": "2026-11-13T19:27:24.723Z",
    "dateReserved": "2026-11-12T16:30:10.903Z",
    "dateUpdated": "2026-11-13T19:27:24.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127213 (GCVE-0-2026-127213)

Vulnerability from cvelistv5 – Published: 2026-11-13 19:18 – Updated: 2026-11-13 21:21 X_Open Source

Title

LearnPress Course Wishlist < 4.1.2 IDOR via render_button

Summary

LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to the render_button callback instead of relying on the session identity. Attackers can exploit the publicly accessible load_content_via_ajax REST route, which only requires a public wp_rest nonce, to add or remove courses from any user's wishlist and determine whether a given course is wishlisted by iterating user_id and course_id values.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 21:21 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

2 references

URL	Tags
https://wordpress.org/plugins/learnpress-wishlist…	release-notespatch
https://www.vulncheck.com/advisories/learnpress-c…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress – Course Wishlist	Affected: 0 , < 4.1.2 (semver)

Date Public

2026-11-11 00:00

Credits

xuannthanh buiih

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127213",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T21:21:35.095863Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T21:21:44.568Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 Course Wishlist",
          "vendor": "ThimPress",
          "versions": [
            {
              "lessThan": "4.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "xuannthanh"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "buiih"
        }
      ],
      "datePublic": "2026-11-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user\u0027s course wishlist by supplying an arbitrary user_id parameter to the render_button callback instead of relying on the session identity. Attackers can exploit the publicly accessible load_content_via_ajax REST route, which only requires a public wp_rest nonce, to add or remove courses from any user\u0027s wishlist and determine whether a given course is wishlisted by iterating user_id and course_id values."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T19:18:18.761Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "WordPress Changelog",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://wordpress.org/plugins/learnpress-wishlist/#developers"
        },
        {
          "name": "VulnCheck Advisory: LearnPress Course Wishlist \u003c 4.1.2 IDOR via render_button",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/learnpress-course-wishlist-idor-via-render-button"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "LearnPress Course Wishlist \u003c 4.1.2 IDOR via render_button",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127213",
    "datePublished": "2026-11-13T19:18:18.761Z",
    "dateReserved": "2026-11-12T16:30:10.903Z",
    "dateUpdated": "2026-11-13T21:21:44.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129139 (GCVE-0-2026-129139)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:22 – Updated: 2026-11-13 17:22

Title

paicoding commit b8206b9 through 903adce Predictable ZSXQ Account Credentials

Summary

paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account.

Severity

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-1391 - Use of Weak Credentials

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

5 references

URL	Tags
https://vul.yulun.ac.cn/20261112/paicoding/	third-party-advisory
https://github.com/itwanger/paicoding/issues/137	issue-tracking
https://github.com/itwanger/paicoding/blob/903adc…	technical-description
https://github.com/itwanger/paicoding/blob/903adc…	technical-description
https://www.vulncheck.com/advisories/paicoding-co…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
itwanger	paicoding	Affected: b8206b97cc504b939ca6fdc46e0a8c3e816b14e9 , ≤ 903adce70309d340f7eec51ec3c80cfe3c8326c1 (git)

Date Public

2026-11-12 05:41

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/itwanger/paicoding",
          "product": "paicoding",
          "repo": "https://github.com/itwanger/paicoding",
          "vendor": "itwanger",
          "versions": [
            {
              "lessThanOrEqual": "903adce70309d340f7eec51ec3c80cfe3c8326c1",
              "status": "affected",
              "version": "b8206b97cc504b939ca6fdc46e0a8c3e816b14e9",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-12T05:41:49.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member\u0027s ZSXQ number. Unauthenticated attackers can read that number from the victim\u0027s /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1391",
              "description": "Use of Weak Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:22:10.344Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261112/paicoding/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/itwanger/paicoding/issues/137"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-service/src/main/java/com/github/paicoding/forum/service/user/service/user/LoginServiceImpl.java#L244-L250"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-ui/src/main/resources/templates/views/user/info/edit.html#L81-L90"
        },
        {
          "name": "VulnCheck Advisory: paicoding commit b8206b9 through 903adce Predictable ZSXQ Account Credentials",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/paicoding-commit-b8206b9-through-903adce-predictable-zsxq-account-credentials"
        }
      ],
      "title": "paicoding commit b8206b9 through 903adce Predictable ZSXQ Account Credentials",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129139",
    "datePublished": "2026-11-13T17:22:10.344Z",
    "dateReserved": "2026-11-13T16:38:38.143Z",
    "dateUpdated": "2026-11-13T17:22:10.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129140 (GCVE-0-2026-129140)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:22 – Updated: 2026-11-13 17:22

Title

paicoding 1.0.0 through 1.0.3 Stored XSS via SVG Image Upload

Summary

paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageServiceImpl.validateStaticImg accepts SVG files, which are then served from the site origin when local storage is used. Authenticated attackers can upload script-bearing SVG images that execute when victims view them, stealing the non-HttpOnly f-session cookie to hijack accounts.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

4 references

URL	Tags
https://vul.yulun.ac.cn/20261112/paicoding/	third-party-advisory
https://github.com/itwanger/paicoding/issues/137	issue-tracking
https://github.com/itwanger/paicoding/blob/903adc…	technical-description
https://www.vulncheck.com/advisories/paicoding-1.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
itwanger	paicoding	Affected: 1.0.0 , ≤ 1.0.3 (semver) cpe:2.3:a:itwanger:paicoding::::::::

Date Public

2026-11-12 05:41

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/itwanger/paicoding",
          "product": "paicoding",
          "repo": "https://github.com/itwanger/paicoding",
          "vendor": "itwanger",
          "versions": [
            {
              "lessThanOrEqual": "1.0.3",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:itwanger:paicoding:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.0.3",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-12T05:41:49.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageServiceImpl.validateStaticImg accepts SVG files, which are then served from the site origin when local storage is used. Authenticated attackers can upload script-bearing SVG images that execute when victims view them, stealing the non-HttpOnly f-session cookie to hijack accounts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:22:09.670Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261112/paicoding/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/itwanger/paicoding/issues/137"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-service/src/main/java/com/github/paicoding/forum/service/image/service/ImageServiceImpl.java#L174-L180"
        },
        {
          "name": "VulnCheck Advisory: paicoding 1.0.0 through 1.0.3 Stored XSS via SVG Image Upload",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/paicoding-1.0.0-through-1.0.3-stored-xss-via-svg-image-upload"
        }
      ],
      "title": "paicoding 1.0.0 through 1.0.3 Stored XSS via SVG Image Upload",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129140",
    "datePublished": "2026-11-13T17:22:09.670Z",
    "dateReserved": "2026-11-13T16:38:46.048Z",
    "dateUpdated": "2026-11-13T17:22:09.670Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129141 (GCVE-0-2026-129141)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:22 – Updated: 2026-11-13 17:22

Title

paicoding 1.0.0 through 1.0.3 Stored XSS via JSON-LD Profile Description

Summary

paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user profile text without escaping in an inline JSON-LD script element. Authenticated attackers can add a closing script tag followed by HTML to their profile, executing scripts for visitors of their profile page and stealing the non-HttpOnly f-session cookie.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

5 references

URL	Tags
https://vul.yulun.ac.cn/20261112/paicoding/	third-party-advisory
https://github.com/itwanger/paicoding/issues/137	issue-tracking
https://github.com/itwanger/paicoding/blob/903adc…	technical-description
https://github.com/itwanger/paicoding/blob/903adc…	technical-description
https://www.vulncheck.com/advisories/paicoding-1.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
itwanger	paicoding	Affected: 1.0.0 , ≤ 1.0.3 (semver) cpe:2.3:a:itwanger:paicoding::::::::

Date Public

2026-11-12 05:41

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/itwanger/paicoding",
          "product": "paicoding",
          "repo": "https://github.com/itwanger/paicoding",
          "vendor": "itwanger",
          "versions": [
            {
              "lessThanOrEqual": "1.0.3",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:itwanger:paicoding:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.0.3",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-12T05:41:49.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user profile text without escaping in an inline JSON-LD script element. Authenticated attackers can add a closing script tag followed by HTML to their profile, executing scripts for visitors of their profile page and stealing the non-HttpOnly f-session cookie."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:22:08.971Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261112/paicoding/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/itwanger/paicoding/issues/137"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-ui/src/main/resources/templates/components/layout/header.html#L59"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-web/src/main/java/com/github/paicoding/forum/web/global/SeoInjectService.java#L386-L387"
        },
        {
          "name": "VulnCheck Advisory: paicoding 1.0.0 through 1.0.3 Stored XSS via JSON-LD Profile Description",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/paicoding-1.0.0-through-1.0.3-stored-xss-via-json-ld-profile-description"
        }
      ],
      "title": "paicoding 1.0.0 through 1.0.3 Stored XSS via JSON-LD Profile Description",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129141",
    "datePublished": "2026-11-13T17:22:08.971Z",
    "dateReserved": "2026-11-13T16:38:46.415Z",
    "dateUpdated": "2026-11-13T17:22:08.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129142 (GCVE-0-2026-129142)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:22 – Updated: 2026-11-13 21:20

Title

paicoding commit 766c48b through 903adce Stored XSS via Payment Notifications

Summary

paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author's browser when the author views notifications.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 21:19 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

5 references

URL	Tags
https://vul.yulun.ac.cn/20261112/paicoding/	third-party-advisory
https://github.com/itwanger/paicoding/issues/137	issue-tracking
https://github.com/itwanger/paicoding/blob/903adc…	technical-description
https://github.com/itwanger/paicoding/blob/903adc…	technical-description
https://www.vulncheck.com/advisories/paicoding-co…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
itwanger	paicoding	Affected: 766c48b39037970853af56f8d86dedbf7a8a2c1c , ≤ 903adce70309d340f7eec51ec3c80cfe3c8326c1 (git)

Date Public

2026-11-12 05:41

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-129142",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T21:19:55.030136Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T21:20:02.120Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/itwanger/paicoding",
          "product": "paicoding",
          "repo": "https://github.com/itwanger/paicoding",
          "vendor": "itwanger",
          "versions": [
            {
              "lessThanOrEqual": "903adce70309d340f7eec51ec3c80cfe3c8326c1",
              "status": "affected",
              "version": "766c48b39037970853af56f8d86dedbf7a8a2c1c",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-12T05:41:49.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer\u0027s display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author\u0027s browser when the author views notifications."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:22:08.201Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261112/paicoding/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/itwanger/paicoding/issues/137"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-service/src/main/java/com/github/paicoding/forum/service/notify/service/impl/NotifyMsgListener.java#L274-L288"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-ui/src/main/resources/templates/components/notice/notify-system-item.html#L18"
        },
        {
          "name": "VulnCheck Advisory: paicoding commit 766c48b through 903adce Stored XSS via Payment Notifications",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/paicoding-commit-766c48b-through-903adce-stored-xss-via-payment-notifications"
        }
      ],
      "title": "paicoding commit 766c48b through 903adce Stored XSS via Payment Notifications",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129142",
    "datePublished": "2026-11-13T17:22:08.201Z",
    "dateReserved": "2026-11-13T16:38:46.763Z",
    "dateUpdated": "2026-11-13T21:20:02.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129143 (GCVE-0-2026-129143)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:22 – Updated: 2026-11-13 17:22

Title

paicoding 1.0.3 Missing Authorization via Article Detail API Endpoint

Summary

paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/{articleId} to retrieve full content of paid, login-only, member-only and draft articles.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

4 references

URL	Tags
https://vul.yulun.ac.cn/20261112/paicoding/	third-party-advisory
https://github.com/itwanger/paicoding/issues/137	issue-tracking
https://github.com/itwanger/paicoding/blob/903adc…	technical-description
https://www.vulncheck.com/advisories/paicoding-1.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
itwanger	paicoding	Affected: 1.0.3 (semver) cpe:2.3:a:itwanger:paicoding:1.0.3:::::::*

Date Public

2026-11-12 05:41

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/itwanger/paicoding",
          "product": "paicoding",
          "repo": "https://github.com/itwanger/paicoding",
          "vendor": "itwanger",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:itwanger:paicoding:1.0.3:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-12T05:41:49.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/{articleId} to retrieve full content of paid, login-only, member-only and draft articles."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:22:07.496Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261112/paicoding/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/itwanger/paicoding/issues/137"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-web/src/main/java/com/github/paicoding/forum/web/front/article/rest/ArticleRestController.java#L87-L94"
        },
        {
          "name": "VulnCheck Advisory: paicoding 1.0.3 Missing Authorization via Article Detail API Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/paicoding-1.0.3-missing-authorization-via-article-detail-api-endpoint"
        }
      ],
      "title": "paicoding 1.0.3 Missing Authorization via Article Detail API Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129143",
    "datePublished": "2026-11-13T17:22:07.496Z",
    "dateReserved": "2026-11-13T16:38:47.120Z",
    "dateUpdated": "2026-11-13T17:22:07.496Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129144 (GCVE-0-2026-129144)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:22 – Updated: 2026-11-13 17:22

Title

paicoding 1.0.3 Payment Bypass via Guessable Codes in /article/api/pay/callback

Summary

paicoding 1.0.3 contains a payment bypass vulnerability that allows authenticated attackers to unlock paid articles by guessing weak payment confirmation codes. Attackers can start a payment, enumerate roughly 2000 IdUtil.genPayCode counter values, and submit the matching verifyCode to the unauthenticated callback to mark it paid.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-334 - Small Space of Random Values

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

5 references

URL	Tags
https://vul.yulun.ac.cn/20261112/paicoding/	third-party-advisory
https://github.com/itwanger/paicoding/issues/137	issue-tracking
https://github.com/itwanger/paicoding/blob/903adc…	technical-description
https://github.com/itwanger/paicoding/blob/903adc…	technical-description
https://www.vulncheck.com/advisories/paicoding-1.…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
itwanger	paicoding	Affected: 1.0.3 (semver) cpe:2.3:a:itwanger:paicoding:1.0.3:::::::*

Date Public

2026-11-12 05:41

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/itwanger/paicoding",
          "product": "paicoding",
          "repo": "https://github.com/itwanger/paicoding",
          "vendor": "itwanger",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:itwanger:paicoding:1.0.3:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-12T05:41:49.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "paicoding 1.0.3 contains a payment bypass vulnerability that allows authenticated attackers to unlock paid articles by guessing weak payment confirmation codes. Attackers can start a payment, enumerate roughly 2000 IdUtil.genPayCode counter values, and submit the matching verifyCode to the unauthenticated callback to mark it paid."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-334",
              "description": "Small Space of Random Values",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:22:06.792Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261112/paicoding/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/itwanger/paicoding/issues/137"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-core/src/main/java/com/github/paicoding/forum/core/util/id/IdUtil.java#L54-L61"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-web/src/main/java/com/github/paicoding/forum/web/front/article/rest/ArticlePayRestController.java#L79-L90"
        },
        {
          "name": "VulnCheck Advisory: paicoding 1.0.3 Payment Bypass via Guessable Codes in /article/api/pay/callback",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/paicoding-1.0.3-payment-bypass-via-guessable-codes-in-article-api-pay-callback"
        }
      ],
      "title": "paicoding 1.0.3 Payment Bypass via Guessable Codes in /article/api/pay/callback",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129144",
    "datePublished": "2026-11-13T17:22:06.792Z",
    "dateReserved": "2026-11-13T16:38:47.488Z",
    "dateUpdated": "2026-11-13T17:22:06.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129151 (GCVE-0-2026-129151)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:22 – Updated: 2026-11-13 17:22

Title

SurveyKing 1.13.2 Unauthenticated Survey Response Disclosure via Result Lookup

Summary

SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the lookup configuration, including its password, and the lookup password check is skipped when no answer is sent. Unauthenticated attackers with a public survey link can inject a % wildcard into the MyBatis LIKE condition to match all responses, then call loadProject with an answerId to read complete responses including hidden fields.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

6 references

URL	Tags
https://vul.yulun.ac.cn/20261107/surveyking/	third-party-advisory
https://github.com/javahuang/SurveyKing/issues/92	issue-tracking
https://github.com/javahuang/SurveyKing/blob/5de0…	technical-description
https://github.com/javahuang/SurveyKing/blob/5de0…	technical-description
https://github.com/javahuang/SurveyKing/blob/5de0…	technical-description
https://www.vulncheck.com/advisories/surveyking-1…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
javahuang	SurveyKing	Affected: 1.13.2 (semver) cpe:2.3:a:surveyking:surveyking:1.13.2:::::::*

Date Public

2026-11-07 00:00

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/javahuang/SurveyKing",
          "product": "SurveyKing",
          "repo": "https://github.com/javahuang/SurveyKing",
          "vendor": "javahuang",
          "versions": [
            {
              "status": "affected",
              "version": "1.13.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:surveyking:surveyking:1.13.2:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the lookup configuration, including its password, and the lookup password check is skipped when no answer is sent. Unauthenticated attackers with a public survey link can inject a % wildcard into the MyBatis LIKE condition to match all responses, then call loadProject with an answerId to read complete responses including hidden fields."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:22:06.088Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261107/surveyking/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/javahuang/SurveyKing/issues/92"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/SurveyServiceImpl.java#L937-L959"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/SurveyServiceImpl.java#L1085-L1096"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/domain/mapper/ProjectViewMapper.java#L30-L33"
        },
        {
          "name": "VulnCheck Advisory: SurveyKing 1.13.2 Unauthenticated Survey Response Disclosure via Result Lookup",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surveyking-1.13.2-unauthenticated-survey-response-disclosure-via-result-lookup"
        }
      ],
      "title": "SurveyKing 1.13.2 Unauthenticated Survey Response Disclosure via Result Lookup",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129151",
    "datePublished": "2026-11-13T17:22:06.088Z",
    "dateReserved": "2026-11-13T17:03:16.842Z",
    "dateUpdated": "2026-11-13T17:22:06.088Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129152 (GCVE-0-2026-129152)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:22 – Updated: 2026-11-13 21:13

Title

SurveyKing 1.12.0 through 1.13.2 Authentication Bypass via saveAnswer Response Submission

Summary

SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit responses to protected surveys and set createBy in the request body to impersonate other users, corrupting survey results.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 21:13 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

5 references

URL	Tags
https://vul.yulun.ac.cn/20261107/surveyking/	third-party-advisory
https://github.com/javahuang/SurveyKing/issues/92	issue-tracking
https://github.com/javahuang/SurveyKing/blob/5de0…	technical-description
https://github.com/javahuang/SurveyKing/blob/5de0…	technical-description
https://www.vulncheck.com/advisories/surveyking-1…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
javahuang	SurveyKing	Affected: 1.12.0 , ≤ 1.13.2 (semver) cpe:2.3:a:surveyking:surveyking::::::::

Date Public

2026-11-07 00:00

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-129152",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T21:13:04.156902Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T21:13:12.274Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/javahuang/SurveyKing",
          "product": "SurveyKing",
          "repo": "https://github.com/javahuang/SurveyKing",
          "vendor": "javahuang",
          "versions": [
            {
              "lessThanOrEqual": "1.13.2",
              "status": "affected",
              "version": "1.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:surveyking:surveyking:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.13.2",
                  "versionStartIncluding": "1.12.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit responses to protected surveys and set createBy in the request body to impersonate other users, corrupting survey results."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:22:05.248Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261107/surveyking/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/javahuang/SurveyKing/issues/92"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/AnswerServiceImpl.java#L216-L230"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/SurveyServiceImpl.java#L226-L236"
        },
        {
          "name": "VulnCheck Advisory: SurveyKing 1.12.0 through 1.13.2 Authentication Bypass via saveAnswer Response Submission",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surveyking-1.12.0-through-1.13.2-authentication-bypass-via-saveanswer-response-submission"
        }
      ],
      "title": "SurveyKing 1.12.0 through 1.13.2 Authentication Bypass via saveAnswer Response Submission",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129152",
    "datePublished": "2026-11-13T17:22:05.248Z",
    "dateReserved": "2026-11-13T17:03:17.186Z",
    "dateUpdated": "2026-11-13T21:13:12.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129153 (GCVE-0-2026-129153)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:22 – Updated: 2026-11-13 17:22

Title

SurveyKing 1.12.0 through 1.13.2 Authorization Bypass via Linked Survey linkSurveyId

Summary

SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller's own project. Authenticated attackers can point a linked option at another user's survey so that loadLinkResult and updateLinkSurveyAnswer read, rewrite, or create responses in that survey.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

5 references

URL	Tags
https://vul.yulun.ac.cn/20261107/surveyking/	third-party-advisory
https://github.com/javahuang/SurveyKing/issues/92	issue-tracking
https://github.com/javahuang/SurveyKing/blob/5de0…	technical-description
https://github.com/javahuang/SurveyKing/blob/5de0…	technical-description
https://www.vulncheck.com/advisories/surveyking-1…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
javahuang	SurveyKing	Affected: 1.12.0 , ≤ 1.13.2 (semver) cpe:2.3:a:surveyking:surveyking::::::::

Date Public

2026-11-07 00:00

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/javahuang/SurveyKing",
          "product": "SurveyKing",
          "repo": "https://github.com/javahuang/SurveyKing",
          "vendor": "javahuang",
          "versions": [
            {
              "lessThanOrEqual": "1.13.2",
              "status": "affected",
              "version": "1.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:surveyking:surveyking:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.13.2",
                  "versionStartIncluding": "1.12.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller\u0027s own project. Authenticated attackers can point a linked option at another user\u0027s survey so that loadLinkResult and updateLinkSurveyAnswer read, rewrite, or create responses in that survey."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:22:04.571Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261107/surveyking/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/javahuang/SurveyKing/issues/92"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/SurveyServiceImpl.java#L435-L470"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/AnswerServiceImpl.java#L793-L830"
        },
        {
          "name": "VulnCheck Advisory: SurveyKing 1.12.0 through 1.13.2 Authorization Bypass via Linked Survey linkSurveyId",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surveyking-1.12.0-through-1.13.2-authorization-bypass-via-linked-survey-linksurveyid"
        }
      ],
      "title": "SurveyKing 1.12.0 through 1.13.2 Authorization Bypass via Linked Survey linkSurveyId",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129153",
    "datePublished": "2026-11-13T17:22:04.571Z",
    "dateReserved": "2026-11-13T17:03:17.537Z",
    "dateUpdated": "2026-11-13T17:22:04.571Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129154 (GCVE-0-2026-129154)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:22 – Updated: 2026-11-13 17:22

Title

SurveyKing 1.13.0 through 1.13.2 Stored XSS via Response Survey Snapshot

Summary

SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a respondent-supplied survey snapshot and the frontend renders its titles via innerHTML. Anonymous respondents can submit a forged snapshot embedding event handlers such as img onerror that execute in an administrator's browser session when the response is viewed.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

4 references

URL	Tags
https://vul.yulun.ac.cn/20261107/surveyking/	third-party-advisory
https://github.com/javahuang/SurveyKing/issues/92	issue-tracking
https://github.com/javahuang/SurveyKing/blob/5de0…	technical-description
https://www.vulncheck.com/advisories/surveyking-1…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
javahuang	SurveyKing	Affected: 1.13.0 , ≤ 1.13.2 (semver) cpe:2.3:a:surveyking:surveyking::::::::

Date Public

2026-11-07 00:00

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/javahuang/SurveyKing",
          "product": "SurveyKing",
          "repo": "https://github.com/javahuang/SurveyKing",
          "vendor": "javahuang",
          "versions": [
            {
              "lessThanOrEqual": "1.13.2",
              "status": "affected",
              "version": "1.13.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:surveyking:surveyking:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.13.2",
                  "versionStartIncluding": "1.13.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a respondent-supplied survey snapshot and the frontend renders its titles via innerHTML. Anonymous respondents can submit a forged snapshot embedding event handlers such as img onerror that execute in an administrator\u0027s browser session when the response is viewed."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:22:03.885Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261107/surveyking/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/javahuang/SurveyKing/issues/92"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/AnswerServiceImpl.java#L728-L737"
        },
        {
          "name": "VulnCheck Advisory: SurveyKing 1.13.0 through 1.13.2 Stored XSS via Response Survey Snapshot",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surveyking-1.13.0-through-1.13.2-stored-xss-via-response-survey-snapshot"
        }
      ],
      "title": "SurveyKing 1.13.0 through 1.13.2 Stored XSS via Response Survey Snapshot",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129154",
    "datePublished": "2026-11-13T17:22:03.885Z",
    "dateReserved": "2026-11-13T17:03:17.896Z",
    "dateUpdated": "2026-11-13T17:22:03.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129155 (GCVE-0-2026-129155)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:22 – Updated: 2026-11-13 17:22

Title

DjangoBlog 2.0.0.0 through 2.1.0.0 Stored XSS via Comment Sanitizer class_filter

Summary

DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter comment sanitizer passes event-handler attributes on span, div, pre and code tags. Authenticated commenters can post a div with autofocus and onfocus attributes, executing script without interaction for every visitor, including administrators.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

5 references

URL	Tags
https://vul.yulun.ac.cn/20261101/djangoblog/	third-party-advisory
https://github.com/liangliangyy/DjangoBlog/issues/1030	issue-tracking
https://github.com/liangliangyy/DjangoBlog/blob/5…	technical-description
https://github.com/liangliangyy/DjangoBlog/blob/5…	technical-description
https://www.vulncheck.com/advisories/djangoblog-2…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
liangliangyy	DjangoBlog	Affected: 2.0.0.0 , ≤ 2.1.0.0 (custom)

Date Public

2026-11-01 00:00

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/liangliangyy/DjangoBlog",
          "product": "DjangoBlog",
          "repo": "https://github.com/liangliangyy/DjangoBlog",
          "vendor": "liangliangyy",
          "versions": [
            {
              "lessThanOrEqual": "2.1.0.0",
              "status": "affected",
              "version": "2.0.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter comment sanitizer passes event-handler attributes on span, div, pre and code tags. Authenticated commenters can post a div with autofocus and onfocus attributes, executing script without interaction for every visitor, including administrators."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:22:03.144Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261101/djangoblog/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/liangliangyy/DjangoBlog/issues/1030"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/liangliangyy/DjangoBlog/blob/55655f236308841e0e83f5b383b1c2056a0fb48c/djangoblog/utils.py#L248-L269"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/liangliangyy/DjangoBlog/blob/55655f236308841e0e83f5b383b1c2056a0fb48c/blog/templatetags/blog_tags.py#L138-L141"
        },
        {
          "name": "VulnCheck Advisory: DjangoBlog 2.0.0.0 through 2.1.0.0 Stored XSS via Comment Sanitizer class_filter",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/djangoblog-2.0.0.0-through-2.1.0.0-stored-xss-via-comment-sanitizer-class-filter"
        }
      ],
      "title": "DjangoBlog 2.0.0.0 through 2.1.0.0 Stored XSS via Comment Sanitizer class_filter",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129155",
    "datePublished": "2026-11-13T17:22:03.144Z",
    "dateReserved": "2026-11-13T17:03:18.247Z",
    "dateUpdated": "2026-11-13T17:22:03.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129156 (GCVE-0-2026-129156)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:22 – Updated: 2026-11-13 21:14

Title

DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactions

Summary

DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors' browsers.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 21:14 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

6 references

URL	Tags
https://vul.yulun.ac.cn/20261101/djangoblog/	third-party-advisory
https://github.com/liangliangyy/DjangoBlog/issues/1030	issue-tracking
https://github.com/liangliangyy/DjangoBlog/blob/6…	technical-description
https://github.com/liangliangyy/DjangoBlog/blob/6…	technical-description
https://github.com/liangliangyy/DjangoBlog/blob/6…	technical-description
https://www.vulncheck.com/advisories/djangoblog-c…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
liangliangyy	DjangoBlog	Affected: d186b1c53bac400a0c8a840f62a121d59880fe97 , ≤ 6134ed63079de676b271af31de4dd40264d17c52 (git)

Date Public

2026-11-01 00:00

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-129156",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T21:14:38.744689Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T21:14:46.139Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/liangliangyy/DjangoBlog",
          "product": "DjangoBlog",
          "repo": "https://github.com/liangliangyy/DjangoBlog",
          "vendor": "liangliangyy",
          "versions": [
            {
              "lessThanOrEqual": "6134ed63079de676b271af31de4dd40264d17c52",
              "status": "affected",
              "version": "d186b1c53bac400a0c8a840f62a121d59880fe97",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors\u0027 browsers."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:22:02.375Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261101/djangoblog/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/liangliangyy/DjangoBlog/issues/1030"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/oauth/views.py#L102-L112"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/templates/comments/tags/comment_item_modern.html#L76"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/blog/templatetags/blog_tags.py#L162-L164"
        },
        {
          "name": "VulnCheck Advisory: DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactions",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/djangoblog-commit-d186b1c-through-6134ed6-stored-xss-via-comment-reactions"
        }
      ],
      "title": "DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactions",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129156",
    "datePublished": "2026-11-13T17:22:02.375Z",
    "dateReserved": "2026-11-13T17:03:18.564Z",
    "dateUpdated": "2026-11-13T21:14:46.139Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129157 (GCVE-0-2026-129157)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:21 – Updated: 2026-11-13 17:21

Title

ragent 1.0.0 through 1.1.0 Missing Authorization via /rag/traces/runs

Summary

ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

5 references

URL	Tags
https://vul.yulun.ac.cn/20261104/ragent/	third-party-advisory
https://github.com/nageoffer/ragent/issues/186	issue-tracking
https://github.com/nageoffer/ragent/blob/f64de341…	technical-description
https://github.com/nageoffer/ragent/blob/f64de341…	technical-description
https://www.vulncheck.com/advisories/ragent-1.0.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nageoffer	ragent	Affected: 1.0.0 , ≤ 1.1.0 (semver)

Date Public

2026-11-04 00:00

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/nageoffer/ragent",
          "product": "ragent",
          "repo": "https://github.com/nageoffer/ragent",
          "vendor": "nageoffer",
          "versions": [
            {
              "lessThanOrEqual": "1.1.0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users\u0027 RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users\u0027 usernames, user ids, conversation ids, questions, and per-node execution details."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:21:59.837Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261104/ragent/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nageoffer/ragent/issues/186"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nageoffer/ragent/blob/f64de341452c8998ebf64cd264e60ccad6a31631/bootstrap/src/main/java/com/nageoffer/ai/ragent/rag/controller/RagTraceController.java#L40-L66"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nageoffer/ragent/blob/f64de341452c8998ebf64cd264e60ccad6a31631/bootstrap/src/main/java/com/nageoffer/ai/ragent/rag/service/impl/RagTraceQueryServiceImpl.java#L59-L76"
        },
        {
          "name": "VulnCheck Advisory: ragent 1.0.0 through 1.1.0 Missing Authorization via /rag/traces/runs",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ragent-1.0.0-through-1.1.0-missing-authorization-via-rag-traces-runs"
        }
      ],
      "title": "ragent 1.0.0 through 1.1.0 Missing Authorization via /rag/traces/runs",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129157",
    "datePublished": "2026-11-13T17:21:59.837Z",
    "dateReserved": "2026-11-13T17:03:18.951Z",
    "dateUpdated": "2026-11-13T17:21:59.837Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129158 (GCVE-0-2026-129158)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:21 – Updated: 2026-11-13 17:21

Title

ragent 1.1.0 Stored XSS via SVG Knowledge-Base Document Upload

Summary

ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading SVG knowledge-base documents served inline as image/svg+xml. Attackers can upload a script-bearing SVG via /knowledge-base/{kb-id}/docs/upload so that victims opening /knowledge-base/docs/{docId}/file execute it in the application origin, enabling account takeover.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

5 references

URL	Tags
https://vul.yulun.ac.cn/20261104/ragent/	third-party-advisory
https://github.com/nageoffer/ragent/issues/187	issue-tracking
https://github.com/nageoffer/ragent/blob/f64de341…	technical-description
https://github.com/nageoffer/ragent/blob/f64de341…	technical-description
https://www.vulncheck.com/advisories/ragent-1.1.0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
nageoffer	ragent	Affected: 1.1.0 (semver)

Date Public

2026-11-04 00:00

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/nageoffer/ragent",
          "product": "ragent",
          "repo": "https://github.com/nageoffer/ragent",
          "vendor": "nageoffer",
          "versions": [
            {
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-11-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading SVG knowledge-base documents served inline as image/svg+xml. Attackers can upload a script-bearing SVG via /knowledge-base/{kb-id}/docs/upload so that victims opening /knowledge-base/docs/{docId}/file execute it in the application origin, enabling account takeover."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:21:59.004Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261104/ragent/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/nageoffer/ragent/issues/187"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nageoffer/ragent/blob/f64de341452c8998ebf64cd264e60ccad6a31631/bootstrap/src/main/java/com/nageoffer/ai/ragent/knowledge/controller/KnowledgeDocumentController.java#L71-L82"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/nageoffer/ragent/blob/f64de341452c8998ebf64cd264e60ccad6a31631/bootstrap/src/main/java/com/nageoffer/ai/ragent/knowledge/controller/KnowledgeDocumentController.java#L187-L198"
        },
        {
          "name": "VulnCheck Advisory: ragent 1.1.0 Stored XSS via SVG Knowledge-Base Document Upload",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ragent-1.1.0-stored-xss-via-svg-knowledge-base-document-upload"
        }
      ],
      "title": "ragent 1.1.0 Stored XSS via SVG Knowledge-Base Document Upload",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129158",
    "datePublished": "2026-11-13T17:21:59.004Z",
    "dateReserved": "2026-11-13T17:03:19.290Z",
    "dateUpdated": "2026-11-13T17:21:59.004Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129160 (GCVE-0-2026-129160)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:21 – Updated: 2026-11-13 17:21

Title

Dromara free-fs 2.0.1 through 2.3.1 SQL Injection via orderBy Parameter

Summary

free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subquery expressions that use share ordering as a boolean oracle to read arbitrary database contents, such as share codes.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

4 references

URL	Tags
https://vul.yulun.ac.cn/20261024/free-fs/	third-party-advisory
https://github.com/dromara/free-fs/issues/28	issue-tracking
https://github.com/dromara/free-fs/blob/f8f4ff2a0…	technical-description
https://www.vulncheck.com/advisories/dromara-free…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
dromara	free-fs	Affected: 2.0.1 , ≤ 2.3.1 (semver)

Date Public

2026-10-24 00:00

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/dromara/free-fs",
          "product": "free-fs",
          "repo": "https://github.com/dromara/free-fs",
          "vendor": "dromara",
          "versions": [
            {
              "lessThanOrEqual": "2.3.1",
              "status": "affected",
              "version": "2.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-10-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subquery expressions that use share ordering as a boolean oracle to read arbitrary database contents, such as share codes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:21:58.167Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261024/free-fs/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/dromara/free-fs/issues/28"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dromara/free-fs/blob/f8f4ff2a0b0af8fcd5cbecbf99a4afb7d0b7c020/fs-modules/fs-file/src/main/java/com/xddcodec/fs/file/service/impl/FileShareServiceImpl.java#L93-L99"
        },
        {
          "name": "VulnCheck Advisory: Dromara free-fs 2.0.1 through 2.3.1 SQL Injection via orderBy Parameter",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dromara-free-fs-2.0.1-through-2.3.1-sql-injection-via-orderby-parameter"
        }
      ],
      "title": "Dromara free-fs 2.0.1 through 2.3.1 SQL Injection via orderBy Parameter",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129160",
    "datePublished": "2026-11-13T17:21:58.167Z",
    "dateReserved": "2026-11-13T17:09:08.630Z",
    "dateUpdated": "2026-11-13T17:21:58.167Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129161 (GCVE-0-2026-129161)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:21 – Updated: 2026-11-13 21:14

Title

Dromara free-fs 2.0.1 through 2.3.1 Password Reset Code Brute-Force Account Takeover

Summary

Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 21:14 UTC

CWE

CWE-307 - Improper Restriction of Excessive Authentication Attempts

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

4 references

URL	Tags
https://vul.yulun.ac.cn/20261024/free-fs/	third-party-advisory
https://github.com/dromara/free-fs/issues/28	issue-tracking
https://github.com/dromara/free-fs/blob/f8f4ff2a0…	technical-description
https://www.vulncheck.com/advisories/dromara-free…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
dromara	free-fs	Affected: 2.0.1 , ≤ 2.3.1 (semver)

Date Public

2026-10-24 00:00

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-129161",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T21:14:15.248982Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T21:14:24.139Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/dromara/free-fs",
          "product": "free-fs",
          "repo": "https://github.com/dromara/free-fs",
          "vendor": "dromara",
          "versions": [
            {
              "lessThanOrEqual": "2.3.1",
              "status": "affected",
              "version": "2.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-10-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:21:55.247Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261024/free-fs/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/dromara/free-fs/issues/28"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dromara/free-fs/blob/f8f4ff2a0b0af8fcd5cbecbf99a4afb7d0b7c020/fs-modules/fs-system/src/main/java/com/xddcodec/fs/system/service/impl/SysUserServiceImpl.java#L277-L294"
        },
        {
          "name": "VulnCheck Advisory: Dromara free-fs 2.0.1 through 2.3.1 Password Reset Code Brute-Force Account Takeover",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dromara-free-fs-2.0.1-through-2.3.1-password-reset-code-brute-force-account-takeover"
        }
      ],
      "title": "Dromara free-fs 2.0.1 through 2.3.1 Password Reset Code Brute-Force Account Takeover",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129161",
    "datePublished": "2026-11-13T17:21:55.247Z",
    "dateReserved": "2026-11-13T17:09:09.003Z",
    "dateUpdated": "2026-11-13T21:14:24.139Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129162 (GCVE-0-2026-129162)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:21 – Updated: 2026-11-13 17:21

Title

Dromara free-fs 2.0.1 through 2.3.1 Missing Authentication via File Stream Preview

Summary

Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/{fileId} to download any user's or workspace's files.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

5 references

URL	Tags
https://vul.yulun.ac.cn/20261024/free-fs/	third-party-advisory
https://github.com/dromara/free-fs/issues/28	issue-tracking
https://github.com/dromara/free-fs/blob/f8f4ff2a0…	technical-description
https://github.com/dromara/free-fs/blob/f8f4ff2a0…	technical-description
https://www.vulncheck.com/advisories/dromara-free…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
dromara	free-fs	Affected: 2.0.1 , ≤ 2.3.1 (semver)

Date Public

2026-10-24 00:00

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/dromara/free-fs",
          "product": "free-fs",
          "repo": "https://github.com/dromara/free-fs",
          "vendor": "dromara",
          "versions": [
            {
              "lessThanOrEqual": "2.3.1",
              "status": "affected",
              "version": "2.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-10-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/{fileId} to download any user\u0027s or workspace\u0027s files."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:21:54.600Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261024/free-fs/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/dromara/free-fs/issues/28"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dromara/free-fs/blob/f8f4ff2a0b0af8fcd5cbecbf99a4afb7d0b7c020/fs-modules/fs-file/src/main/java/com/xddcodec/fs/file/controller/FileStreamController.java#L52-L77"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dromara/free-fs/blob/f8f4ff2a0b0af8fcd5cbecbf99a4afb7d0b7c020/fs-admin/src/main/java/com/xddcodec/fs/web/WebMvcConfig.java#L50-L84"
        },
        {
          "name": "VulnCheck Advisory: Dromara free-fs 2.0.1 through 2.3.1 Missing Authentication via File Stream Preview",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dromara-free-fs-2.0.1-through-2.3.1-missing-authentication-via-file-stream-preview"
        }
      ],
      "title": "Dromara free-fs 2.0.1 through 2.3.1 Missing Authentication via File Stream Preview",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129162",
    "datePublished": "2026-11-13T17:21:54.600Z",
    "dateReserved": "2026-11-13T17:09:09.359Z",
    "dateUpdated": "2026-11-13T17:21:54.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-129163 (GCVE-0-2026-129163)

Vulnerability from cvelistv5 – Published: 2026-11-13 17:21 – Updated: 2026-11-13 17:21

Title

Dromara free-fs 2.0.1 through 2.3.1 Stored XSS via File Preview Endpoint

Summary

Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users to run script by uploading HTML files served inline as text/html. Attackers can send a victim the /api/file/stream/preview/{fileId} link to execute script in the application origin, calling /apis endpoints to expose the victim's files and account.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8186 records in the last 180 days details

References

4 references

URL	Tags
https://vul.yulun.ac.cn/20261024/free-fs/	third-party-advisory
https://github.com/dromara/free-fs/issues/28	issue-tracking
https://github.com/dromara/free-fs/blob/f8f4ff2a0…	technical-description
https://www.vulncheck.com/advisories/dromara-free…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
dromara	free-fs	Affected: 2.0.1 , ≤ 2.3.1 (semver)

Date Public

2026-10-24 00:00

Credits

Wu Yulun

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/dromara/free-fs",
          "product": "free-fs",
          "repo": "https://github.com/dromara/free-fs",
          "vendor": "dromara",
          "versions": [
            {
              "lessThanOrEqual": "2.3.1",
              "status": "affected",
              "version": "2.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wu Yulun"
        }
      ],
      "datePublic": "2026-10-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users to run script by uploading HTML files served inline as text/html. Attackers can send a victim the /api/file/stream/preview/{fileId} link to execute script in the application origin, calling /apis endpoints to expose the victim\u0027s files and account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T17:21:53.942Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vul.yulun.ac.cn/20261024/free-fs/"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/dromara/free-fs/issues/28"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dromara/free-fs/blob/f8f4ff2a0b0af8fcd5cbecbf99a4afb7d0b7c020/fs-modules/fs-file/src/main/java/com/xddcodec/fs/file/controller/FileStreamController.java#L209-L237"
        },
        {
          "name": "VulnCheck Advisory: Dromara free-fs 2.0.1 through 2.3.1 Stored XSS via File Preview Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dromara-free-fs-2.0.1-through-2.3.1-stored-xss-via-file-preview-endpoint"
        }
      ],
      "title": "Dromara free-fs 2.0.1 through 2.3.1 Stored XSS via File Preview Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-129163",
    "datePublished": "2026-11-13T17:21:53.942Z",
    "dateReserved": "2026-11-13T17:09:09.712Z",
    "dateUpdated": "2026-11-13T17:21:53.942Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

11815 vulnerabilities

CVE-2026-71519 (GCVE-0-2026-71519)

CVE-2026-71531 (GCVE-0-2026-71531)

CVE-2026-124021 (GCVE-0-2026-124021)

CVE-2026-124020 (GCVE-0-2026-124020)

CVE-2026-9661 (GCVE-0-2026-9661)

CVE-2026-127217 (GCVE-0-2026-127217)

CVE-2026-82504 (GCVE-0-2026-82504)

CVE-2026-127216 (GCVE-0-2026-127216)

CVE-2026-89037 (GCVE-0-2026-89037)

CVE-2026-127215 (GCVE-0-2026-127215)

CVE-2026-127214 (GCVE-0-2026-127214)

CVE-2026-127213 (GCVE-0-2026-127213)

CVE-2026-129139 (GCVE-0-2026-129139)

CVE-2026-129140 (GCVE-0-2026-129140)

CVE-2026-129141 (GCVE-0-2026-129141)

CVE-2026-129142 (GCVE-0-2026-129142)

CVE-2026-129143 (GCVE-0-2026-129143)

CVE-2026-129144 (GCVE-0-2026-129144)

CVE-2026-129151 (GCVE-0-2026-129151)

CVE-2026-129152 (GCVE-0-2026-129152)

CVE-2026-129153 (GCVE-0-2026-129153)

CVE-2026-129154 (GCVE-0-2026-129154)

CVE-2026-129155 (GCVE-0-2026-129155)

CVE-2026-129156 (GCVE-0-2026-129156)

CVE-2026-129157 (GCVE-0-2026-129157)

CVE-2026-129158 (GCVE-0-2026-129158)

CVE-2026-129160 (GCVE-0-2026-129160)

CVE-2026-129161 (GCVE-0-2026-129161)

CVE-2026-129162 (GCVE-0-2026-129162)

CVE-2026-129163 (GCVE-0-2026-129163)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

11815 vulnerabilities

CVE-2026-71519 (GCVE-0-2026-71519)

CVE-2026-71531 (GCVE-0-2026-71531)

CVE-2026-124021 (GCVE-0-2026-124021)

CVE-2026-124020 (GCVE-0-2026-124020)

CVE-2026-9661 (GCVE-0-2026-9661)

CVE-2026-127217 (GCVE-0-2026-127217)

CVE-2026-82504 (GCVE-0-2026-82504)

CVE-2026-127216 (GCVE-0-2026-127216)

CVE-2026-89037 (GCVE-0-2026-89037)

CVE-2026-127215 (GCVE-0-2026-127215)

CVE-2026-127214 (GCVE-0-2026-127214)

CVE-2026-127213 (GCVE-0-2026-127213)

CVE-2026-129139 (GCVE-0-2026-129139)

CVE-2026-129140 (GCVE-0-2026-129140)

CVE-2026-129141 (GCVE-0-2026-129141)

CVE-2026-129142 (GCVE-0-2026-129142)

CVE-2026-129143 (GCVE-0-2026-129143)

CVE-2026-129144 (GCVE-0-2026-129144)

CVE-2026-129151 (GCVE-0-2026-129151)

CVE-2026-129152 (GCVE-0-2026-129152)

CVE-2026-129153 (GCVE-0-2026-129153)

CVE-2026-129154 (GCVE-0-2026-129154)

CVE-2026-129155 (GCVE-0-2026-129155)

CVE-2026-129156 (GCVE-0-2026-129156)

CVE-2026-129157 (GCVE-0-2026-129157)

CVE-2026-129158 (GCVE-0-2026-129158)

CVE-2026-129160 (GCVE-0-2026-129160)

CVE-2026-129161 (GCVE-0-2026-129161)

CVE-2026-129162 (GCVE-0-2026-129162)

CVE-2026-129163 (GCVE-0-2026-129163)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.