Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
8 vulnerabilities by Discuz!
GCVE-1988-2026-0344
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
EPSS
VEX
Title
[KIS-2026-11] Discuz! <= X5.0 (enable_disable.php) Local File Inclusion Vulnerability
Summary
-----------------------------------------------------------------------
Discuz! <= X5.0 (enable_disable.php) Local File Inclusion Vulnerability
-----------------------------------------------------------------------
[-] Software Link:
https://www.discuz.vip
[-] Affected Versions:
Version X5.0, releases 20260320 through 20260610.
Older X3.4 and X3.5 releases may be affected too.
[-] Vulnerability Description:
A Local File Inclusion (LFI) vulnerability exists in the Discuz! plugin
management functionality. When enabling or disabling a plugin, the
application includes a file whose path is derived from plugin metadata
stored in the database. Due to insufficient validation of the plugin's
directory attribute during the import process, an administrator can import
a specially crafted plugin configuration containing Directory Traversal
sequences. By additionally triggering an exception during plugin
installation, the sanitization routine can be bypassed, causing malicious
paths to be stored unsanitized.
The vulnerable code is located in the
/source/app/admin/child/plugins/enable_disable.php script:
32 if(!empty($pluginarray[$operation.'file']) && preg_match('/^[\w\.]+$/',
$pluginarray[$operation.'file'])) {
33 $filename = DISCUZ_PLUGIN($dir).'/'.$pluginarray[$operation.'file'];
34 if(file_exists($filename)) {
35 $installlang = load_installlang($dir);
36 @include $filename;
37 }
38 }
Because the attacker controls both the plugin directory and the included
filename through the imported plugin metadata, it becomes possible to force
the application to include arbitrary files from the local filesystem by
abusing the include() call at line 36. By combining this issue with an
upload functionality that allows PHP code to be stored on the server, an
authenticated administrator can escalate the vulnerability to arbitrary PHP
code execution, resulting in Remote Code Execution (RCE) in the context of
the web server user.
Successful exploitation of this vulnerability requires administrator
privileges.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/discuz_rce.zip
[-] Solution:
No official solution is currently available.
[-] Disclosure Timeline:
[27/04/2026] - Vendor contacted through private messages on gitee.com, no
response
[27/04/2026] - Vendor contacted via e-mail at admin () discuz vip and
security () tencent com, no response
[07/05/2026] - Opened issue IJLFUW on https://gitee.com/Discuz/DiscuzX
[09/05/2026] - Vulnerability details shared within issue IJLFUW
[09/05/2026] - Vendor replied "all plugin-related issues are reviewed by
application center auditors"
[09/06/2026] - CVE identifier requested
[09/06/2026] - CVE identifier assigned
[13/06/2026] - Public disclosure at hackmeeting 0x1D
[15/06/2026] - Publication of this advisory
[-] CVE Reference:
CVE-2026-49954 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-11
[-] Technical write-up:
https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
9 references
Relationships
analysis
GCVE-1988-2026-0344 (this record)
- related CVE-2026-49954
{
"containers": {
"cna": {
"affected": [
{
"product": "Discuz!",
"vendor": "Discuz!",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----------------------------------------------------------------------\nDiscuz! \u003c= X5.0 (enable_disable.php) Local File Inclusion Vulnerability\n-----------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.discuz.vip\n\n\n[-] Affected Versions:\n\nVersion X5.0, releases 20260320 through 20260610.\nOlder X3.4 and X3.5 releases may be affected too.\n\n\n[-] Vulnerability Description:\n\nA Local File Inclusion (LFI) vulnerability exists in the Discuz! plugin\nmanagement functionality. When enabling or disabling a plugin, the\napplication includes a file whose path is derived from plugin metadata\nstored in the database. Due to insufficient validation of the plugin\u0027s\ndirectory attribute during the import process, an administrator can import\na specially crafted plugin configuration containing Directory Traversal\nsequences. By additionally triggering an exception during plugin\ninstallation, the sanitization routine can be bypassed, causing malicious\npaths to be stored unsanitized.\n\nThe vulnerable code is located in the\n/source/app/admin/child/plugins/enable_disable.php script:\n\n32 if(!empty($pluginarray[$operation.\u0027file\u0027]) \u0026\u0026 preg_match(\u0027/^[\\w\\.]+$/\u0027,\n$pluginarray[$operation.\u0027file\u0027])) {\n33 $filename = DISCUZ_PLUGIN($dir).\u0027/\u0027.$pluginarray[$operation.\u0027file\u0027];\n34 if(file_exists($filename)) {\n35 $installlang = load_installlang($dir);\n36 @include $filename;\n37 }\n38 }\n\nBecause the attacker controls both the plugin directory and the included\nfilename through the imported plugin metadata, it becomes possible to force\nthe application to include arbitrary files from the local filesystem by\nabusing the include() call at line 36. By combining this issue with an\nupload functionality that allows PHP code to be stored on the server, an\nauthenticated administrator can escalate the vulnerability to arbitrary PHP\ncode execution, resulting in Remote Code Execution (RCE) in the context of\nthe web server user.\n\nSuccessful exploitation of this vulnerability requires administrator\nprivileges.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/discuz_rce.zip\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[27/04/2026] - Vendor contacted through private messages on gitee.com, no\nresponse\n[27/04/2026] - Vendor contacted via e-mail at admin () discuz vip and\nsecurity () tencent com, no response\n[07/05/2026] - Opened issue IJLFUW on https://gitee.com/Discuz/DiscuzX\n[09/05/2026] - Vulnerability details shared within issue IJLFUW\n[09/05/2026] - Vendor replied \"all plugin-related issues are reviewed by\napplication center auditors\"\n[09/06/2026] - CVE identifier requested\n[09/06/2026] - CVE identifier assigned\n[13/06/2026] - Public disclosure at hackmeeting 0x1D\n[15/06/2026] - Publication of this advisory\n\n\n[-] CVE Reference:\n\nCVE-2026-49954 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-11\n\n\n[-] Technical write-up:\n\nhttps://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:55:57Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/5"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jun/5"
},
{
"url": "https://gitee.com/Discuz/DiscuzX"
},
{
"url": "https://karmainsecurity.com/KIS-2026-11"
},
{
"url": "https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce"
},
{
"url": "https://karmainsecurity.com/pocs/discuz_rce.zip"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.discuz.vip"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jun/5"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-11] Discuz! \u003c= X5.0 (enable_disable.php) Local File Inclusion Vulnerability",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-49954",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0344",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/5",
"automated": true,
"contentSha256": "b27975a4c6b5b4d9cfc4df6cac3cf19509001218a032a1e245c6b263c15b8a72",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/5",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-06-15T18:44:33Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0344"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:57Z",
"dateUpdated": "2026-09-11T07:55:57Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0344"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0343
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
EPSS
VEX
Title
[KIS-2026-10] Discuz! <= X5.0 OCR-based CAPTCHA Bypass Vulnerability
Summary
------------------------------------------------------
Discuz! <= X5.0 OCR-based CAPTCHA Bypass Vulnerability
------------------------------------------------------
[-] Software Link:
https://www.discuz.vip
[-] Affected Versions:
Version X5.0, releases 20260320 through 20260610.
Older X3.4 and X3.5 releases may be affected too.
[-] Vulnerability Description:
A security weakness in the CAPTCHA implementation of Discuz! allows
automated solving of CAPTCHA challenges through Optical Character
Recognition (OCR) techniques.
Due to the limited complexity and predictability of the generated CAPTCHA
images, an attacker can train a custom OCR model to reliably recognize the
challenge text, effectively bypassing a security control intended to
prevent automated abuse.
This issue may facilitate automated registration, login, credential
stuffing, and exploitation workflows that rely on CAPTCHA-protected
functionality.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/discuz_captcha_bypass.zip
[-] Solution:
No official solution is currently available.
[-] Disclosure Timeline:
[27/04/2026] - Vendor contacted through private messages on gitee.com, no
response
[27/04/2026] - Vendor contacted via e-mail at admin () discuz vip and
security () tencent com, no response
[07/05/2026] - Opened issue IJLFUW on https://gitee.com/Discuz/DiscuzX
[09/05/2026] - Vulnerability details shared within issue IJLFUW
[09/05/2026] - Vendor replied "OCR-based CAPTCHA bypass is a well-known
issue"
[09/06/2026] - CVE identifier requested
[09/06/2026] - CVE identifier assigned
[13/06/2026] - Public disclosure at hackmeeting 0x1D
[15/06/2026] - Publication of this advisory
[-] CVE Reference:
CVE-2026-49953 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-10
[-] Technical write-up:
https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
9 references
Relationships
analysis
GCVE-1988-2026-0343 (this record)
- related CVE-2026-49953
{
"containers": {
"cna": {
"affected": [
{
"product": "Discuz!",
"vendor": "Discuz!",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "------------------------------------------------------\nDiscuz! \u003c= X5.0 OCR-based CAPTCHA Bypass Vulnerability\n------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.discuz.vip\n\n\n[-] Affected Versions:\n\nVersion X5.0, releases 20260320 through 20260610.\nOlder X3.4 and X3.5 releases may be affected too.\n\n\n[-] Vulnerability Description:\n\nA security weakness in the CAPTCHA implementation of Discuz! allows\nautomated solving of CAPTCHA challenges through Optical Character\nRecognition (OCR) techniques.\n\nDue to the limited complexity and predictability of the generated CAPTCHA\nimages, an attacker can train a custom OCR model to reliably recognize the\nchallenge text, effectively bypassing a security control intended to\nprevent automated abuse.\n\nThis issue may facilitate automated registration, login, credential\nstuffing, and exploitation workflows that rely on CAPTCHA-protected\nfunctionality.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/discuz_captcha_bypass.zip\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[27/04/2026] - Vendor contacted through private messages on gitee.com, no\nresponse\n[27/04/2026] - Vendor contacted via e-mail at admin () discuz vip and\nsecurity () tencent com, no response\n[07/05/2026] - Opened issue IJLFUW on https://gitee.com/Discuz/DiscuzX\n[09/05/2026] - Vulnerability details shared within issue IJLFUW\n[09/05/2026] - Vendor replied \"OCR-based CAPTCHA bypass is a well-known\nissue\"\n[09/06/2026] - CVE identifier requested\n[09/06/2026] - CVE identifier assigned\n[13/06/2026] - Public disclosure at hackmeeting 0x1D\n[15/06/2026] - Publication of this advisory\n\n\n[-] CVE Reference:\n\nCVE-2026-49953 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-10\n\n\n[-] Technical write-up:\n\nhttps://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:55:56Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/4"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jun/4"
},
{
"url": "https://gitee.com/Discuz/DiscuzX"
},
{
"url": "https://karmainsecurity.com/KIS-2026-10"
},
{
"url": "https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce"
},
{
"url": "https://karmainsecurity.com/pocs/discuz_captcha_bypass.zip"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.discuz.vip"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jun/4"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-10] Discuz! \u003c= X5.0 OCR-based CAPTCHA Bypass Vulnerability",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-49953",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0343",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/4",
"automated": true,
"contentSha256": "b57995b4e4fcb3b47cfaaa54e95919ec1b6be8469ec3fe193c4cadad9c0315ab",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/4",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-06-15T18:43:10Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0343"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:56Z",
"dateUpdated": "2026-09-11T07:55:56Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0343"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49954 (GCVE-0-2026-49954)
Vulnerability from nvd – Published: 2026-06-15 18:50 – Updated: 2026-07-28 01:49 X_Open Source
VLAI
EPSS
VEX
Title
Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory
Summary
Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences in the directory attribute. Attackers can trigger an exception during plugin installation to bypass sanitization routines, causing malicious paths to be stored unsanitized and subsequently passed to include(), which combined with file upload functionality escalates to arbitrary code execution in the context of the web server user.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 15:07 UTC
CWE
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-11 | technical-description |
| https://karmainsecurity.com/chaining-bugs-in-disc… | exploit |
| https://www.vulncheck.com/advisories/discuz-x5-0-… | third-party-advisory |
| http://seclists.org/fulldisclosure/2026/Jun/5 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Discuz! | Discuz! X5.0 |
Affected:
20260320 , ≤ 20260610
(date)
cpe:2.3:a:discuz:discuzx:*:*:*:*:*:*:*:* |
Date Public
2026-06-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-06-16T09:48:25.815Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Jun/5"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49954",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T15:07:24.389747Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T15:20:11.714Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Discuz! X5.0",
"repo": "https://gitee.com/Discuz/DiscuzX",
"vendor": "Discuz!",
"versions": [
{
"lessThanOrEqual": "20260610",
"status": "affected",
"version": "20260320",
"versionType": "date"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:discuz:discuzx:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"datePublic": "2026-06-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences in the directory attribute. Attackers can trigger an exception during plugin installation to bypass sanitization routines, causing malicious paths to be stored unsanitized and subsequently passed to include(), which combined with file upload functionality escalates to arbitrary code execution in the context of the web server user."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T01:49:39.672Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://karmainsecurity.com/KIS-2026-11"
},
{
"tags": [
"exploit"
],
"url": "https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/discuz-x5-0-local-file-inclusion-via-enable-disable-php-plugin-directory"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-49954",
"datePublished": "2026-06-15T18:50:01.058Z",
"dateReserved": "2026-06-02T16:30:15.232Z",
"dateUpdated": "2026-07-28T01:49:39.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49953 (GCVE-0-2026-49953)
Vulnerability from nvd – Published: 2026-06-15 18:45 – Updated: 2026-07-28 01:49 X_Open Source
VLAI
EPSS
VEX
Title
Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set
Summary
Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 22:04 UTC
CWE
- CWE-804 - Guessable CAPTCHA
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-10 | technical-description |
| https://karmainsecurity.com/chaining-bugs-in-disc… | exploit |
| https://www.vulncheck.com/advisories/discuz-x5-0-… | third-party-advisory |
| http://seclists.org/fulldisclosure/2026/Jun/4 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Discuz! | Discuz! X5.0 |
Affected:
20260320 , ≤ 20260610
(date)
cpe:2.3:a:discuz:discuzx:*:*:*:*:*:*:*:* |
Date Public
2026-06-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49953",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T22:04:03.767762Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T22:04:58.303Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-06-16T09:48:24.870Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Jun/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Discuz! X5.0",
"repo": "https://gitee.com/Discuz/DiscuzX",
"vendor": "Discuz!",
"versions": [
{
"lessThanOrEqual": "20260610",
"status": "affected",
"version": "20260320",
"versionType": "date"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:discuz:discuzx:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"datePublic": "2026-06-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-804",
"description": "Guessable CAPTCHA",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T01:49:38.986Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://karmainsecurity.com/KIS-2026-10"
},
{
"tags": [
"exploit"
],
"url": "https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/discuz-x5-0-captcha-bypass-via-predictable-character-set"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-49953",
"datePublished": "2026-06-15T18:45:19.051Z",
"dateReserved": "2026-06-02T16:30:15.232Z",
"dateUpdated": "2026-07-28T01:49:38.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49952 (GCVE-0-2026-49952)
Vulnerability from nvd – Published: 2026-06-15 18:43 – Updated: 2026-07-28 01:49 X_Open Source
VLAI
EPSS
VEX
Title
Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle
Summary
Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 19:58 UTC
CWE
- CWE-323 - Reusing a Nonce, Key Pair in Encryption
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-09 | technical-description |
| https://karmainsecurity.com/chaining-bugs-in-disc… | exploit |
| https://gitee.com/Discuz/DiscuzX/commit/9962dad52… | patch |
| https://www.vulncheck.com/advisories/discuz-x5-0-… | third-party-advisory |
| http://seclists.org/fulldisclosure/2026/Jun/3 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Discuz! | Discuz! X5.0 |
Affected:
20260320 , ≤ 20260501
(date)
cpe:2.3:a:discuz:discuzx:*:*:*:*:*:*:*:* |
Date Public
2026-05-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49952",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T19:58:52.987295Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T19:59:18.533Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-06-16T09:48:23.903Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Jun/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Discuz! X5.0",
"repo": "https://gitee.com/Discuz/DiscuzX",
"vendor": "Discuz!",
"versions": [
{
"lessThanOrEqual": "20260501",
"status": "affected",
"version": "20260320",
"versionType": "date"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:discuz:discuzx:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"datePublic": "2026-05-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-323",
"description": "Reusing a Nonce, Key Pair in Encryption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T01:49:38.302Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://karmainsecurity.com/KIS-2026-09"
},
{
"tags": [
"exploit"
],
"url": "https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce"
},
{
"tags": [
"patch"
],
"url": "https://gitee.com/Discuz/DiscuzX/commit/9962dad52c4c6999dabaf91ecd70377c680ff3c6"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/discuz-x5-0-authentication-bypass-via-dbbak-php-encryption-oracle"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-49952",
"datePublished": "2026-06-15T18:43:21.990Z",
"dateReserved": "2026-06-02T16:30:15.232Z",
"dateUpdated": "2026-07-28T01:49:38.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49954 (GCVE-0-2026-49954)
Vulnerability from cvelistv5 – Published: 2026-06-15 18:50 – Updated: 2026-07-28 01:49 X_Open Source
VLAI
EPSS
VEX
Title
Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory
Summary
Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences in the directory attribute. Attackers can trigger an exception during plugin installation to bypass sanitization routines, causing malicious paths to be stored unsanitized and subsequently passed to include(), which combined with file upload functionality escalates to arbitrary code execution in the context of the web server user.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 15:07 UTC
CWE
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-11 | technical-description |
| https://karmainsecurity.com/chaining-bugs-in-disc… | exploit |
| https://www.vulncheck.com/advisories/discuz-x5-0-… | third-party-advisory |
| http://seclists.org/fulldisclosure/2026/Jun/5 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Discuz! | Discuz! X5.0 |
Affected:
20260320 , ≤ 20260610
(date)
cpe:2.3:a:discuz:discuzx:*:*:*:*:*:*:*:* |
Date Public
2026-06-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-06-16T09:48:25.815Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Jun/5"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49954",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T15:07:24.389747Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T15:20:11.714Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Discuz! X5.0",
"repo": "https://gitee.com/Discuz/DiscuzX",
"vendor": "Discuz!",
"versions": [
{
"lessThanOrEqual": "20260610",
"status": "affected",
"version": "20260320",
"versionType": "date"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:discuz:discuzx:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"datePublic": "2026-06-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences in the directory attribute. Attackers can trigger an exception during plugin installation to bypass sanitization routines, causing malicious paths to be stored unsanitized and subsequently passed to include(), which combined with file upload functionality escalates to arbitrary code execution in the context of the web server user."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T01:49:39.672Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://karmainsecurity.com/KIS-2026-11"
},
{
"tags": [
"exploit"
],
"url": "https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/discuz-x5-0-local-file-inclusion-via-enable-disable-php-plugin-directory"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-49954",
"datePublished": "2026-06-15T18:50:01.058Z",
"dateReserved": "2026-06-02T16:30:15.232Z",
"dateUpdated": "2026-07-28T01:49:39.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49953 (GCVE-0-2026-49953)
Vulnerability from cvelistv5 – Published: 2026-06-15 18:45 – Updated: 2026-07-28 01:49 X_Open Source
VLAI
EPSS
VEX
Title
Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set
Summary
Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 22:04 UTC
CWE
- CWE-804 - Guessable CAPTCHA
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-10 | technical-description |
| https://karmainsecurity.com/chaining-bugs-in-disc… | exploit |
| https://www.vulncheck.com/advisories/discuz-x5-0-… | third-party-advisory |
| http://seclists.org/fulldisclosure/2026/Jun/4 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Discuz! | Discuz! X5.0 |
Affected:
20260320 , ≤ 20260610
(date)
cpe:2.3:a:discuz:discuzx:*:*:*:*:*:*:*:* |
Date Public
2026-06-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49953",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T22:04:03.767762Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T22:04:58.303Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-06-16T09:48:24.870Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Jun/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Discuz! X5.0",
"repo": "https://gitee.com/Discuz/DiscuzX",
"vendor": "Discuz!",
"versions": [
{
"lessThanOrEqual": "20260610",
"status": "affected",
"version": "20260320",
"versionType": "date"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:discuz:discuzx:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"datePublic": "2026-06-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-804",
"description": "Guessable CAPTCHA",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T01:49:38.986Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://karmainsecurity.com/KIS-2026-10"
},
{
"tags": [
"exploit"
],
"url": "https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/discuz-x5-0-captcha-bypass-via-predictable-character-set"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-49953",
"datePublished": "2026-06-15T18:45:19.051Z",
"dateReserved": "2026-06-02T16:30:15.232Z",
"dateUpdated": "2026-07-28T01:49:38.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49952 (GCVE-0-2026-49952)
Vulnerability from cvelistv5 – Published: 2026-06-15 18:43 – Updated: 2026-07-28 01:49 X_Open Source
VLAI
EPSS
VEX
Title
Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle
Summary
Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 19:58 UTC
CWE
- CWE-323 - Reusing a Nonce, Key Pair in Encryption
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://karmainsecurity.com/KIS-2026-09 | technical-description |
| https://karmainsecurity.com/chaining-bugs-in-disc… | exploit |
| https://gitee.com/Discuz/DiscuzX/commit/9962dad52… | patch |
| https://www.vulncheck.com/advisories/discuz-x5-0-… | third-party-advisory |
| http://seclists.org/fulldisclosure/2026/Jun/3 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Discuz! | Discuz! X5.0 |
Affected:
20260320 , ≤ 20260501
(date)
cpe:2.3:a:discuz:discuzx:*:*:*:*:*:*:*:* |
Date Public
2026-05-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49952",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-15T19:58:52.987295Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-15T19:59:18.533Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-06-16T09:48:23.903Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Jun/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Discuz! X5.0",
"repo": "https://gitee.com/Discuz/DiscuzX",
"vendor": "Discuz!",
"versions": [
{
"lessThanOrEqual": "20260501",
"status": "affected",
"version": "20260320",
"versionType": "date"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:discuz:discuzx:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"datePublic": "2026-05-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-323",
"description": "Reusing a Nonce, Key Pair in Encryption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T01:49:38.302Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://karmainsecurity.com/KIS-2026-09"
},
{
"tags": [
"exploit"
],
"url": "https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce"
},
{
"tags": [
"patch"
],
"url": "https://gitee.com/Discuz/DiscuzX/commit/9962dad52c4c6999dabaf91ecd70377c680ff3c6"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/discuz-x5-0-authentication-bypass-via-dbbak-php-encryption-oracle"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-49952",
"datePublished": "2026-06-15T18:43:21.990Z",
"dateReserved": "2026-06-02T16:30:15.232Z",
"dateUpdated": "2026-07-28T01:49:38.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}