Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by MODSetter
CVE-2026-102245 (GCVE-0-2026-102245)
Vulnerability from nvd – Published: 2026-09-29 03:00 – Updated: 2026-09-29 03:00
VLAI
EPSS
VEX
Title
MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication
Summary
A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook_route.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/411143 | vdb-entry |
| https://vuldb.com/vuln/411143/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-102245 | third-party-advisory |
| https://vuldb.com/submit/933653 | third-party-advisory |
| https://gist.github.com/DReazer/1e476832e48bcdb2b… | exploit |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:*"
],
"modules": [
"circleback Endpoint"
],
"product": "SurfSense",
"vendor": "MODSetter",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Snkn0w (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook_route.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T03:00:15.001Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-411143 | MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/411143"
},
{
"name": "VDB-411143 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/411143/cti"
},
{
"name": "CVE-2026-102245 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-102245"
},
{
"name": "Submit #933653 | MODSetter SurfSense \u003c=0.0.36 Missing Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933653"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/DReazer/1e476832e48bcdb2b4f732689dfeac0c"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-28T20:51:35.000Z",
"value": "VulDB entry last update"
}
],
"title": "MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-102245",
"datePublished": "2026-09-29T03:00:15.001Z",
"dateReserved": "2026-09-28T18:46:21.600Z",
"dateUpdated": "2026-09-29T03:00:15.001Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102244 (GCVE-0-2026-102244)
Vulnerability from nvd – Published: 2026-09-29 02:45 – Updated: 2026-09-29 02:45 X_Open Source
VLAI
EPSS
VEX
Title
MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery
Summary
A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded.
Severity
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/411142 | vdb-entry |
| https://vuldb.com/vuln/411142/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-102244 | third-party-advisory |
| https://vuldb.com/submit/933330 | third-party-advisory |
| https://gist.github.com/DReazer/57126e711507324a5… | exploit |
| https://github.com/MODSetter/SurfSense/commit/2fa… | patch |
| https://github.com/MODSetter/SurfSense/releases/t… | patch |
| https://github.com/MODSetter/SurfSense/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MODSetter | SurfSense |
Affected:
0.0.1
Affected: 0.0.2 Affected: 0.0.3 Affected: 0.0.4 Affected: 0.0.5 Affected: 0.0.6 Affected: 0.0.7 Affected: 0.0.8 Affected: 0.0.9 Affected: 0.0.10 Affected: 0.0.11 Affected: 0.0.12 Affected: 0.0.13 Affected: 0.0.14 Affected: 0.0.15 Affected: 0.0.16 Affected: 0.0.17 Affected: 0.0.18 Affected: 0.0.19 Affected: 0.0.20 Affected: 0.0.21 Affected: 0.0.22 Affected: 0.0.23 Affected: 0.0.24 Affected: 0.0.25 Affected: 0.0.26 Affected: 0.0.27 Affected: 0.0.28 Affected: 0.0.29 Affected: 0.0.30 Affected: 0.0.31 Affected: 0.0.32 Affected: 0.0.33 Affected: 0.0.34 Affected: 0.0.35 Affected: 0.0.36 Unaffected: 0.0.36.3 cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:*"
],
"modules": [
"Document Export Feature"
],
"product": "SurfSense",
"vendor": "MODSetter",
"versions": [
{
"status": "affected",
"version": "0.0.1"
},
{
"status": "affected",
"version": "0.0.2"
},
{
"status": "affected",
"version": "0.0.3"
},
{
"status": "affected",
"version": "0.0.4"
},
{
"status": "affected",
"version": "0.0.5"
},
{
"status": "affected",
"version": "0.0.6"
},
{
"status": "affected",
"version": "0.0.7"
},
{
"status": "affected",
"version": "0.0.8"
},
{
"status": "affected",
"version": "0.0.9"
},
{
"status": "affected",
"version": "0.0.10"
},
{
"status": "affected",
"version": "0.0.11"
},
{
"status": "affected",
"version": "0.0.12"
},
{
"status": "affected",
"version": "0.0.13"
},
{
"status": "affected",
"version": "0.0.14"
},
{
"status": "affected",
"version": "0.0.15"
},
{
"status": "affected",
"version": "0.0.16"
},
{
"status": "affected",
"version": "0.0.17"
},
{
"status": "affected",
"version": "0.0.18"
},
{
"status": "affected",
"version": "0.0.19"
},
{
"status": "affected",
"version": "0.0.20"
},
{
"status": "affected",
"version": "0.0.21"
},
{
"status": "affected",
"version": "0.0.22"
},
{
"status": "affected",
"version": "0.0.23"
},
{
"status": "affected",
"version": "0.0.24"
},
{
"status": "affected",
"version": "0.0.25"
},
{
"status": "affected",
"version": "0.0.26"
},
{
"status": "affected",
"version": "0.0.27"
},
{
"status": "affected",
"version": "0.0.28"
},
{
"status": "affected",
"version": "0.0.29"
},
{
"status": "affected",
"version": "0.0.30"
},
{
"status": "affected",
"version": "0.0.31"
},
{
"status": "affected",
"version": "0.0.32"
},
{
"status": "affected",
"version": "0.0.33"
},
{
"status": "affected",
"version": "0.0.34"
},
{
"status": "affected",
"version": "0.0.35"
},
{
"status": "affected",
"version": "0.0.36"
},
{
"status": "unaffected",
"version": "0.0.36.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Snkn0w (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:45:13.530Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-411142 | MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/411142"
},
{
"name": "VDB-411142 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/411142/cti"
},
{
"name": "CVE-2026-102244 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-102244"
},
{
"name": "Submit #933330 | MODSetter SurfSense \u003c=0.0.36 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933330"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/DReazer/57126e711507324a547edde96c62c218"
},
{
"tags": [
"patch"
],
"url": "https://github.com/MODSetter/SurfSense/commit/2faff7b3823322a9cb6797973e6caf089386c354"
},
{
"tags": [
"patch"
],
"url": "https://github.com/MODSetter/SurfSense/releases/tag/0.0.36.3"
},
{
"tags": [
"product"
],
"url": "https://github.com/MODSetter/SurfSense/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-28T20:51:31.000Z",
"value": "VulDB entry last update"
}
],
"title": "MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-102244",
"datePublished": "2026-09-29T02:45:13.530Z",
"dateReserved": "2026-09-28T18:46:17.616Z",
"dateUpdated": "2026-09-29T02:45:13.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102243 (GCVE-0-2026-102243)
Vulnerability from nvd – Published: 2026-09-29 02:30 – Updated: 2026-09-29 10:42
VLAI
EPSS
VEX
Title
MODSetter SurfSense MCP Connector Integration test command injection
Summary
A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 10:42 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/411141 | vdb-entry |
| https://vuldb.com/vuln/411141/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-102243 | third-party-advisory |
| https://vuldb.com/submit/933323 | third-party-advisory |
| https://gist.github.com/DReazer/81504d373f4e32206… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102243",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T10:42:05.341340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T10:42:14.530Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:*"
],
"modules": [
"MCP Connector Integration"
],
"product": "SurfSense",
"vendor": "MODSetter",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Snkn0w (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:30:13.441Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-411141 | MODSetter SurfSense MCP Connector Integration test command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/411141"
},
{
"name": "VDB-411141 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/411141/cti"
},
{
"name": "CVE-2026-102243 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-102243"
},
{
"name": "Submit #933323 | MODSetter SurfSense \u003c=0.0.36 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933323"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/DReazer/81504d373f4e32206dc885d3c415e278"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-28T20:51:27.000Z",
"value": "VulDB entry last update"
}
],
"title": "MODSetter SurfSense MCP Connector Integration test command injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-102243",
"datePublished": "2026-09-29T02:30:13.441Z",
"dateReserved": "2026-09-28T18:46:14.189Z",
"dateUpdated": "2026-09-29T10:42:14.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102245 (GCVE-0-2026-102245)
Vulnerability from cvelistv5 – Published: 2026-09-29 03:00 – Updated: 2026-09-29 03:00
VLAI
EPSS
VEX
Title
MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication
Summary
A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook_route.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/411143 | vdb-entry |
| https://vuldb.com/vuln/411143/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-102245 | third-party-advisory |
| https://vuldb.com/submit/933653 | third-party-advisory |
| https://gist.github.com/DReazer/1e476832e48bcdb2b… | exploit |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:*"
],
"modules": [
"circleback Endpoint"
],
"product": "SurfSense",
"vendor": "MODSetter",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Snkn0w (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook_route.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T03:00:15.001Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-411143 | MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/411143"
},
{
"name": "VDB-411143 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/411143/cti"
},
{
"name": "CVE-2026-102245 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-102245"
},
{
"name": "Submit #933653 | MODSetter SurfSense \u003c=0.0.36 Missing Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933653"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/DReazer/1e476832e48bcdb2b4f732689dfeac0c"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-28T20:51:35.000Z",
"value": "VulDB entry last update"
}
],
"title": "MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-102245",
"datePublished": "2026-09-29T03:00:15.001Z",
"dateReserved": "2026-09-28T18:46:21.600Z",
"dateUpdated": "2026-09-29T03:00:15.001Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102244 (GCVE-0-2026-102244)
Vulnerability from cvelistv5 – Published: 2026-09-29 02:45 – Updated: 2026-09-29 02:45 X_Open Source
VLAI
EPSS
VEX
Title
MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery
Summary
A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded.
Severity
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/411142 | vdb-entry |
| https://vuldb.com/vuln/411142/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-102244 | third-party-advisory |
| https://vuldb.com/submit/933330 | third-party-advisory |
| https://gist.github.com/DReazer/57126e711507324a5… | exploit |
| https://github.com/MODSetter/SurfSense/commit/2fa… | patch |
| https://github.com/MODSetter/SurfSense/releases/t… | patch |
| https://github.com/MODSetter/SurfSense/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MODSetter | SurfSense |
Affected:
0.0.1
Affected: 0.0.2 Affected: 0.0.3 Affected: 0.0.4 Affected: 0.0.5 Affected: 0.0.6 Affected: 0.0.7 Affected: 0.0.8 Affected: 0.0.9 Affected: 0.0.10 Affected: 0.0.11 Affected: 0.0.12 Affected: 0.0.13 Affected: 0.0.14 Affected: 0.0.15 Affected: 0.0.16 Affected: 0.0.17 Affected: 0.0.18 Affected: 0.0.19 Affected: 0.0.20 Affected: 0.0.21 Affected: 0.0.22 Affected: 0.0.23 Affected: 0.0.24 Affected: 0.0.25 Affected: 0.0.26 Affected: 0.0.27 Affected: 0.0.28 Affected: 0.0.29 Affected: 0.0.30 Affected: 0.0.31 Affected: 0.0.32 Affected: 0.0.33 Affected: 0.0.34 Affected: 0.0.35 Affected: 0.0.36 Unaffected: 0.0.36.3 cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:*"
],
"modules": [
"Document Export Feature"
],
"product": "SurfSense",
"vendor": "MODSetter",
"versions": [
{
"status": "affected",
"version": "0.0.1"
},
{
"status": "affected",
"version": "0.0.2"
},
{
"status": "affected",
"version": "0.0.3"
},
{
"status": "affected",
"version": "0.0.4"
},
{
"status": "affected",
"version": "0.0.5"
},
{
"status": "affected",
"version": "0.0.6"
},
{
"status": "affected",
"version": "0.0.7"
},
{
"status": "affected",
"version": "0.0.8"
},
{
"status": "affected",
"version": "0.0.9"
},
{
"status": "affected",
"version": "0.0.10"
},
{
"status": "affected",
"version": "0.0.11"
},
{
"status": "affected",
"version": "0.0.12"
},
{
"status": "affected",
"version": "0.0.13"
},
{
"status": "affected",
"version": "0.0.14"
},
{
"status": "affected",
"version": "0.0.15"
},
{
"status": "affected",
"version": "0.0.16"
},
{
"status": "affected",
"version": "0.0.17"
},
{
"status": "affected",
"version": "0.0.18"
},
{
"status": "affected",
"version": "0.0.19"
},
{
"status": "affected",
"version": "0.0.20"
},
{
"status": "affected",
"version": "0.0.21"
},
{
"status": "affected",
"version": "0.0.22"
},
{
"status": "affected",
"version": "0.0.23"
},
{
"status": "affected",
"version": "0.0.24"
},
{
"status": "affected",
"version": "0.0.25"
},
{
"status": "affected",
"version": "0.0.26"
},
{
"status": "affected",
"version": "0.0.27"
},
{
"status": "affected",
"version": "0.0.28"
},
{
"status": "affected",
"version": "0.0.29"
},
{
"status": "affected",
"version": "0.0.30"
},
{
"status": "affected",
"version": "0.0.31"
},
{
"status": "affected",
"version": "0.0.32"
},
{
"status": "affected",
"version": "0.0.33"
},
{
"status": "affected",
"version": "0.0.34"
},
{
"status": "affected",
"version": "0.0.35"
},
{
"status": "affected",
"version": "0.0.36"
},
{
"status": "unaffected",
"version": "0.0.36.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Snkn0w (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:45:13.530Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-411142 | MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/411142"
},
{
"name": "VDB-411142 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/411142/cti"
},
{
"name": "CVE-2026-102244 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-102244"
},
{
"name": "Submit #933330 | MODSetter SurfSense \u003c=0.0.36 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933330"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/DReazer/57126e711507324a547edde96c62c218"
},
{
"tags": [
"patch"
],
"url": "https://github.com/MODSetter/SurfSense/commit/2faff7b3823322a9cb6797973e6caf089386c354"
},
{
"tags": [
"patch"
],
"url": "https://github.com/MODSetter/SurfSense/releases/tag/0.0.36.3"
},
{
"tags": [
"product"
],
"url": "https://github.com/MODSetter/SurfSense/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-28T20:51:31.000Z",
"value": "VulDB entry last update"
}
],
"title": "MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-102244",
"datePublished": "2026-09-29T02:45:13.530Z",
"dateReserved": "2026-09-28T18:46:17.616Z",
"dateUpdated": "2026-09-29T02:45:13.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102243 (GCVE-0-2026-102243)
Vulnerability from cvelistv5 – Published: 2026-09-29 02:30 – Updated: 2026-09-29 10:42
VLAI
EPSS
VEX
Title
MODSetter SurfSense MCP Connector Integration test command injection
Summary
A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 10:42 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/411141 | vdb-entry |
| https://vuldb.com/vuln/411141/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-102243 | third-party-advisory |
| https://vuldb.com/submit/933323 | third-party-advisory |
| https://gist.github.com/DReazer/81504d373f4e32206… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102243",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T10:42:05.341340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T10:42:14.530Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:*"
],
"modules": [
"MCP Connector Integration"
],
"product": "SurfSense",
"vendor": "MODSetter",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Snkn0w (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:30:13.441Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-411141 | MODSetter SurfSense MCP Connector Integration test command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/411141"
},
{
"name": "VDB-411141 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/411141/cti"
},
{
"name": "CVE-2026-102243 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-102243"
},
{
"name": "Submit #933323 | MODSetter SurfSense \u003c=0.0.36 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933323"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/DReazer/81504d373f4e32206dc885d3c415e278"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-28T20:51:27.000Z",
"value": "VulDB entry last update"
}
],
"title": "MODSetter SurfSense MCP Connector Integration test command injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-102243",
"datePublished": "2026-09-29T02:30:13.441Z",
"dateReserved": "2026-09-28T18:46:14.189Z",
"dateUpdated": "2026-09-29T10:42:14.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}