EUVD-2026-91065

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...