CVE-2026-121940

Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to rea...

CVE-2026-121940

The Stonewuu ai-fusion-video software (versions before 1.3.0 ) is affected by an Insecure Direct Object Reference (IDOR) vulnerability. Authenticated users can access other users' projects by providing unscoped object IDs. By enumerating auto-increment IDs on the /api/project , /api/asset , and /...

CVE-2026-121940 Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers

Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to rea...

PT-2026-136960

Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to rea...

CVE-2026-121940: Stonewuu ai-fusion-video: Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows…

Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to rea...

SUSE CVE-2026-72808

SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth unlike the /asset...

CVE-2026-72808 SiYuan before v3.7.4 Information Disclosure via getFileAnnotation

SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth unlike the /asset...

CVE-2026-72808

SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth unlike the /asset...

PT-2026-85352

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v7ph-r5r6-4jcj. This link is maintained to preserve external references. Original Description SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the...

CVE-2024-55659: Improper Limitation of a Pathname to a Restricted Directory

SiYuan is a personal knowledge management system. Prior to version 3.1.16, the /api/asset/upload endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting via the file write. Version 3.1.16 contains a patch for the issue...

CVE-2024-55659

SiYuan is a personal knowledge management system. Prior to version 3.1.16, the "/api/asset/upload" endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting via the file write. Version 3.1.16 contains a patch for the issue...

PT-2022-11551

Name of the Vulnerable Software and Affected Versions MasaCMS version 7.2.1 Description The issue is a path traversal vulnerability in the /index.cfm/ api/asset/image/ API endpoint. This allows for unauthorized access to files on the system. Recommendations For MasaCMS version 7.2.1, as a tempora...

CVE-2020-26525: Improper Neutralization of Special Elements used in an SQL Command

Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. This allows forcing the database and server to initiate remote connections to third party DNS servers...

PT-2020-16439

Name of the Vulnerable Software and Affected Versions Damstra Smart Asset version 2020.7 Description The issue allows for SQL injection via the "API/api/Asset" endpoint, specifically through the originator parameter. This enables an attacker to force the database and server to initiate remote...