24 matches found
Exploit for CVE-2026-104051
CVE-2026-104051 — Sensitive Information Disclosure via info...
EUVD-2026-91065
PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...
CVE-2026-104051
PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...
CVE-2026-104051
PictShare versions prior to 3.7.1 are vulnerable to an information disclosure vulnerability via the API::info() endpoint. The root cause is the lack of a field whitelist, allowing unauthenticated attackers to retrieve complete raw metadata objects. By using a publicly visible file hash, an attack...
PT-2026-104019
Name of the Vulnerable Software and Affected Versions PictShare versions prior to 3.7.1 Description An information disclosure issue exists where unauthenticated attackers can obtain the secret delete code and uploader metadata. This occurs when calling the 'API::info' endpoint, which returns the...
EUVD-2026-44933
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by kiota info...
CVE-2026-32142 shopware/commercial: `/api/_info/config` route exposes information about licenses
Shopware is an open commerce platform. /api/info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15...
CVE-2026-32100
Shopware is an open commerce platform. /api/info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7...
CVE-2026-32100
Shopware is an open commerce platform. /api/info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7...
CVE-2026-30933 FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and...
FileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info
Summary The remediation for CVE-2026-27611 appears incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info in docker image gtstef/filebrowser:1.3.1-webdav-2. Details The issue stems from two flaws: 1. Tokenized download URLs are written into the...
CVE-2026-2108: Improper Resource Shutdown or Release
A vulnerability was determined in jsbroks COCO Annotator up to 0.11.1. This impacts an unknown function of the file /api/info/longtask of the component Endpoint. This manipulation causes denial of service. The attack may be initiated remotely. The exploit has been publicly disclosed and may be...
CVE-2024-33789
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the ipurl parameter at /API/info form endpoint...
Linksys E5600 Command Injection Vulnerability
Linksys E5600 is a powerful, compact and reliable WiFi 5 router from Linksys USA. A command injection vulnerability exists in the Linksys E5600 v1.1.0.26, which stems from the failure of the PinCode parameter of the /API/info form endpoint to properly filter constructed command special characters...
CVE-2024-33788
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the PinCode parameter at /API/info form endpoint...
CVE-2024-33788
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the PinCode parameter at /API/info form endpoint...
CVE-2024-33788
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the PinCode parameter at /API/info form endpoint...
CVE-2024-33788: Improper Neutralization of Special Elements used in a Command
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the PinCode parameter at /API/info form endpoint...
CVE-2024-33788
The Linksys E5600 router, specifically version 1.1.0.26 , contains a command injection vulnerability in its microprogramming software. The flaw exists within the /API/info form endpoint because the PinCode parameter fails to properly filter or neutralize special characters used in operating syste...