CVE-2026-119705

SerpBear versions before 3.1.1 are vulnerable to a missing authentication flaw in the pages/api/notify.ts component. The root cause is that the verifyUser() function is never invoked, allowing remote unauthenticated attackers to send repeated POST requests to /api/notify. This can be used to floo...

CVE-2026-119705 SerpBear before 3.1.1 Missing Authentication via POST /api/notify

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust...

Xxe

An XML External Entity XXE vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files...