Nezhahq Nezha resource management error vulnerability

In versions from 1.0.0 to 2.3.15, there was a resource management error vulnerability in the dashboard file manager. This vulnerability stemmed from the fact that the fmStream in the WebSocket endpoint of the file manager did not call SetReadLimit. As a result, the message size became unlimited,...

PickMall Lilishop authorization issue vulnerability

PickMall Lilishop versions 5.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of ownership checks in the ReceiptServiceImpl.getDetail method. Unsafe direct object references exist, allowing attackers to provide the receipt IDs of other buyers and...

Exrick XBoot Authorization Issue Vulnerability

Exrick XBoot 3.3.4 and earlier versions have an authorization issue vulnerability. This vulnerability arises from the failure to validate the scope of role data. Attackers can exploit this vulnerability by making a GET request to xboot/user/getByDepartmentId/departmentId, with any department ID...

Wayn111 Waynboot-Mall Authorization Issue Vulnerability

Wayn111 and Waynboot-Mall versions 2.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of authentication at the /callback/order/unpaid endpoint. Unverified attackers can cancel pending orders for any member by submitting a predictable orderSn value...

Devolutions Server Authorization Issue Vulnerability

Devolutions Server 2026.3.8.0 and earlier versions have an authorization issue vulnerability. This vulnerability stems from improper access control of asset contact passwords. Certified users who have regular editing permissions but do not have editing rights for assets can modify asset contact...

FastAPIAdmin encryption issue vulnerability

In FastAPIAdmin versions 3.0 and earlier, there is a security vulnerability related to encryption. This vulnerability stems from the hardcoded JWT signing key in the backend/app/config/setting.py file. An attacker can register and log in through the unvalidated /api/v1/system/user/register...

Nezhahq Nezha information leakage vulnerability

Versions of Nezhahq Nezha from 2.2.5 to 2.3.15 contained an information leakage vulnerability. This vulnerability stemmed from the fact that listDDNS did not anonymize the WebhookURL and WebhookRequestBody. Administrators or PATs with the nezha:ddns:read permission could read the plaintext tokens...

FastapiAdmin authorization issue vulnerability

In FastAPIAdmin versions 3.0 and earlier, there is an authorization issue vulnerability. This vulnerability stems from the lack of protection for the automatic login endpoint. Unauthorized attackers can list users through /api/v1/auth/auto-login/users, obtain the superuser automatic login token,...

IoTSharp authorization issue vulnerability

IoTSharp 3.6.1 and earlier versions have an authorization issue vulnerability. This vulnerability arises from the fact that the Customers and Devices API handlers do not limit the query scope to the caller’s tenant. There is a potential for insecure direct object references. Attackers can registe...

PBH-BTN PeerBanHelper SQL Injection Vulnerability

The PBH-BTN PeerBanHelper versions from 5.0.0 to 9.3.15 had an SQL injection vulnerability. This vulnerability stemmed from the /api/statistic/analysis/field endpoint, which improperly handled field query parameters provided by authenticated users. The mapField method did not clean up unrecognize...

Hui Ge Open Source Charging Station Platform HUIZHI-ChargeOS-cloud: Authorization Issues and Vulnerabilities

The HUIZHI-ChargeOS-cloud 3.0.9 and earlier versions have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification at the hcp-mp PayController.xcxRecharge endpoint. Attackers can send requests using arbitrary amount and userId parameters, thereby...

O2OA Authorization Issue Vulnerability

O2OA 10.0.2-ce and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of verification in xprocessplatformassemblesurface for the ActionDownloadWithWork and ActionDownloadWithWorkStream methods to ensure that the requested attachment ID belongs to th...

WordPress MailOptin: Permissions, permissions grants, and access control issues

WordPress MailOptin 1.2.78.6 and earlier versions have vulnerabilities related to permission granting and access control. This vulnerability arises from the subscribetoemaillist endpoint accepting the optindataformcustomfieldmappings parameter provided by attackers, without any validation of the...

Mattermost information leakage vulnerability

Mattermost versions 11.9.1 and earlier of 11.9.x series, 11.8.5 and earlier of 11.8.x series, 11.7.10 and earlier of 11.7.x series, and 11.10.1 and earlier of 11.10.x series have a vulnerability related to information leakage. This vulnerability arises from the fact that the activity channel fiel...

Hellohao Authorization Issue Vulnerability

Hellohao 20240319 and earlier versions have an authorization issue vulnerability. This vulnerability stems from an absence of authorization checks. Any authenticated user can rename other users’ images through the /admin/setImgFileName endpoint. An attacker can provide the victim’s publicly...

My Railgun Sakon Network Barrage Service Authorization Vulnerability

My Railgun Sakon Network Barrage Service versions 2.8.9 and earlier have an authorization issue vulnerability. This vulnerability stems from an unprotected POST /api/ui/config-history/rollback endpoint that allows authentication bypass. This allows unauthenticated attackers to write arbitrary...

Steedos Platform Authorization Vulnerability

The Steedos Platform versions 3.0.15-beta.51 and earlier have an authorization issue vulnerability. This vulnerability stems from objectql’s callAdapter, which skips space filtering for the enablespaceglobal object during the find/findOne operation. As a result, authenticated attackers can read t...

Rocboss PaoPao Authorization Issue Vulnerability

Robcoboss PaoPao versions 0.6.0-alpha.3 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the DownloadAttachment function. Attackers can enumerate consecutive postcontent IDs through the /v1/attachment endpoint, thereby...

eladmin Permission Authorization and Access Control Vulnerabilities

The eladmin 2.7 and earlier versions have vulnerabilities related to permission authorization and access control. These vulnerabilities stem from improper access control in the role management module. The PUT /api/roles/menu RoleController.updateRoleMenu endpoint authorizes only by comparing the...

WordPress Mail Mint SQL Injection Vulnerability

WordPress Mail Mint 1.31.4 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper handling of the filters parameter in the /wp-json/mrm/v1/segments/contacts REST endpoint. The value of the filter parameter provided by users is insufficiently escaped. In li...