CVE-2026-101063 Obot before v0.23.0 Authentication Bypass via Registry API

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...

CVE-2026-101063 Obot before v0.23.0 Authentication Bypass via Registry API

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...

EUVD-2026-88032

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...

CVE-2026-101063: Missing Authorization

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/ when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to...

GHSA-PR6H-VR44-XQ8J Obot: MCP Registry API readable without authentication

Summary In affected versions, enabling registry authentication OBOTSERVERENABLEREGISTRYAUTH=true does not actually protect the MCP Registry endpoints under /v0.1/ — they remain readable by unauthenticated callers. Am I affected? You are affected if you run Obot = v0.22.1 with...

CVE-2026-44430: Server-Side Request Forgery (SSRF)

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification POST /v0/auth/http, POST /v0.1/auth/http uses safeDialContext internal/api/handlers/v0/auth/http.go:67-110 to refuse dialling...

CVE-2024-39248

A cross-site scripting XSS vulnerability in SimpCMS v0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field at /admin.php...

CVE-2024-39248

A cross-site scripting XSS vulnerability in SimpCMS v0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field at /admin.php...

CVE-2024-39248

SimpCMS v0.1 is affected by an XSS in the Title field at /admin.php. Root cause cited across sources is lack of proper filtering/escaping of user input, enabling arbitrary web script or HTML execution. Impacted functionality is the admin input for the Title, with the potential for full script exe...

EMH CMS 0.1 Cross Site Scripting

==================================================================================================================================== | Title : EMH CMS v0.1 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 66.0.364-bit | | Vendor :...

Piyanas 0.1 Cross Site Request Forgery

==================================================================================================================================== | Title : Piyanas v0.1 User Login Page CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | ...

CVE-2022-34501

CVE-2022-34501 concerns the bin-collection package for Python (PyPI) prior to v0.1, where a third-party backdoor enables code execution. The vulnerability affects the library’s handling of external packages mirrored from various sources, allowing an attacker to inject and execute malicious code. ...

Cross site scripting

An issue was discovered in Gris CMS v0.1. There is a Persistent XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML via admin/dashboard...

CVE-2020-22000: Improper Neutralization of Special Elements used in an OS Command

HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell commands as the web user via the 'setcommandon' and 'setcommandoff' POST parameters in...

Call of Duty Cheats Expose Gamers to Malware

Activision, the company behind Call of Duty: Warzone, has issued a warning that a threat actor is taking out ads for cheat tools, which instead turn out to be remote-access trojan RAT malware . The scam was first floated in March when a cyberattacker posted in hacking forums that they had a free,...

Slim CMS 0.1 Cross Site Request Forgery

input type="hidden" name="url" value="http://localhost/SlimCMS"...

SlimCMS 0.1 - Cross-Site Request Forgery (Change Admin Password)

Exploit for php platform in category web applications input ty...

eCan 0.1 - Local File Disclosure Vulnerability

No description provided by source. Exploit Title: eCan v0.1 = Local File Disclosure Vulnerability Date: 11/07/2012 Author: GoLdM Vendor or Software Link: http://sourceforge.net/projects/ecan/ Version: 1.03 Category:: Local File Disclosure Vulnerability2 Tested on: Xp SP 2 Ex : eCan...

Light HTTPd 0.1 (Windows) - Remote Buffer Overflow

import urllib2 from time import sleep TitleWindows Light HTTPD v0.1 HTTP GET Buffer Overflow Discovered and Reported24th of April, 2013 Discovered/Exploited ByJacob Holcomb/Gimppy042 Software Vendorhttp://sourceforge.net/projects/lhttpd/?source=navbar Exploit/Advisoryhttp://infosec42.blogspot.com...

eCan 0.1 File Disclosure

Exploit Title: eCan v0.1 = Local File Disclosure Vulnerability Date: 11/07/2012 Author: GoLdM Vendor or Software Link: http://sourceforge.net/projects/ecan/ Version: 1.03 Category:: Local File Disclosure Vulnerability2 Tested on: Xp SP 2 Ex : eCan...