21 matches found
CVE-2025-46080
BUGAuthor: yggcwhat Affected version: Huocms Vendor: https://huocms.com/ Source Code Address: https://gitee.com/digital-flag/huocms Vulnerability File: AttachmentController.php Affected Version： HuoCMS - controller -backend - AttachmentController.php:editFileUrl The suffix of $newPathUrl in the...
CVE-2026-116020
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or...
CVE-2026-116020 BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or...
EUVD-2026-109278
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or...
CVE-2026-116020
BookStack versions prior to 26.09.2 are vulnerable to an incorrect authorization flaw in the AttachmentController . This vulnerability allows authenticated users to access attachments belonging to other users' unpublished draft pages by identifying sequential attachment IDs. Attackers with suffic...
BookStackApp BookStack authorization issue vulnerability
BookStackApp versions prior to 26.09.2 contain an authorization issue vulnerability. This vulnerability stems from improper authorization in AttachmentController; authenticated attackers with attachment permissions can enumerate, download, rename, re-associate, or replace attachments within draft...
PT-2026-122601
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or...
CVE-2026-86285 BookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm access control
A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper acces...
CVE-2026-86285
A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper acces...
CVE-2023-27084
Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentController parameter...
CVE-2024-43033
JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentControllerupload. NOTE: this is unrelated to the attack vector for...
CVE-2024-43033
JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentControllerupload. NOTE: this is unrelated to the attack vector for...
CVE-2024-43033
JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentControllerupload. NOTE: this is unrelated to the attack vector for...
CVE-2024-43033: Improper Handling of Windows ::DATA Alternate Data Stream
JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentControllerupload. NOTE: this is unrelated to the attack vector for...
CVE-2024-43033
JPress versions through 5.1.1 on Windows are vulnerable to an arbitrary file upload vulnerability. The root cause is the improper handling of Windows ::$DATA alternate data streams within the io.jpress.web.commons.controller.AttachmentController#upload function. An attacker can exploit this to up...
Design/Logic Flaw
Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentController parameter...
CVE-2023-27084
CVE-2023-27084 concerns a permissions issue in isoftforce Dreamer CMS v4.0.1 that lets a local attacker access sensitive data via the AttachmentController parameter. The vulnerability is described as a local-attack, high confidentiality impact with medium overall CVSS (5.3) and no user interactio...
CVE-2023-27084: Incorrect Permission Assignment for Critical Resource
Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentController parameter...
Dreamer CMS security vulnerability
Dreamer CMS is a dreamer content management system by the individual developer Junnan Wang in China. A security vulnerability exists in isoftforce Dreamer CMS version v.4.0.1, which stems from a privilege vulnerability that can be exploited by a local attacker to gain access to sensitive...