315 matches found
CVE-2026-67204
BookStack before 26.05.4 contains a broken access control vulnerability in the Image Gallery API endpoints . The API controller loads any image type without the content-type restrictions enforced by the web controller's gallery and drawio checks. An authenticated user with image-update or image-d...
CVE-2026-67204 BookStack < 26.05.4 Broken Access Control via Image Gallery API
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...
CVE-2026-67204: Incorrect Authorization
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...
PT-2026-80904
BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...
BookStack Login Panel - Detect
Bookstack login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Bookstack login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'BookStack Login Panel - Detect', 'description':...
📄 BookStack Denial of Service
This Python3 script demonstrates a denial of service condition against a BookStack search endpoint by generating extremely large search queries and sending them with high levels of concurrency. Versions prior to 25.12.1 are affected...
📄 BookStack Denial of Service
This Metasploit auxiliary module targets a denial of service vulnerability in BookStack versions prior to 25.12.1 by abusing the search system. ================================================================================================================================== | Title : BookStack...
BookStack 25.12.1 - Denial of Service
Exploit Title: BookStack 25.12.1 - Denial of Service Search Terms Resource Exhaustion Date: 2026-04-29 Exploit Author: Gabriel Rodrigues TEXUGO Vendor Homepage: https://www.bookstackapp.com Software Link: https://github.com/BookStackApp/BookStack Version: 2 else None searchurl =...
📄 BookStack 25.12.1 Denial of Service
BookStack version 25.12.1 suffers from a denial of service vulnerability. Exploit Title: BookStack 25.12.1 - Denial of Service Search Terms Resource Exhaustion Date: 2026-04-29 Exploit Author: Gabriel Rodrigues TEXUGO Vendor Homepage: https://www.bookstackapp.com Software Link:...
CVE-2026-5484
A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of the component Chapter Export Handler. Executing a manipulation of the argument pages can lead to improper access controls. It is possible...
CVE-2026-5484
A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of the component Chapter Export Handler. Executing a manipulation of the argument pages can lead to improper access controls. It is possible...
CVE-2026-5484
Summary (CVE-2026-5484) : BookStackApp BookStack (up to 26.03) contains a vulnerability in the function chapterToMarkdown within app/Exports/ExportFormatter.php of the Chapter Export Handler . Manipulating the argument pages can bypass access controls, enabling a remote attack. The exploit is pub...
PT-2026-30222
Name of the Vulnerable Software and Affected Versions BookStack versions prior to 26.03.1 Description An issue exists in the Chapter Export Handler component within the chapterToMarkdown function of the app/Exports/ExportFormatter.php file. A remote attacker can manipulate the pages argument to...
BookStack access control vulnerability
BookStack is a simple, self-hosted, and easy-to-use platform by BookStack Inc. It is used for organizing and storing information. Versions of BookStack prior to 26.03 contained a security vulnerability related to access control. This vulnerability stemmed from improper handling of the pages...
CVE-2026-5484: Improper Access Control
A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of the component Chapter Export Handler. Executing a manipulation of the argument pages can lead to improper access controls. It is possible...
CVE-2022-0877
Cross-site Scripting XSS - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3...
EUVD-2017-1589
Malware in sbrugna...
EUVD-2021-2401
Malware in sbrugna...