CVE-2026-43877: Cross-Site Request Forgery (CSRF)

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legacy profile-photo endpoint that accepts a base64 POST parameter and writes the decoded bytes to videos/userPhoto/photo .png. Its only access control is User::isLogged. It does not...

EUVD-2020-23902

Malware in sbrugna...

Smartstore SmartStoreNET 输入验证错误漏洞

Smartstore SmartStoreNET is an open source e-commerce Web platform of Germany Smartstore company . The platform includes CRM, CMS, sales, marketing, payment, order processing and other functions. A security vulnerability exists in Smartstore that allows CommonController.ClearCache,...

CVE-2020-36365: URL Redirection to Untrusted Site

Smartstore aka SmartStoreNET before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open redirect...