pybbs code injection vulnerability

pybbs is a Java-developed community platform created by iuiu’s individual developers. Version 6.0.0 of pybbs contains a code injection vulnerability. This vulnerability stems from a cross-site scripting attack in the create function located in the file...

EUVD-2026-5705

WeKan versions prior to 8.19 contain an insecure direct object reference IDOR in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier...

PHPCMS_V9 /modules/comment/index.php 本地包含漏洞

由于PHPCMSV9文件attachments.php的未验证上传用户权限，可以上传文件仅图片。加上其他文件存在可以截断的本地包含漏洞，导致包含任意文件并获取webshell 文件\phpcms\modules\attachment\attachments.php codepublic function cropupload if isset$GLOBALS"HTTPRAWPOSTDATA" $pic = $GLOBALS"HTTPRAWPOSTDATA"; …… fileputcontents$this-uploadpath.$filepath.$newfile, $pic;/code...