CVE-2026-86041

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New without configuring SetTrustedProxies, causing c.ClientIP to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can suppl...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Gin CORS middleware vulnerability (USN-8983-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8983-1 advisory. It was discovered that the Gin CORS middleware incorrectly handled wildcards at the end of origin strings. A remote attacker could possibl...

Gin-Vue-admin-poc-CVE-2022-21660

Gin-Vue-admin Vertical Privilege Escalation Vulnerability and Code Analysis - CVE-2022-21660 1. Foreword Welcome everyone to give this project a star.http https://github.com/flipped-aurora/gin-vue-admin/ After finishing the article, applying for a CVE was somewhat troublesome, but fortunately it...

gin-vulnerable

gin-vulnerable Demo consumer pinned to github.com/gin-gonic/gin v1.7.0 vulnerable to CVE-2023-29401. The /download/:filename handler passes user input directly to Context.FileAttachment — the exploit-condition pattern Endor flags as exploitable...

CVE-2026-110738

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting XSS. This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16...

CVE-2026-110738 Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting XSS. This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16...

EUVD-2026-113556

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting XSS. This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16...

CVE-2026-110738

The Gin Admin Theme for Drupal (versions 0.0.0 to 4.1.4 and 5.0.0 to 5.0.16) is vulnerable to Cross-Site Scripting (XSS) due to the improper sanitization of certain HTML or URL attributes. This flaw allows for script injection but is mitigated by the requirement that an attacker must possess spec...

CVE-2026-110738 Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting XSS. This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16...

CVE-2026-110738: Drupal Gin Admin Theme: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin…

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting XSS. This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16...

Drupal Gin Admin Theme cross-site scripting vulnerability

Drupal Gin Admin Theme versions prior to 0.0.0 and 4.1.4, as well as versions prior to 5.0.0 and 5.0.16, contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation and makes them susceptible to cross-site scripting attacks...

CVE-2026-114492

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...

EUVD-2026-107420

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...

CVE-2026-114492 gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...

CVE-2026-114492 gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...

CVE-2026-114492

The gin-vue-admin framework (versions through 2.9.2 ) is vulnerable to a path traversal vulnerability in the /autoCode/removePlugin endpoint. An authenticated administrator can send a crafted POST request containing ../ sequences in the pluginName parameter, triggering the os.RemoveAll function. ...

CVE-2026-114492 gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...

CVE-2026-114492

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...

flipped-aurora Gin-Vue-Admin path traversal vulnerability

Flipped-Aurora Gin-Vue-Admin versions 2.9.2 and earlier contain a path traversal vulnerability. This vulnerability arises from improper handling of the pluginName parameter, which may allow authenticated administrators to send specially crafted requests containing ../ sequences to...

PT-2026-120742

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...