CVE-2026-120444

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser,...

CVE-2026-120443

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executi...

CVE-2026-120444 GoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser,...

CVE-2026-120443

The GoFound application (versions through 1.4.1 ) is vulnerable to a stored cross-site scripting (XSS) flaw. An unauthenticated attacker can inject malicious scripts by submitting document text to the /api/index endpoint. The vulnerability occurs because the searcher/engine.go component returns u...

CVE-2026-120444

The GoFound software (through version 1.4.1 ) is vulnerable to a path traversal vulnerability. An unauthenticated attacker can delete arbitrary directories by supplying ../ sequences in the database parameter of the GET requests sent to /api/db/create and /api/db/drop . This flaw triggers the os....

EUVD-2026-115204

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser,...

EUVD-2026-115203

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executi...

com.github.snowdream.android:http (1.0), io.github.newpanjing:gofound-java (>=1.0.1, <=1.1) +6 more potentially affected by CVE-2019-1010206 via com.github.kevinsawicki:http-request (5.6)

com.github.kevinsawicki:http-request MAVEN version 5.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.github.kevinsawicki:http-request and may be impacted: - com.github.snowdream.android:http 1.0 - io.github.newpanjing:gofound-java =1.0.1, =1.3.2,...