GHSA-54MM-6729-R5WP Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Summary Any authenticated Leantime user - including the lowest-privilege readonly role - can escalate to full administrative access by calling the JSON-RPC method leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role value. The server creates a new account at that role with n...

CVE-2026-108980

Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing...

EUVD-2026-97145

Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing...

CVE-2026-108980

Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing...

PT-2026-110423

Name of the Vulnerable Software and Affected Versions Blinko versions prior to 1.8.9 Description An issue exists where the plugin.installPlugin tRPC procedure, accessible to any authenticated user, fails to sanitize the plugin name used to build the installation path in server/routerTrpc/plugin.t...

CVE-2026-108980: Path Traversal: '../filedir'

Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing...

CVE-2026-79920 Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

CVE-2026-79920 Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

CVE-2026-79920

The Ajenti modular server admin panel (Linux & BSD) is vulnerable to local privilege escalation prior to version 2.2.16 . An authenticated user can call the /api/core/tasks/start endpoint to enqueue tasks like InstallPlugin , UnInstallPlugin , or UpgradeAll from plugins/plugins/tasks.py without t...

PerfreeBlog security vulnerabilities

PerfreeBlog is PerfreeBlog open source a java-based development of blog/CMS site building platform. PerfreeBlog v4.0.11 version of a security vulnerability , the vulnerability stems from installPlugin function has a file upload vulnerability...

EUVD-2025-35861

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function...

CVE-2025-60735

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function...

CVE-2025-60735

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function...

CVE-2025-60735: Unrestricted Upload of File with Dangerous Type

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function...

PT-2025-43664

Name of the Vulnerable Software and Affected Versions PerfreeBlog version 4.0.11 Description PerfreeBlog version 4.0.11 contains a File Upload issue within the installPlugin function. This allows for potential unauthorized file uploads. Recommendations Update to a newer version that contains a fi...

CVE-2025-60735

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function...

CVE-2025-60735

PerfreeBlog version 4.0.11 , a Java-based blog/CMS platform, contains a File Upload vulnerability within the installPlugin function. This flaw allows for the unrestricted upload of files with dangerous types , which could lead to potential unauthorized file execution or system compromise. Remedia...

GHSA-C9M9-48PW-6MPV apiconnect-cli-plugins vulnerable to OS Command Injection

apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the pluginUri argument. PoC js var root = require"apiconnect-cli-plugins"; var payload = "& touch Song &"; root.pluginLoader.installPluginpayload, ""; The injection point is...

PT-2020-19669

Name of the Vulnerable Software and Affected Versions apiconnect-cli-plugins versions 6.0.1 and earlier Description The issue allows execution of arbitrary commands via the pluginUri argument, enabling command injection. This can be exploited by passing malicious input to the...

OS Command Injection

strapi is vulnerable to OS Command Injection. The vulnerability exists as it does not sanitize nor validate plugin names in installPlugin and uninstallPlugin...