CVE-2026-110324

The Gitea platform is vulnerable to a private profile information disclosure via a POST request . The vulnerability exists because visibility checks were only enforced on GET requests; the POST /{username} endpoint (used for follow/unfollow actions) only required a signed-in session. Consequently...

CVE-2026-110324 Gitea private profile information disclosure through POST request

The visibility check of Gitea user profiles was applied to GET requests only, while POST /username follow and unfollow required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response...

SQL Injection Vulnerability in Shield Spirit Public Number Promotion System Login.php

Shield Spirit public number promotion system is mainly applied to public number promotion affiliate. A SQL injection vulnerability exists in the login.php of the Shield Spirit public number promotion system. Since the username variable in the statement gets data directly from post, it allows...