CVE-2026-71251 Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...

CVE-2026-71251

CVE-2026-71251 (Akaunting) : The shared download route app/Http/Controllers/Common/Uploads.php::download() allowed an authenticated portal customer to fetch any Media by ID without verifying ownership. This constitutes a cross-company IDOR: a user could download another company’s uploaded files b...

Arab Portal 2.x - forum.php SQL Injection

Arab Portal 2.x - forum.php SQL Injection getqc &&!isset$apt-getqp $qc = $apt-getqc; $result = $apt-query"select name,comment from rafiacomment where id='$qc'"; $row = $apt-dbarray$result; $apt-row'quote' = "\n\n\nQUOTE..... :".$row'name'."\n".$row'comment'."/QUOTE"; /code - Debug : code $qc =...