CVE-2026-119763

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter...

CVE-2026-119763 changelog.com before commit 7b35e829 Missing Authorization via Preview Routes

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter...

EUVD-2026-114240

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter...

CVE-2026-119763

The software changelog.com (prior to commit 7b35e829 ) is susceptible to a missing authorization vulnerability (CWE-862). This flaw allows unauthenticated attackers to access unpublished content through preview routes within the PostController , NewsIssueController , and NewsItemController . By e...

CVE-2026-119763 changelog.com before commit 7b35e829 Missing Authorization via Preview Routes

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter...

CVE-2026-119763: thechangelog changelog.com: changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated…

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter...

Relative Path Traversal

Overview mikopbx/core is a Free PBX system for SMB based on Asterisk Affected versions of this package are vulnerable to Relative Path Traversal via the PostController.php process. An attacker can execute arbitrary code and access sensitive files by uploading a crafted PHP script to an arbitrary...

PT-2025-27246 · Mikopbx · Mikopbx

Name of the Vulnerable Software and Affected Versions: MikoPBX versions through 2024.1.114 Description: The issue allows uploading a PHP script to an arbitrary directory due to a problem in the PBXCoreREST/Controllers/Files/PostController.php file. Recommendations: For MikoPBX versions through...

CVE-2025-52207

Summary: CVE-2025-52207 affects MikoPBX (MikoPBX/core) up to version 2024.1.114, where PBXCoreREST/Controllers/Files/PostController.php permits uploading a PHP script to an arbitrary directory. Impact (as stated): authenticated users can upload and execute arbitrary PHP, enabling remote code exec...

CVE-2019-11362

The CVE-2019-11362 entry describes an SQL injection in ROCBOSS V2.2.1, arising from unsafely handling the Post:doReward score parameter in app/controllers/frontend/PostController.php. The vulnerability is demonstrated via the /do/reward/3 URI. Connected documents confirm the same description acro...