CVE-2026-108799

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument...

EUVD-2026-97174

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument...

CVE-2026-108799

A SQL injection vulnerability exists in the jackq XCMS software (up to version 3fab5342cc509945a7ce1b8ec39d19f701b89261). The flaw is located in the Password Recovery Mail Endpoint component, specifically within the PublicController::sendFindPwdMail function of the Admin/Home/Controller/PublicCon...

CVE-2026-108799: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument...

PT-2026-110439

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument...

JackQ XCMS input validation error vulnerability

The JackQ XCMS 3fab5342cc509945a7ce1b8ec39d19f701b89261 and previous versions have security vulnerabilities. These vulnerabilities stem from improper handling of parameters in the PublicController::sendFindPwdMail function within the Password Recovery Mail Endpoint component. This improper handli...

CVE-2026-34577

Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is url.endsWith'mp4', which is trivially bypassable by...

CVE-2026-34577: Server-Side Request Forgery (SSRF)

Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is url.endsWith'mp4', which is trivially bypassable by...

PT-2023-23737 · Zhong Bang · Zhong Bang Crmeb

Name of the Vulnerable Software and Affected Versions: Zhong Bang CRMEB versions up to 4.6.0 Description: A vulnerability was found in the function put image of the file api/controller/v1/PublicController.php. The manipulation leads to deserialization. The attack can be launched remotely. The...

weiphp /Application/Admin/Controller/PublicController.class.php Login SQL Injection Vulnerability

weiphp is an open source, efficient, simple microsoft development platform. The weiphp /Application/Admin/Controller/PublicController.class.php login is vulnerable to SQL injection. Allow attackers to exploit the vulnerability to obtain sensitive database information...