CVE-2026-121436

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

EUVD-2026-115858

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-121436

Froxlor versions 2.3.8 through 2.3.14 are vulnerable to an information disclosure flaw in api_keys.php . This issue stems from an unscoped WHERE 1 query , which allows administrators possessing the customers_see_all privilege to view the API keys and secrets of every account. A significant securi...

CVE-2026-121436 Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-121436: froxlor: Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with…

Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customersseeall to view every account's API key and secret through an unscoped WHERE 1 query in apikeys.php. Attackers can read the super administrator's apikey and secret from the...

CVE-2026-120201

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats...

EUVD-2026-114722

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats...

CVE-2026-120201 Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats...

CVE-2026-120201

Jpom versions 2.10.0 through 2.11.12 are vulnerable to an authentication bypass that allows unauthenticated attackers to obtain super-administrator access . The root cause is the improper neutralization of special elements in data query logic (CWE-943); specifically, attackers can inject query co...

CVE-2026-120201 Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats...

CVE-2026-120201 Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats...

CVE-2026-37068

CVE-2026-37068 Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected...

PT-2026-134520

Name of the Vulnerable Software and Affected Versions Jpom versions 2.10.0 through 2.11.12 Description An authentication bypass exists that allows unauthenticated attackers to gain super-administrator access. This is achieved by injecting query conditions into the JPOM-USER-TOKEN header...

CVE-2026-120201: dromara Jpom: Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to…

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats...

CVE-2026-112296

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

EUVD-2026-104277

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112296 FlyCms through commit edfdf724 Default Super Administrator Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112296 FlyCms through commit edfdf724 Default Super Administrator Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112296 FlyCms through commit edfdf724 Default Super Administrator Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112296

The FlyCms content management system (through commit edfdf724 ) is vulnerable to a default credentials vulnerability. This flaw allows unauthenticated remote attackers to gain super administrator access by logging into the flycms account using the default password admin123 via a POST request to /...