68 matches found
CVE-2026-77427
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENTTOKENSKEY or metadata/persistenttokens.key can activate a published legacy compatibility key. If an attacker...
CVE-2026-77427
The self-hosted file manager FileRise versions 3.9.0 through 3.22.0 is vulnerable to an insecure default cryptographic key fallback in manual installations. If the PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key are missing, the system activates a published legacy compatibility key. An at...
CVE-2026-77427 FileRise: Insecure default cryptographic key fallback in manual installs
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENTTOKENSKEY or metadata/persistenttokens.key can activate a published legacy compatibility key. If an attacker...
EUVD-2026-101679
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENTTOKENSKEY or metadata/persistenttokens.key can activate a published legacy compatibility key. If an attacker...
CVE-2026-77427 FileRise: Insecure default cryptographic key fallback in manual installs
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENTTOKENSKEY or metadata/persistenttokens.key can activate a published legacy compatibility key. If an attacker...
CVE-2026-77427 FileRise: Insecure default cryptographic key fallback in manual installs
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENTTOKENSKEY or metadata/persistenttokens.key can activate a published legacy compatibility key. If an attacker...
CVE-2026-77427
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENTTOKENSKEY or metadata/persistenttokens.key can activate a published legacy compatibility key. If an attacker...
PT-2026-114286
Name of the Vulnerable Software and Affected Versions FileRise versions 3.9.0 through 3.21.0 Description Manual installations lacking a PERSISTENT TOKENS KEY or a metadata/persistent tokens.key file may activate a published legacy compatibility key. If an attacker obtains configuration or account...
CVE-2026-77427: Use of Hard-coded Credentials
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENTTOKENSKEY or metadata/persistenttokens.key can activate a published legacy compatibility key. If an attacker...
CVE-2026-108904
pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...
CVE-2026-108904
The pH7Builder (pH7 Social Dating CMS) version before 18.5.0 contains an information disclosure vulnerability. The root cause is that the UserController::users() and user() functions return unfiltered database rows to API clients. An attacker possessing a valid private API key can exploit this to...
CVE-2026-108904 pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController
pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...
CVE-2026-108904 pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController
pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...
EUVD-2026-97067
pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...
CVE-2026-108904
pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...
CVE-2026-108904 pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController
pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...
CVE-2026-108904: Insufficiently Protected Credentials
pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...
PT-2026-110214
pH7Builder pH7 Social Dating CMS before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users and user return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password...
PT-2026-96153
Name of the Vulnerable Software and Affected Versions ntopng versions prior to 6.7.260718 Description Authenticated non-administrator users can list and download system-configuration backups due to a missing administrator check in the endpoints 'scripts/lua/rest/v2/get/system/configurations/list...
CLEANSTART-2026-RG79000 Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period
Security vulnerability affects the vault package. Vault and Vault Enterprise’s “Vault” TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period...