31 matches found
Waline Login Accepts A Non-string Email As A Match-all MongoDB Query
Summary The login endpoint POST /api/token reads the "email" field from the request body without checking its type and passes it straight into the MongoDB storage query. When "email" is not a string for example a JSON object such as "$ne": null, the MongoDB storage adapter's parseWhere silently...
GHSA-JF75-Q64Q-G65R Waline login accepts a non-string email as a match-all MongoDB query
Summary The login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as "$ne": null, the MongoDB storage adapter's parseWhere silently DROPS...
Waline login accepts a non-string email as a match-all MongoDB query
Summary The login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as "$ne": null, the MongoDB storage adapter's parseWhere silently DROPS...
CVE-2026-55369
Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...
EUVD-2026-112060
Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...
CVE-2026-55369 Waline login accepts a non-string email as a match-all MongoDB query
Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...
CVE-2026-55369 Waline login accepts a non-string email as a match-all MongoDB query
Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...
CVE-2026-55369
Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...
CVE-2026-55369 Waline login accepts a non-string email as a match-all MongoDB query
Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...
CVE-2026-55369
The comment system Waline is vulnerable to a partial authentication bypass in versions prior to 1.41.1 . The POST /api/token login endpoint fails to validate the type of the email field in the request body. When a non-string value (e.g., a JSON object like `{
CVE-2026-55369: walinejs waline: Waline is a comment system with backend support
Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...
PT-2026-132067
Summary The login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as "$ne": null, the MongoDB storage adapter's parseWhere silently DROPS...
Waline authorization issue vulnerability
Waline versions 1.40.3 and earlier contain a security vulnerability. This vulnerability arises because the POST /api/token endpoint fails to validate the type of the email field before passing it directly to MongoDB for storage. As a result, non-string emails cause the field to be discarded,...
PT-2026-128224
Name of the Vulnerable Software and Affected Versions Waline versions prior to 1.41.1 Description The login endpoint 'POST /api/token' reads the email field from the request body without type validation and passes it directly into a MongoDB storage query. If the email field is provided as a...
EUVD-2022-29473
Malicious code in bioql PyPI...
CVE-2022-24594
In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...
MAL-2023-958 Malicious code in waline-magic (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a36651e1c228b2c1cc270f4d650d20db1da7126756f6ae78b407b803174a517 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in waline-magic (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a36651e1c228b2c1cc270f4d650d20db1da7126756f6ae78b407b803174a517 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in waline-magic
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
