Thorsten Rinne phpMyFAQ Permission and Access Control Vulnerabilities

Thorsten Rinne has identified vulnerabilities related to permission handling and access control in versions of phpMyFAQ prior to 4.2.0-beta and 4.2.0-alpha. These vulnerabilities stem from improper permission verification in the GroupController::saveCategoryRestrictions function. Restricted...

Thorsten Rinne phpMyFAQ Resource Management Error Vulnerabilities

Thorsten Rinne’s phpMyFAQ version prior to 4.2.0-beta and 4.2.0-alpha versions contained a resource management vulnerability. This vulnerability stemmed from unauthenticated faqs and search API endpoints, which experienced uncontrolled resource consumption. Attackers could send concurrent GET...

Thorsten Rinne phpMyFAQ Authorization Issues Vulnerability

Thorsten Rinne: Versions of phpMyFAQ from 4.0.0 to 4.1.9 and from 4.2.0-alpha to 4.2.0-beta have an authorization issue. This vulnerability arises because the PUT /api/v3.1/faq/update endpoint only checks the global editfaq permission without verifying access rights to the target FAQ. Certified...

Thorsten Rinne phpMyFAQ Cross-Site Request Forgery Vulnerability

Thorsten Rinne’s phpMyFAQ versions from 4.0.0 to 4.1.9 contained a cross-site request forgeing vulnerability. This vulnerability occurred when the POST /admin/api/update-database endpoint was used to execute database migrations, without verifying the CSRF token. This allowed attackers to trick...

Thorsten Rinne phpMyFAQ Authorization Issues Vulnerability

Thorsten Rinne reported an authorization issue in versions of phpMyFAQ between 3.2.0 and 4.1.9, as well as between 4.2.0-alpha and 4.2.0-beta. The issue stems from the GET /admin/api/user/data/userId API, which contains an insecure direct object reference. No checks are performed on SuperAdmin or...

CVE-2026-42269

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/datamigration/api/api.js passes the user-controlled exportid to cleanupdata without path validation...

CVE-2026-92263 SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

CVE-2026-92263

The SparkyFitness health and fitness tracker is vulnerable to OS command injection in versions prior to 1.6.0 . The flaw exists in the api/admin/backup/restore endpoint, where the application interpolates an uploaded filename directly into a shell command. An authenticated global administrator ca...

CVE-2026-92263

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

EUVD-2026-102913

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

CVE-2026-92263 SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

CVE-2026-92263 SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

CVE-2026-55836 Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

CVE-2026-55836

The Open Zaak data and services layer is vulnerable to path traversal and arbitrary server-file read in versions 1.13.0 through 1.27.2, 1.28.2, and 1.29.0. The root cause lies in the _import_document_row function within src/openzaak/components/documenten/tasks.py, which fails to validate that the...

CVE-2026-55836 Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

CVE-2026-55836 Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

EUVD-2026-102899

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/zoek do not filter result querysets according to the...

CVE-2026-106705

ELADMIN eladmin-mp up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu RoleController.updateRoleMenu authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither...

CVE-2026-63619

Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This...

CVE-2026-64959

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...