Exploit for CVE-2026-52887

nocobase-cve-2026-52887 NocoBase security research and exploi...

Malicious Package

Overview daily-app-message is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-52887

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filterlatestMsgReceiveTimestamp$lt value was inserted into a...

PT-2026-60296

Name of the Vulnerable Software and Affected Versions NocoBase versions prior to 2.0.61 Description An issue exists in the @nocobase/plugin-notification-in-app-message where the 'GET /api/myInAppChannels:list' endpoint is exposed. A signed-up authenticated user can exploit this by providing a val...

MAL-2024-2060 Malicious code in daily-app-message (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in daily-app-message (npm)

--- -= Per source details. Do not edit below this line.=-...

Ecmall Sql injection first watches. - Vulnerability warning-the black bar safety net

Brief description: Hit a patch try. Detailed description: In the app/message. app. php function drop $msgids = isset$GET'msgid' ? trim$GET'msgid' : "; if !$ msgids $this-showwarning'nosuchmessage'; return; $msgids = explode',',$msgids; $modmessage = &m'message'; foreach $msgids as $key=$msgid...