40 matches found
CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...
CVE-2026-19895: Improper Restriction of Excessive Authentication Attempts
A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...
CVE-2025-32781 Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/env/releases/releaseId while...
Malicious Package
Overview app-config-utility is a malicious package. This package contains malicious code, and its content has been removed from the official package manager. While this package typosquats well-known libraries to impersonate valid open-source ecosystems, there is no connection between those...
CVE-2026-3643
The Accessibly WordPress plugin (versions ≤ 3.0.3) is vulnerable to an unauthenticated Stored XSS via REST API endpoints /otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config. These endpoints have permission_callback set to __return_true, so no auth checks occur. updateWidgetOptions()...
CVE-2026-3643 Accessibly <= 3.0.3 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Widget Source Injection via REST API
The Accessibly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in all versions up to, and including, 3.0.3. The plugin registers REST API endpoints at /otm-ac/v1/update-widget-options and /otm-ac/v1/update-app-config with the permissioncallback set to returntrue...
CVE-2025-60949
Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha...
CVE-2025-60949: Exposure of Sensitive Information to an Unauthorized Actor
Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha...
Dinky 访问控制错误漏洞
Dinky is an open-source real-time computing platform developed by DataLinkDC. Versions of Dinky 1.2.5 and earlier contained a security vulnerability related to access control. This vulnerability stemmed from a missing authentication check in the addInterceptors function of the OpenAPI endpoint...
CVE-2025-68434: Cross-Site Request Forgery (CSRF)
Open Source Point of Sale opensourcepos is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery CSRF vulnerability exists in the application's filter configuration. The CSRF protection...
Malicious code in yandex-app-config (npm)
The package yandex-app-config was found to contain malicious code...
MAL-2025-40211 Malicious code in yandex-app-config (npm)
The package yandex-app-config was found to contain malicious code...
CVE-2024-47160
In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible...
PT-2024-32800 · Unknown · @Backstage/Plugin-App-Backend
Name of the Vulnerable Software and Affected Versions: @backstage/plugin-app-backend versions prior to 0.3.75 Description: The issue concerns the configuration supplied through APP CONFIG environment variables, where the visibility defined in the configuration schema is unexpectedly ignored. This...
JetBrains YouTrack < 2024.3.44799 Multiple Vulnerabilities
The version of JetBrains YouTrack installed on the remote host is prior to 2024.3.44799. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached t...
CVE-2024-47160
In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible...
CVE-2024-47160
In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible...
CVE-2024-47160
In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible...
CVE-2024-47160
JetBrains YouTrack before 2024.3.44799 is vulnerable to an issue where access to global application config data is possible without proper permissions. This CVE (CVE-2024-47160) is corroborated by multiple connected sources: Red Hat advisory, a Nessus plugin for JetBrains YouTrack