EUVD-2026-120539

VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or reque...

CVE-2026-125082

A security flaw exists in sunkaifei FlyCMS (up to commit e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a) within the Content Rendering component. Specifically, the ModelDataService.insertData function in the file articles/detail.html is vulnerable because it fails to properly handle the content argument...

EUVD-2026-120672

A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a. Affected by this vulnerability is the function ModelDataService.insertData of the file articles/detail.html of the component Content Rendering. Performing a manipulation of the argument content...

CVE-2026-125376

VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or reque...

PT-2026-141274

A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a. Affected by this vulnerability is the function ModelDataService.insertData of the file articles/detail.html of the component Content Rendering. Performing a manipulation of the argument content...

CVE-2026-125376: Mereithhh vanblog: VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read…

VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or reque...

CVE-2026-125082: sunkaifei FlyCMS: A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a

A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a. Affected by this vulnerability is the function ModelDataService.insertData of the file articles/detail.html of the component Content Rendering. Performing a manipulation of the argument content...

CVE-2026-125376 VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint

VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or reque...

CVE-2026-125376

VanBlog versions through 0.54.0 are vulnerable to an information disclosure vulnerability. An unauthenticated attacker can read private and hidden articles by accessing the POST /api/public/article/:id endpoint. The root cause is that the getByIdWithPassword function fails to check the hidden fla...

PT-2026-141199

VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or reque...

CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

Linux Distros Unpatched Vulnerability : CVE-2026-122032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back- office access to inject arbitrary SQL by submitting a...

DEBIAN-CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

EUVD-2026-116939

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

PT-2026-136996

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing spip sanitiz...

UBUNTU-CVE-2026-122032

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-122032: SPIP: SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access…

SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=articles endpoint, bypassing...

CVE-2026-102802

Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension 17.0.1 when used with Articles Anywhere extension 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere ca...