EUVD-2026-88048

A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource...

CVE-2026-100884

A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource...

CVE-2026-100884

A resource injection vulnerability exists in Krayin laravel-crm versions up to 2.2.5 within the attachment-download component. Specifically, the Storage::download function in packages/Webkul/Admin/src/Config/acl.php is susceptible to the manipulation of the ID argument, leading to improper contro...

CVE-2026-100884 Krayin laravel-crm attachment-download Endpoint acl.php resource injection

A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource...

CVE-2026-100884 Krayin laravel-crm attachment-download Endpoint acl.php resource injection

A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource...

CVE-2026-56723

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachme...

CVE-2026-56723 Zammad: Missing authorization on ticket attachment download

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachme...

CVE-2026-56723

The Zammad helpdesk and customer support system contains an authorization bypass in versions prior to 7.0.2 . While internal ticket articles are correctly hidden from customers via the article listing API, the attachment download endpoint fails to enforce article-level authorization. This allows ...

EUVD-2026-87205

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachme...

EUVD-2026-66213

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries n...

poc-cve-2026-32255

Kan SSRF mediante Descarga de Adjuntos CVE-2026-32255 - Prueba de Concepto Este repositorio contiene una prueba de concepto POC para CVE-2026-32255 , una vulnerabilidad de Server-Side Request Forgery SSRF de alta severidad en Kan , una herramienta de gestión de proyectos de código abierto. El...

CVE-2026-81021

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers...

CVE-2026-81021: Exposure of Sensitive Information to an Unauthorized Actor

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers...

PT-2026-88864

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers...

GHSA-F2XF-7X3G-4272 PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

Summary Stored cross-site scripting XSS in PrivateBin's attachment download link. An anonymous attacker can create a paste with a text/html attachment that, with certain user interaction, bypasses protections similar to CVE-2022-24833. When a victim opens the "Download attachment" link in a new...

PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

Summary Stored cross-site scripting XSS in PrivateBin's attachment download link. An anonymous attacker can create a paste with a text/html attachment that, with certain user interaction, bypasses protections similar to CVE-2022-24833. When a victim opens the "Download attachment" link in a new...

CVE-2026-55696 PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...

CVE-2026-55696 PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...

CVE-2026-55696

PrivateBin versions prior to 2.0.5 contain a stored XSS vulnerability in the attachment download link. The root cause is that DOMPurify sanitization in AttachmentViewer.setAttachment only applies to image/*svg MIME types, and the resulting sanitized blob is assigned to a local variable used for t...

CVE-2026-55696 PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...