EUVD-2026-97374

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file names, storage paths, MD5 hashes and...

EUVD-2026-97372

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which...

CVE-2026-109168

The lamp-cloud software (versions through 5.10.1 ) contains an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). This flaw allows authenticated users to access file attachments belonging to other business objects by providing an arbitrary bizId to the listFileByBizId endpoint. Impa...

CVE-2026-109166

Versions of lamp-cloud through 5.10.1 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). The root cause is located in the FileAnyoneController 's findUrlById handler, which fails to perform ownership verification. This allows authenticated users to retrieve acce...

CVE-2024-9756

🚀 WooCommerce Arbitrary File Upload Exploit CVE-2024-9756 📌 Overview This exploit leverages an unauthorized limited arbitrary file upload vulnerability in the Order Attachments for WooCommerce plugin versions 2.0 to 2.4.1 for WordPress. The vulnerability allows authenticated users Subscriber+ to...

gophish

Gophish fork This is a fork of Gophish: Open-Source Phishing Toolkit Gophish New features This fork has a focus on running real-life phishing campaigns for a single customer. The following features are added: Script to automatically setup a fully configured Gophish instance on a fresh VPS. This...

EUVD-2026-96615

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from...

CVE-2026-108676 JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from...

CVE-2026-108676

JeecgBoot versions up to and including 3.9.5 are vulnerable to a missing authorization flaw (CWE-862) in the SysAnnouncementController downLoadFiles handler. This vulnerability allows low-privileged authenticated users to bypass authorization checks by supplying a known announcement ID. An attack...

CVE-2026-108676

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from...

EUVD-2026-96319

Open Source Social Network OSSN through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossncom.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/guid route with sequentia...

CVE-2026-108164

Open Source Social Network (OSSN) versions up to and including 10.1 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the components/OssnMessages/ossn_com.php component. This flaw allows authenticated users to bypass sender and recipient verification by requesting the ...

CVE-2026-108164 Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route

Open Source Social Network OSSN through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossncom.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/guid route with sequentia...

CVE-2026-95684

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachmentsname' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-95684 VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachmentsname' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-95684

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.8.15 . The flaw resides in the 'attachments[name]' parameter due to insufficient input sanitization and output escaping . This allows unauthentic...

EUVD-2026-96223

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachmentsname' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

Atlassian Confluence Download Attachments - Remote Code Execution

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this pat...

CVE-2026-108101 HortusFox through 6.3 Unrestricted File Upload via Plant Attachments

HortusFox hortusfox-web through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored...

CVE-2026-107801

Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share i...