CVE-2026-103396

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

CVE-2026-103396

bbs-go through version 4.4.6 is vulnerable to a permission bypass within the AdminMiddleware authorization logic. The root cause is that the dashboard.user.view permission rule incorrectly matches the /api/admin/user/synccount endpoint before the required dashboard.user.update rule is evaluated. ...

EUVD-2026-89991

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

PT-2026-103290

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

CVE-2026-103396: Incorrect Authorization

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

EUVD-2021-24679

Malware in sbrugna...

EUVD-2023-40199

Malicious code in bioql PyPI...

EUVD-2023-40200

Malicious code in bioql PyPI...

CVE-2023-36222

Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the comment parameter in the article function...

CVE-2021-38221

bbs-go = 3.3.0 including Custom Edition is vulnerable to stored XSS...

CVE-2023-36223

Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the announcements parameter in the settings function...

CVE-2023-36222

Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the comment parameter in the article function...

CVE-2023-36223

Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the announcements parameter in the settings function...

Cross site scripting

Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the announcements parameter in the settings function...

bbs-go 跨站脚本漏洞

bbs-go is an open source community system built using the Go language by mlogclub open source. A cross-site scripting vulnerability exists in mlogclub bbs-go v. 3.5.5, which stems from a vulnerability that allows a remote attacker to execute arbitrary code via a crafted payload on the comment...

bbs-go 跨站脚本漏洞

bbs-go is an open source community system built using the Go language by mlogclub open source. A cross-site scripting vulnerability exists in mlogclub bbs-go v. 3.5.5, which stems from a vulnerability that allows a remote attacker to execute arbitrary code via a crafted payload on the announcemen...

CVE-2023-36223

Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the announcements parameter in the settings function...