CVE-2026-33528

GoDoxy is a reverse proxy and container orchestrator for self-hosters. Prior to version 0.27.5, the file content API endpoint at /api/v1/file/content is vulnerable to path traversal. The filename query parameter is passed directly to path.Joincommon.ConfigBasePath, filename where ConfigBasePath =...

CVE-2026-33528

GoDoxy contains a path traversal vulnerability in its file content API: HTTP request to /api/v1/file/content with a crafted filename parameter can bypass validation and cause access outside the intended config directory by exploiting how the path is joined with ConfigBasePath. An authenticated at...

PT-2026-27624

Name of the Vulnerable Software and Affected Versions GoDoxy versions prior to 0.27.5 Description GoDoxy, a reverse proxy and container orchestrator, contains a path traversal flaw in the file content API endpoint at /api/v1/file/content. The filename query parameter is directly used in...

GHSA-VXW4-WV6M-9HHH OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

Previously reported via email to [email protected] on 2025-11-17 per the security policy in opencode-sdk-js/SECURITY.md. No response received. Summary OpenCode automatically starts an unauthenticated HTTP server that allows any local process—or any website via permissive CORS—to execute arbitrary...

PT-2025-52571

Name of the Vulnerable Software and Affected Versions PostX plugin for WordPress versions up to and including 5.0.3 Description The PostX plugin for WordPress is affected by a flaw that allows unauthorized access to data. A missing capability check on the /ultp/v2/get dynamic content/ REST API...

CVE-2025-12584

The CVE CVE-2025-12584 affects the WordPress plugin Quick View for WooCommerce (versions up to 2.2.17). It exposes information via the wqv_popup_content AJAX endpoint due to insufficient access restrictions, allowing unauthenticated attackers to retrieve data from private products. The vulnerabil...

PT-2025-48252

The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv popup content' AJAX endpoint due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers...

CVE-2025-11368

The CWE/CVE entry CVE-2025-11368 maps to the LearnPress WordPress LMS Plugin. Affected versions are up to 4.2.9.4 (and versions prior to 4.2.9.5 as per PT-2025-47660). The root cause is missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax, enabling arbitrary callbac...

Ilevia EVE X1 Server 4.7.18.0.eden Parameter Traversal Arbitrary File Access

Summary EVE is a smart home and building automation solution designed for both residential and commercial environments, including malls, hotels, restaurants, bars, gyms, spas, boardrooms, and offices. It enables comprehensive control and monitoring of electrical installations through a highly...

PT-2024-20868 · Unknown · Bludit Cms

Name of the Vulnerable Software and Affected Versions: Bludit CMS version 3.15 Description: A Cross Site Scripting XSS issue allows remote attackers to execute arbitrary code and obtain sensitive information via the "edit-content.php" endpoint. The estimated number of potentially affected devices...

PT-2006-6099 · Contenido · Contenido Cms

Name of the Vulnerable Software and Affected Versions: Contenido CMS versions prior to 4.6.15 Description: A remote file inclusion issue allows remote attackers to execute arbitrary PHP code via a URL in the contenido path parameter to 1 "cms/dbfs.php" or 2 "cms/front content.php". Recommendation...