CVE-2026-42569

🚨 CVE-2026-42569 - phpVMS Unauth Database Wipe Unauthenticated Database Wipe / Destructive Import in phpVMS 📌 Overview CVE-2026-42569 is a critical vulnerability in phpVMS Virtual Airline Management System that allows unauthenticated attackers to access legacy import endpoints. These endpoints we...

EUVD-2026-74925

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

CVE-2026-86748 Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

CVE-2026-86748 Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

CVE-2026-86748 Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

CVE-2026-86748

Snipe-IT versions before 8.7.0 contain a vulnerability in the restore endpoint where the database is wiped before the uploaded backup archive is validated. A superuser uploading a corrupted or invalid zip file triggers permanent data loss with no recovery path or rollback mechanism. The CVSS 3.1 ...

CVE-2026-53984

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

CVE-2026-53984 Ground Station prior to 0.6.0 Unauthenticated Database Wipe and Arbitrary Data Injection via Socket.IO database_backup full_restore Action

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

CVE-2026-53984

Ground Station (before 0.6.0) is vulnerable to unauthenticated database wipe and arbitrary data injection via Socket.IO. The database_backup full_restore handler accepts a caller-supplied SQL blob, enabling an unauthenticated network peer to drop or recreate the SQLite database (via attacker-cont...

CVE-2026-53984 Ground Station prior to 0.6.0 Unauthenticated Database Wipe and Arbitrary Data Injection via Socket.IO database_backup full_restore Action

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

CVE-2026-42569

phpVMS 7.x prior to 7.0.6 contains a critical, unauthenticated access flaw in the legacy importer feature that allows manipulation or deletion of data via the importer path. The weakness affects phpVMS 7.x up to 7.0.5 and was fixed in 7.0.6 (with later advisory notes referencing 7.0.7 for mitigat...

CVE-2026-42569 phpvms: /importer authorization bypass causing full database wipe

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6...

CVE-2026-42569 phpvms: /importer authorization bypass causing full database wipe

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6...

CVE-2026-42569 phpvms: /importer authorization bypass causing full database wipe

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6...

EUVD-2026-8753

Vikunja has Path Traversal in CLI Restore...

Vikunja has Path Traversal in CLI Restore

Summary Path Traversal Zip Slip and Denial of Service DoS vulnerability discovered in the Vikunja CLI's restore functionality. Details The restoreConfig function in vikunja/pkg/modules/dump/restore.go of the https://github.com/go-vikunja/vikunja/tree/main repository fails to sanitize file paths...

GHSA-42WG-38GX-85RH Vikunja has Path Traversal in CLI Restore

Summary Path Traversal Zip Slip and Denial of Service DoS vulnerability discovered in the Vikunja CLI's restore functionality. Details The restoreConfig function in vikunja/pkg/modules/dump/restore.go of the https://github.com/go-vikunja/vikunja/tree/main repository fails to sanitize file paths...

CVE-2026-27819

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archive. A maliciously crafted ZIP can bypass the...

CVE-2026-27819 Vikunja has Path Traversal in CLI Restore

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archive. A maliciously crafted ZIP can bypass the...

CVE-2026-27819 Vikunja has Path Traversal in CLI Restore

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archive. A maliciously crafted ZIP can bypass the...