CVE-2026-105630 Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a...

CVE-2026-104960

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-104960 Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-104960

The project management tool Plane contains an authorization bypass in the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint. Prior to version 1.4.0 , the application fails to enforce project-level access controls for project-bound FileAsset objects. Con...

CVE-2026-104960 Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

EUVD-2026-92481

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-104960 Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

mouseserver-exploit

Mobile Mouse 3.6.0.4 RCE - 修正版 Mobile Mouse 3.6.0.4 のリモートコード実行エクスプロイトの修正版で、EDB-51010 として公開されています。 脆弱性 CVE: CVE-2023-31902 影響を受けるバージョン: Mobile Mouse 3.6.0.4 デフォルトポート: TCP/9099 修正内容 元のエクスプロイトはペイロードのダウンロードには成功しますが、両方のステージが同じ TCP 接続を使用するため、実行に失敗する可能性があります。 この修正版では以下の処理を行います: 最初のセッションを通じてペイロードをダウンロード...

CVE-2026-102775

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

CVE-2026-102775 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

CVE-2026-102775

The Joomla Extension - phoca.cz (specifically Phoca Cart versions 5.0.0 - 6.1.8 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the order-file download endpoint. The application fails to validate provided d (download token) and o (order token) parameters against stored value...

CVE-2020-5398

CVE-2020-5398 - Spring MVC용 RFDReflected File Download 공격 Spring Framework 5.2.x5.2.3 미만, 5.1.x5.1.13 미만, 5.0.x5.0.16 미만 버전에서 사용자 입력에서 파생된 filename 속성을 사용하여 응답에 'Content-Disposition' 헤더를 설정하는 애플리케이션은 RFD반영된 파일 다운로드 공격에 취약합니다. 사용 방법 1. ./gradlew bootrun 127.0.0.1:8080에서 수신 대기. 2. $ curl...

CVE-2026-88394

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into...

CVE-2026-66916

JoomGallery の JSON 形式によるパスワード保護カテゴリのバイパス JoomGallery ≤ 4.3.0-stable — 未認証の攻撃者がパスワードゲートをバイパスして保護された画像をダウンロード可能 概要 JoomGallery のカテゴリ JSON ビューに、未認証のアクセス制御バイパスが存在します。ギャラリーカテゴリがパスワードで保護されている場合、HTML ビューはパスワードゲートを正しく強制しますが、JSON ビュー（format=json）はこのチェックを完全にスキップします。...

CVE-2021-26855-d

基本的な使い方:python owamails.py -u -l -p オプション引数: -h, --help show this help message and exit -u URL, --url URL Url, provide schema and not final / eg https://example.org -l LIST, --list LIST Users mailbox list -p PATH, --path PATH Path to write emails in xml format -f FQDN, --fqdn FQDN FQDN -d DOMAIN,...

CVE-2024-1303---Badgermeter-moni-tool-Path-Traversal

CVE-2024-1303 --- Badgermeter moni tool - パストラバーサル https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool CVE-2024-1303: 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | CWE-22. ソフトウェアリンク : https://www.s-can.at/en/product/monitool/ バージョン : 4.6.3...

AOSP-DownloadProviderDbDumper

AOSP-DownloadProviderDbDumper AndroidのダウンロードプロバイダにおけるSQLインジェクションを悪用するPoC CVE-2018-9493 セキュリティアドバイザリ https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-SQL-Injection-CVE-2018-9493.pdf 詳細情報...

CVE-2026-60093

CVE-2026-60093 — path traversal en camel-azure-storage-datalake downloadToFile Reproductores de prueba de concepto ejecutables para la misma vulnerabilidad de Apache Camel, uno por runtime: Runtime| Directorio| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 +...

WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by dutafi in WordPress Plugin Piotnet Addons For Elementor versions = 7.1.71...

Astra Linux – Vulnerability in OpenSSH

In OpenSSH 8.2, the scp client incorrectly sends duplicate responses to the server when a utimes system call fails. This allows a malicious, unprivileged user on the remote server to overwrite arbitrary files in the client’s download directory by creating a crafted subdirectory anywhere on the...