CVE-2026-105307 Casdoor API Endpoint authz_filter.go ApiFilter missing authentication

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authzfilter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...

CVE-2026-105307

A vulnerability exists in Casdoor up to version 3.161.1 involving the API Endpoint component. The issue resides in the ApiFilter function located within the routers/authz_filter.go file, where a manipulation can lead to missing authentication . This flaw allows for remote attacks. While an exploi...

CVE-2025-57819-FreePBX-RCE2Root

CVE-2025-57819 — FreePBX SQLi → RCE → Root Full-chain PoC for CVE-2025-57819. Unauthenticated error-based SQL injection in FreePBX's endpoint module chains into a root shell via cron job injection and incron privilege escalation. For authorized testing and research only. Do not use against system...

CVE-2026-105291 feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...

EUVD-2026-92402

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...

CVE-2026-105291 feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...

CVE-2026-105291

The software feelec-yishu feelcrm-os 1.0.0 contains a cross-site scripting (XSS) vulnerability in the Department Search Endpoint component. The root cause is located in the GroupController::index function within the file App/Feelcrm/Index/Controller/GroupController.class.php, where the manipulati...

CVE-2022-36804

CVE-2022-36804 - Vulnerabilidad de Inyección de Comandos en Atlassian Bitbucket Server y Data Center ⚠️ Solo con fines educativos y de investigación de seguridad autorizada Autores del Exploit Original Muy agradecido al autor original del PoC Walnut Security Services Pvt. Ltd Descripción Varios...

CVE-2024-9796

CVE-2024-9796 POC SQLi - CVE-2024-9796 PoC funcional para la vulnerabilidad CVE-2024-9796, que afecta al plugin WP Advanced Search autocompletion en WordPress, permitiendo una inyección SQL SQL Injection a través de parámetros GET no sanitizados. 📌 Descripción Esta vulnerabilidad permite a un...

CVE-2026-105290 feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery

A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is...

CVE-2026-105290 feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery

A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is...

CVE-2026-105290

The software feelec-yishu feelcrm-os version 1.0.0 is vulnerable to a server-side request forgery (SSRF) . The flaw exists within the getCurlData endpoint, specifically involving an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php. An attacker can remotely launch t...

CVE-2026-59788

A Stored XSS vulnerability exists in the email media type OAuth form because the application passes the Authorization endpoint value to window.open() without validating the URL scheme. This allows for the execution of a javascript: URL in the browser. An attacker can deliver a crafted media type ...

EUVD-2026-92400

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

CVE-2026-105288

A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirecturl leads to cross site scripting. The atta...

CVE-2026-105289 feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2026-105289

The feelec-yishu feelcrm-os version 1.0.0 is vulnerable to a Cross-Site Scripting (XSS) flaw within the Create Customer Endpoint component. The root cause is the use of the htmlspecialchars_decode function in the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php. An attacker can initiate...

EUVD-2026-92393

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2026-105289 feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2026-105288 feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting

A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirecturl leads to cross site scripting. The atta...