CVE-2026-111646

SurveyKing versions before 1.13.0 are vulnerable to an unauthenticated file download flaw due to missing authorization. Attackers can exploit the GET /api/public/preview/{attachmentId} endpoint to bypass shared, owner, and project checks within FileServiceImpl.loadFile . By knowing or deriving ti...

CVE-2026-111646 SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview

SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/attachmentId. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks i...

EUVD-2026-103057

Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an allowed extension...

CVE-2026-111635 Helical Insight through 7.0.0 Path Traversal via /getExternalResource

Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an allowed extension...

CVE-2026-111635

Helical Insight through 7.0.0 is vulnerable to a path traversal vulnerability (CWE-22) within the /getExternalResource endpoint. This flaw allows authenticated viewers to bypass per-resource access controls by supplying parent-directory segments in the path parameter . Successful exploitation ena...

CVE-2026-111618 CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints

CoAI Chat Nio through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated...

CVE-2026-111613

AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with...

EUVD-2026-103035

AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with...

CVE-2026-13249

CVE-2026-13249 — Honeywell PD45 Unauthenticated File Upload RCE Python 3 PoC for CVE-2026-13249 — Honeywell PD45 Industrial Printer web management interface. Description PoCbit / GitHub CVE-2026-13249 — Firmware F10.19.010040 through before F10.22.030745 exposes an unauthenticated arbitrary file...

DEBIAN-CVE-2026-85985

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

CVE-2026-85985

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

server

Ulterius: Easy Remote Management Interested in sublicensing? Want to use our code in your stack or rebrand it for internal use? Reach out to us at [email protected] Ulterius is a tool that allows unfettered access to a Windows system via a remote web interface. This program allows you to sta...

CVE-2026-27540

🌐 Language / Dil 📌 Özet WooCommerce Wholesale Lead Capture WWLC — Kimlik doğrulamasız dosya yükleme → RCE | ---|--- Ürün| WooCommerce Wholesale Lead Capture — wwlc eklentisi Sürüm| ≤ 2.0.3.1 Fixed| 2.0.3.2+ — upload handler korumalı Auth| Unauthenticated Vektör|...

frappe-erpnext-2026-pocs

Frappe and ERPNext security research Proof-of-concept clients...

amasty-chekout-POC-rce

CVE-2026-53787 - Amasty Order Attributes Unauthenticated File Upload Description CVE-2026-53787 is a critical unauthenticated arbitrary file upload vulnerability in the Amasty Order Attributes extension for Magento 2 versions prior to 4.0.0 . The vulnerability allows attackers to upload files of...

CVE-2026-92262

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql50 bypass prefix is affected because it allows the mysql50 prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue wit...

CVE-2026-96424

Incorrect DBus policy for lomiri-upload-manager part of lomiri-download-manager allows arbitrary user to read arbitrary file as root over DBus...

CVE-2026-85985 MariaDB: Unauthorized file access via CONNECT engine UDFs

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

CVE-2026-85985

The MariaDB server is vulnerable to unauthorized file access due to a missing authorization check in the CONNECT engine plugin. Specifically, the file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() do not enforce the FILE privilege or the secure_file_priv settin...

CVE-2026-85985

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...