25 matches found
CVE-2026-111699
Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to rea...
CVE-2026-111699 Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie
Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to rea...
CVE-2026-111699
The Niefy wx-api software, in versions through 0.8.2 , is vulnerable to an authentication bypass due to the use of unverified openid cookies . An unauthenticated attacker who knows a victim's openid can impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. This allow...
CVE-2026-111699
Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to rea...
CVE-2026-111699 Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie
Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to rea...
EUVD-2026-102990
Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to rea...
PT-2026-116098
šØ CVE-2026-111699 Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTag...
CVE-2026-111699: Missing Authentication for Critical Function
Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to rea...
Niefy wx-api authorization issue vulnerability
Niefy wx-api versions 0.8.2 and earlier have an authorization issue vulnerability. This vulnerability stems from an authentication bypass flaw, allowing unverified attackers to impersonate WeChat fans by providing the original openid cookie to fan-oriented controllers. These attackers can then ca...
CGM CLININET SQL Injection Vulnerability (CNVD-2025-19810)
CGM CLININET is a hospital information management system from CGM Germany. CGM CLININET suffers from a SQL injection vulnerability that originates from the lack of validation of the UserID parameter of the getUserInfo function against external input SQL statements. An attacker can exploit this...
CVE-2025-30060
In the ReturnUserUnitsXML.pl service, the "getUserInfo" function is vulnerable to SQL injection through the "UserID" parameter...
CVE-2025-30060 SQL injection in ReturnUserUnitsXML.pl via the UserID parameter
In the ReturnUserUnitsXML.pl service, the "getUserInfo" function is vulnerable to SQL injection through the "UserID" parameter...
CVE-2025-30060 SQL injection in ReturnUserUnitsXML.pl via the UserID parameter
In the ReturnUserUnitsXML.pl service, the "getUserInfo" function is vulnerable to SQL injection through the "UserID" parameter...
CVE-2025-30060: Improper Neutralization of Special Elements used in an SQL Command
In the ReturnUserUnitsXML.pl service, the "getUserInfo" function is vulnerable to SQL injection through the "UserID" parameter...
CGM Clininet SQL injection vulnerability
CGM CLININET is a hospital information management system from German company CGM. CGM CLININET suffers from a SQL injection vulnerability that stems from improper handling of the UserID parameter in the getUserInfo function, which could lead to a SQL injection attack...
Cisco UCS-IMC Supervisor 2.2.0.0 Authentication Bypass
Exploit Title: Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass + Cisco IMC Supervisor - 2.2.1.0 + Date: 08/21/2019 + Affected Component: /app/ui/ClientServlet?apiName=GetUserInfo + Vendor:...
Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass Vulnerability
Exploit Title: Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass + Cisco IMC Supervisor - 2.2.1.0 + Affected Component: /app/ui/ClientServlet?apiName=GetUserInfo + Vendor:...
CVE-2020-11704
An issue was discovered in ProVide formerly zFTPServer through 13.1. The Admin Web Interface has Multiple Stored and Reflected XSS. GetInheritedProperties is Reflected via the groups parameter. GetUserInfo is Reflected via POST data. SetUserInfo is Stored via the general parameter...
PT-2020-12791
Name of the Vulnerable Software and Affected Versions ProVide formerly zFTPServer versions through 13.1 Description The issue concerns Multiple Stored and Reflected XSS in the Admin Web Interface. Specifically, GetInheritedProperties is reflected via the groups parameter, GetUserInfo is reflected...
CVE-2020-11704: Improper Neutralization of Input During Web Page Generation
An issue was discovered in ProVide formerly zFTPServer through 13.1. The Admin Web Interface has Multiple Stored and Reflected XSS. GetInheritedProperties is Reflected via the groups parameter. GetUserInfo is Reflected via POST data. SetUserInfo is Stored via the general parameter...