CVE-2025-56161

YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields bcrypt password hash, mobile...

CVE-2025-56161

YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields bcrypt password hash, mobile...

CVE-2025-56161: Exposure of Sensitive Information to an Unauthorized Actor

YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields bcrypt password hash, mobile...

PT-2025-40399

Name of the Vulnerable Software and Affected Versions YOSHOP 2.0 Description The software allows unauthorized disclosure of information through comment-list API endpoints within the Goods module. The Comment model loads the related User model without filtering specific fields. Due to the absence ...

CVE-2025-56161

YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields bcrypt password hash, mobile...

SQL Injection Vulnerabilities in 4site CMS

High-Tech Bridge SA Security Research Lab has discovered three vulnerabilities in 4site CMS which could be exploited to execute arbitrary SQL commands in applications database. 1 SQL injection vulnerabilities in 4site CMS: CVE-2010-4152 1.1 The vulnerability exists due to insufficient validation ...