CVE-2026-109175

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and...

EUVD-2026-97381

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which...

CVE-2026-109175

MoguBlog versions through 6.2 are affected by an insecure direct object reference vulnerability in the /networkDisk/getFileList endpoint. Authenticated administrators can list network-disk files belonging to other administrators because the system filters by status, file type, or filePath but fai...

EUVD-2026-97379

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and...

PT-2026-110566

Name of the Vulnerable Software and Affected Versions MoguBlog versions prior to 6.3 Description Broken access control allows authenticated administrators to move or rename files belonging to other administrators on the network disk by providing the specific file paths. This occurs because the...

CVE-2026-109177: Authorization Bypass Through User-Controlled Key

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which...

CVE-2026-109175: Authorization Bypass Through User-Controlled Key

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and...

EUVD-2020-29214

Malware in sbrugna...

EUVD-2020-29215

Malware in sbrugna...

EUVD-2023-43553

Malicious code in bioql PyPI...

EUVD-2023-31327

Malicious code in bioql PyPI...

CVE-2024-30845

Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the validation component of the input parameters...

CVE-2023-39853

SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Network Disk backend module...

CVE-2020-8347

A reflective cross-site scripting XSS vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow execution of code in an authenticated user's browser if a crafted url is visited, possibly through phishing...

CVE-2020-8348

A DOM-based cross-site scripting XSS vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow execution of code in an authenticated user's current browser session if a crafted url is visited, possibly through phishing...

Rainbow external link network disk security vulnerability

Rainbow external link network disk is a PHP network disk and external link sharing program by netcccyun's personal developer. A security vulnerability exists in Rainbow external link network disk version v.5.5, which stems from a cross-site scripting XSS vulnerability. A remote attacker can execu...

CVE-2024-30845

Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the validation component of the input parameters...

CVE-2024-30845

Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the validation component of the input parameters...

CVE-2024-30845

Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the validation component of the input parameters...

CVE-2024-30845: Improper Control of Generation of Code

Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the validation component of the input parameters...