GHSA-588F-FVCV-XHVF Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books

Summary GET /api/books/bookID/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped bypassing GORM's soft-delete scope but keeps the read-authorization clause as "ownerid = ? OR ispublic = ?". As ...

PHP exif_process_IFD_in_MAKERNOTE Information Disclosure Vulnerability

PHP is a widely used general-purpose scripting language that is particularly well suited for web development and can be embedded in HTML. An information disclosure vulnerability exists in the ext/exif/exif.c/exifprocessIFDinMAKERNOTE function in versions prior to PHP 5.5.38, 5.6.x prior to 5.6.24...