CVE-2026-61529

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

CVE-2026-61529 Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

EUVD-2026-112410

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

PT-2026-129171

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous POST /forms/formId/submissions endpoint stores attacker-controlled JsonData after checking only that the JSON is well formed. A file object with name, type and content fields can contai...

CakePHP 1.3.5 / 1.2.8 Cache Corruption

!/usr/bin/python burnedCake.py - CakePHP = 1.3.5 / 1.2.8 Cache Corruption Exploit written by [email protected] This code exploits a unserialize vulnerability in the CakePHP security component. See http://malloc.im/CakePHP-unserialize.txt for a detailed analysis of the vulnerability. The exploit...