CVE-2026-114394

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge...

CVE-2026-114394 Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge...

CVE-2026-114394

Trudesk versions through 1.2.11 are vulnerable to an authorization bypass (CWE-639) within the Ticket Comment and Create APIs . The root cause allows authenticated users to supply user-controlled ownerId or owner parameters in postComment, postInternalNote, and ticket creation requests. This enab...

EUVD-2026-107241

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge...

CVE-2026-114394 Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge...

PT-2026-120581

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge...

CVE-2026-72861

In Appwrite templates' github-issue-bot, verifyWebhook uses an inverted condition (typeof signature !== 'string' || (await verify(...))) that short-circuits to success when the X-Hub-Signature-256 header is absent, skipping HMAC verification. Unauthenticated callers can then post arbitrary commen...

CVE-2026-72861: Improper Verification of Cryptographic Signature

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

CVE-2025-23572: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Dave Konopka UpDownUpDown updownupdown-postcomment-voting allows Stored XSS.This issue affects UpDownUpDown: from n/a through = 1.1...

Reflected XSS with parameters in PostComment

Impact An attacker could inject malicious web code into the users' web browsers by creating a malicious link. Patches The problem is fixed in 4.2.0 References Cross-site Scripting XSS - Reflected CWE-79...

GHSA-58W4-W77W-QV3W Reflected XSS with parameters in PostComment

Impact An attacker could inject malicious web code into the users' web browsers by creating a malicious link. Patches The problem is fixed in 4.2.0 References Cross-site Scripting XSS - Reflected CWE-79...

Lito Lite CMS Multiple Cross Site Scripting / Blind SQL Injection Exploit

No description provided by source. --+++===================================================================================+++-- --+++====== Lito Lite Multiple Cross Site Scripting / Blind SQL Injection Exploit ======+++--...

Invision Gallery 2.0.7 SQL Injection Vulnerability

Invision Gallery 2.0.7 DOS attak can be performed index.php?automodule=gallery&cmd=postcomment&op=doaddcomment&Post=test&img=111 OR id IN SELECT BENCHMARK10000000,BENCHMARK10000000,md5currentdate FROM ipbgalleryimages...

CVE-2006-3173

Multiple PHP remote file inclusion vulnerabilities in ContentBuilder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the 1 pathcb parameter to a libraries/comment/postComment.php and b modules/poll/poll.php, 2 rel parameter to c modules/archive/overview.inc.php, and the 3...