6 matches found
EUVD-2026-120522
Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger probePanSou to send server-side POST...
CVE-2026-125359
Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger probePanSou to send server-side POST...
CVE-2026-125359: fancydirty mediary-scout: Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated…
Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger probePanSou to send server-side POST...
CVE-2026-125359
Mediary Scout versions prior to 2026.11.05 are susceptible to a server-side request forgery (SSRF) vulnerability. The issue stems from a lack of role checks in the savePanSouBaseUrlAction, which allows any authenticated user—including non-owner accounts—to define an arbitrary PanSou base URL . Ex...
CVE-2026-125359 Mediary Scout before 2026.11.05 SSRF via PanSou Search Source Setting
Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger probePanSou to send server-side POST...
PT-2026-141180
Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger probePanSou to send server-side POST...