147 matches found
EUVD-2026-116591
Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under...
CVE-2026-121733
Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under...
CVE-2026-107056
Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message...
EUVD-2026-112492
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded apikey and another...
PT-2026-132387
Name of the Vulnerable Software and Affected Versions OpenTracks version 6751 Description Insecure permissions in the io.file.importer.ImportActivity component allow unauthorized attackers to inject crafted tracking data into the user's location database by sending a specially crafted SEND messag...
CVE-2026-107056
Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message...
EUVD-2026-113258
Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message...
OpenTracks security vulnerability
OpenTracks version 6751 contains a security vulnerability stemming from insecure permissions in the io.file.importer.ImportActivity component. This flaw may allow unauthorized attackers to inject specially crafted tracking data into the victim’s location database via a specially designed SEND...
CVE-2026-107056
Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message...
CVE-2026-107056
OpenTracks version 6751 is vulnerable to a security flaw caused by insecure permissions in the io.file.importer.ImportActivity component. This vulnerability allows unauthorized attackers to inject crafted tracking data into a victim's location database by sending a specially designed SEND message...
CVE-2026-107056: n/a: Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows…
Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message...
CVE-2026-118691
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded apikey and another...
CVE-2026-118691
The xianyu-auto-reply-fix tool (versions through 2.0.7 ) is vulnerable to missing authorization in the POST /send-message endpoint. This flaw allows unauthenticated attackers to send arbitrary messages from other users' accounts by utilizing publicly known default API secrets . Specifically, an a...
CVE-2026-118691 xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded apikey and another...
CVE-2026-118691 xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded apikey and another...
CVE-2026-118691
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded apikey and another...
CVE-2026-118691: GuDong2003 xianyu-auto-reply-fix: xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint…
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded apikey and another...
PT-2026-129194
xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users' accounts using publicly known default API secrets. Attackers can supply the hard-coded api key and another...
PT-2026-117170
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send message mobile of the file controllers/simple.php. Such manipulation of the argument user id leads to weak password recovery. The attack can be launched remotely. The exploit has been...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: TCP: fixed page frag corruption upon a page fault. Steffen reported a corruption of the TCP stream for HTTP requests served by the Apache web-server, using a CIFS mount-point and the corresponding file’s memory mapping. The root...