EUVD-2026-104281

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal servertoken values and...

Operacle CheckCle Authorization Issue Vulnerability

Operacle CheckCle 1.6.0 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of authorization checks. The PocketBase collection uses empty API rules. Attackers can query the /api/collections//records endpoint without authentication. They can read,...

CVE-2026-37504: Use of GET Request Method With Sensitive Query Strings

Sensitive servertoken exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server authentication token is accepted via GET parameter transmission. The token appears in URLs such as /api/v1/server/UniProxy/user?token=SECRET, causing it to be...

CVE-2026-37504

Sensitive servertoken exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server authentication token is accepted via GET parameter transmission. The token appears in URLs such as /api/v1/server/UniProxy/user?token=SECRET, causing it to be...