CVE-2026-70559

Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...

CVE-2026-70559 Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll

Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...

CVE-2026-70559

Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...

CVE-2026-70559

Summary: Dinky v1.2.5 (and dev head) exposes an unauthenticated GET endpoint, /api/sysConfig/getAll, due to a method-level @SaIgnore bypassing class-level login checks. An unauthenticated remote user can retrieve the full live system configuration (54 entries on stock v1.2.5) with minimal GET. Th...

PT-2026-68783

Name of the Vulnerable Software and Affected Versions Dinky version 1.2.5 Description The getAll function in the SysConfigController contains a method-level @SaIgnore annotation that bypasses the class-level @SaCheckLogin security check. This allows unauthenticated remote callers to access the GE...

grub2 security update

2.12-29.0.1.el101.2 - efinet: Close and reopen card on failure Orabug: 37808688 - Update grub2 dependencies to match new Secure Boot certificate chain of trust Orabug: 37766761 - Fix typo in SBAT metadata Orabug: 37693946 - Allow installation of grub2 only with shim-aa64 that allows booting it...

Oracle Linux 9 : python3.9 (ELSA-2025-23342)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-23342 advisory. 3.9.25-2.0.1 - Remove upstream URL reference 3.9.25-2 - Move sysconfigdatadlinux.py to the debug subpackage 3.9.25-1 - Update to Python 3.9.25 3.9.24-...

CVE-2025-65233

Reflected cross-site scripting XSS in SLiMS slims9bulian before 9.6.0 via improper handling of $SERVER'PHPSELF' in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path...

CVE-2025-65233

Reflected cross-site scripting (XSS) is present in SLiMS (slims9_bulian) versions prior to 9.6.0 . The vulnerability is caused by the improper handling of the $_SERVER['PHP_SELF'] variable within the index.php/sysconfig.inc.php file. This flaw allows a remote attacker to execute arbitrary JavaScr...

EUVD-2011-4125

Malware in sbrugna...

CVE-2025-6132: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in Chanjet CRM 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysconfig/departmentsetting.php. The manipulation of the argument gblOrgID leads to sql injection. The attack can be launched remotely. The exploit...

Chanjet CRM injection vulnerability

Chanjet CRM is a customer relationship management system from China's Chanjet company. An injection vulnerability exists in Chanjet CRM version 1.0, which is caused by incorrect manipulation of the parameter gblOrgID in the file /sysconfig/departmentsetting.php, resulting in SQL injection...

Do Not Configure the Encryption Algorithm Overwriting Policy for the SSH Service

The configuration files of the SSH encryption algorithms are /etc/ssh/sshdconfig and /etc/sysconfig/sshd. When the SSH service is running, you can edit the /etc/sysconfig/sshd file to overwrite the encryption algorithm policy. If the encryption algorithm overwriting policy is configured, users ar...

PT-2025-19693 · Opensuse · Etcd

This update for etcd fixes the following issues: Security Update to version 3.5.18: Ensure all goroutines created by StartEtcd to exit before closing the errc mvcc: restore tombstone index if it's first revision Bump go toolchain to 1.22.11 Avoid deadlock in etcd.Close when stopping during...

CVE-2025-0484

A vulnerability was found in Fanli2012 native-php-cms 1.0 and classified as critical. This issue affects some unknown processing of the file /fladmin/sysconfigdoedit.php of the component Backend. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit h...

native-php-cms security vulnerabilities

native-php-cms is a website builder system for FLi individual developers. A security vulnerability exists in version 1.0 of native-php-cms, which stems from the parameter info in the file /fladmin/sysconfigdoedit.php that can lead to cross-site scripting attacks...

native-php-cms security vulnerabilities

native-php-cms is a website builder system for FLi individual developers. A security vulnerability exists in native-php-cms version 1.0, which originates from improper authorization in the file /fladmin/sysconfigdoedit.php in the Backend component...

PT-2025-3914 · Fanli2012 · Native-Php-Cms

Name of the Vulnerable Software and Affected Versions: Fanli2012 native-php-cms version 1.0 Description: A critical issue affects the processing of the file /fladmin/sysconfig doedit.php in the Backend component, leading to improper authorization. The attack can be initiated remotely...

CVE-2024-55516

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 v3.90. The component affected by this issue is /uploadsysconfig.php on the web interface. By crafting a suitable form name, arbitrary files can be uploaded, potentially leading to unauthorized access to server permissio...

SUSE-SU-2024:3266-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-prometheus-prometheus: - Security issues fixed: CVE-2024-6104: Update go-retryablehttp to version 0.7.7 bsc1227038 CVE-2023-45142: Updated otelhttp to version 0.46.1 bsc1228556 - Require Go 1.20 for building - Migrate from disabled to manual...