CVE-2026-47102-PoC

CVE-2026-47102 — LiteLLM Privilege Escalation via /user/update LiteLLM v1.83.7 versions before v1.83.10 /user/update endpoint allows low-privileged users with access to this endpoint to modify their own userrole field to proxyadmin when updating their account, achieving unauthorized privilege...

CVE-2026-35029-PoC

CVE-2026-35029 — LiteLLM /config/update Broken Access Control LiteLLM 's /config/update endpoint does not check the caller's role privileges. Any authenticated user with a valid API Key without admin privileges can modify the proxy configuration, register malicious Pass-Through endpoints to achie...

LiteLLM - Arbitrary File Read

LiteLLM 1.83.0 contains a broken access control vulnerability caused by lack of admin role enforcement on /config/update endpoint, letting authenticated users modify configurations, execute code, read files, and take over accounts. id: CVE-2026-35029 info: name: LiteLLM - Arbitrary File Read...

CVE-2026-110121 PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/goodsId to...

CVE-2026-96535

Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The fil...

CVE-2026-96535 Cross-Site Scripting in the YouMind web application

Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The fil...

CVE-2026-96535

The YouMind portal is vulnerable to Cross-Site Scripting (XSS) within its avatar update endpoint . The flaw occurs because the application fails to sanitize or validate SVG content when a user sets a profile picture via an arbitrary URL. An attacker can upload an SVG file containing embedded Java...

PT-2026-111565

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.6.0 through 4.14.7 Description An authentication bypass exists because the security.update user function implements the reserved user guard and password policy within a falsy truthiness check. This allows a delegated user...

CVE-2026-110121: Authorization Bypass Through User-Controlled Key

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/goodsId to...

CVE-2026-103521

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such a...

CVE-2026-103521

In Thelia v2.6.0 , a vulnerability exists in the document update endpoint because it fails to perform the same validation as the document upload endpoint. While the upload endpoint blocks executable file types, the update endpoint allows an attacker with administrative permissions to upload arbit...

CVE-2026-103521 CVE-2026-103521

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such a...

CVE-2026-103521 CVE-2026-103521

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such a...

EUVD-2026-97474

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such a...

Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1

Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution RCE, server-side template injection SSTI, stored...

CVE-2026-103521: Unrestricted Upload of File with Dangerous Type

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such a...

PT-2026-110601

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description The document update endpoint fails to validate file types, unlike the document upload endpoint which correctly blocks executable files. An attacker with administrative permissions can exploit this to upload...

EUVD-2026-93503

Payload: Unauthorized update to collection documents...

CVE-2026-105859

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control...

CVE-2026-105859

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control...