DB-GPT <= 0.8.1 - Arbitrary File Write

DB-GPT through 0.8.1 allows unauthenticated arbitrary file writes via a path traversal in the userid HTTP header of the POST /api/v1/python/file/upload endpoint, letting attackers escape the intended upload directory and write files anywhere, as confirmed by the reflected upload path in the JSON...

EUVD-2026-117154

VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different userid or profileid to endpoints such as GET /front/profile/profileid/report/ and GET...

CVE-2026-54377

VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different userid or profileid to endpoints such as GET /front/profile/profileid/report/ and GET...

CVE-2026-54377

The VitaFit cloud API (versions prior to 2026-10-30 ) is vulnerable to an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can access another user's private data by supplying different user_id or profile_id values to endpoints such as GET /front/profile/{profile_id}/...

CVE-2024-10793

CVE-2024-10793 CVE-2024-10793 poc exploit CVE-2024-10793.yaml script is needed to search for a plugin. CVE-2024-10793.sh script is the exploit itself. For post-exploitation, you can use beef-xss. Google dork: inurl:wp-content/plugins/wp-security-audit-log The WP Activity Log plugin for WordPress ...

CVE-2026-90960 Seraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.29.24 via the WPObjectCache::getFilePath. This makes it possible for unauthenticated attackers to extract complete WordPress user records — including plaintext...

CVE-2026-116216

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData that allows unauthenticated attackers to set arbitrary maccomment columns including userid. Attackers can submit anonymous comments with a crafted userid parameter to attribute them to any...

CVE-2026-116216 MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData that allows unauthenticated attackers to set arbitrary maccomment columns including userid. Attackers can submit anonymous comments with a crafted userid parameter to attribute them to any...

EUVD-2026-109808

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData that allows unauthenticated attackers to set arbitrary maccomment columns including userid. Attackers can submit anonymous comments with a crafted userid parameter to attribute them to any...

CVE-2026-116216

MacCMS versions v10 through 2026.1000.4056 are vulnerable to a mass assignment vulnerability in the index/Comment::saveData() function. This flaw allows unauthenticated attackers to manipulate mac_comment columns, specifically the user_id parameter. By submitting a crafted user_id, an attacker ca...

CVE-2026-116216 MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData that allows unauthenticated attackers to set arbitrary maccomment columns including userid. Attackers can submit anonymous comments with a crafted userid parameter to attribute them to any...

Maccmspro Maccms10 input validation error vulnerability

The MaccmsPro Maccms10 contains an input validation error vulnerability. This vulnerability stems from a batch assignment issue in index/Comment::saveData. Unauthenticated attackers can submit anonymous comments by using a specially crafted userid parameter, setting arbitrary values for the...

CVE-2026-114439

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument userid can lead to missing authentication. It is possible to launch t...

CVE-2026-114439

The oretnom23 php-travel-agency-system is vulnerable to missing authentication within the Session Handler component, specifically affecting the admin/session.php file. An attacker can perform a remote attack by manipulating the user_id argument. While the exploit has been publicly disclosed, the ...

CVE-2026-114439 oretnom23 php-travel-agency-system Session session.php missing authentication

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument userid can lead to missing authentication. It is possible to launch t...

CVE-2026-114439 oretnom23 php-travel-agency-system Session session.php missing authentication

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument userid can lead to missing authentication. It is possible to launch t...

CVE-2026-114439 oretnom23 php-travel-agency-system Session session.php missing authentication

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument userid can lead to missing authentication. It is possible to launch t...

oretnom23 php-travel-agency-system authorization issue vulnerability

The oretnom23 php-travel-agency-system contains an authorization issue vulnerability. This vulnerability stems from improper handling of the userid parameter in the admin/session.php file within the Session Handler component, potentially leading to missing authentication checks...

CVE-2026-77937

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted userid HTTP header. Attackers can set userid to another tenant's ID, even with LETTASERVERSECURE enabled, to read and modify that user's agents,...

CVE-2026-77937 Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted userid HTTP header. Attackers can set userid to another tenant's ID, even with LETTASERVERSECURE enabled, to read and modify that user's agents,...