JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysPositionController deleteBatch handler. This flaw allows any authenticated user, including low-privileged attackers, to delete organizational positions by sending comma-separated position IDs. These IDs can be obtained from an unprotected list endpoint, enabling attackers to remove all sys_position records and orphan user-position assignments. The vulnerability has a medium severity with a CVSS score of 5.4.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the AiragExtDataController exportXls handler. This flaw allows any authenticated user, including low-privileged attackers, to export AI evaluator data for all users. Exploitation involves requesting the /airag/extData/exportXls endpoint to download evaluator definitions and test-tracking records as an Excel file. The vulnerability has a CVSS score of 4.3, indicating medium severity.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysLogController delete handler. This flaw allows any authenticated user, including low-privileged attackers, to delete audit log entries. Attackers can obtain log IDs from the unprotected /sys/log/list endpoint and remove specific sys_log records to erase evidence of their activities.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that permits low-privileged authenticated users to delete message templates via a specific API endpoint. This deletion can disrupt template-based notifications such as workflow reminders. The vulnerability has a medium severity with a CVSS score of 5.4.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the AigcWordTemplateController's delete handler. This flaw allows any authenticated user, including low-privileged attackers, to delete word templates by sending DELETE requests with an id parameter. The vulnerability results in unauthorized deletion of shared library templates.
JeecgBoot versions through 3.9.5 have an insecure direct object reference (IDOR) vulnerability that allows authenticated users to access other users' AI voice generation history. By exploiting the userId parameter in the GET /airag/voice/listByUser endpoint, an attacker who knows another user's ID can retrieve sensitive data including text-to-speech inputs, voice settings, timestamps, and generated audio file metadata stored in Redis. This vulnerability has a medium severity rating with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have an insecure direct object reference (IDOR) vulnerability that allows authenticated users to delete AI video generation records belonging to other users. This is achieved by supplying arbitrary userId values to the DELETE /airag/video/deleteVideoRecord endpoint. Attackers can enumerate record IDs via the GET /airag/video/listByUser endpoint and delete Redis-stored video history entries one at a time.
JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler. This flaw allows authenticated users with low privileges to delete word templates by sending a crafted DELETE request with template IDs. The vulnerability impacts the integrity and availability of shared word templates.
JeecgBoot versions through 3.9.5 have an insecure direct object reference (IDOR) vulnerability that allows authenticated users to delete AI voice records belonging to other users. This occurs because the DELETE /airag/voice/deleteVoiceRecord endpoint accepts an arbitrary userId without proper authorization checks. Attackers can enumerate record IDs via the GET /airag/voice/listByUser endpoint and delete victims' text-to-speech history stored in Redis. The vulnerability has a CVSS score of 4.3, indicating medium severity.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the AigcWordTemplateController edit handler. This flaw allows any authenticated user, including those with low privileges, to modify shared word templates by sending PUT or POST requests to the /airag/word/edit endpoint. The vulnerability could lead to unauthorized modification of templates used by other users to generate documents.
JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability in the AiOcrController updateById handler. This flaw allows any authenticated user, including low-privileged attackers, to modify global OCR templates by sending PUT requests to /airag/ocr/edit. Exploitation can corrupt OCR results for all users by overwriting shared Redis keys.
JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability in the AiOcrController deleteById handler. This flaw allows any authenticated user, including low-privileged attackers, to delete OCR records. Attackers can enumerate record IDs via an unprotected GET endpoint and delete shared OCR prompt records stored in Redis.
This content describes a free, comprehensive, and open-source exploit development curriculum covering C programming, x86-64 assembly, reverse engineering, and advanced exploitation techniques. It is intended as an educational resource for beginners and security researchers to learn exploit development from the ground up. The curriculum is not a vulnerability or exploit itself but a learning tool.
Multiple security issues were addressed in the iscsiuio-0.7.8.8-114.1 package included in the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities affecting the iscsiuio component in this specific package version. No detailed technical information or CVSS scores are provided for these issues.
This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-10-10. It is categorized under OSINT, network activity, and payload delivery, indicating it relates to threat intelligence data rather than a specific vulnerability or exploit. No specific malware details, affected software versions, or technical analysis are provided.
A denial of service vulnerability exists in Microsoft product version 3.0 due to eager array allocation during deserialization. This flaw can cause resource exhaustion leading to service disruption. No CVSS score or detailed technical exploitation information is provided. No patch or remediation guidance is currently available.
The PyPI package ig-gox version 1.0.0 contains malicious code that executes a concealed payload upon import. This payload is base64-decoded, XOR-decrypted, decompressed, HMAC-verified, and then executed dynamically. The package employs anti-analysis techniques to detect debugging, decompilation, and sandbox environments, exiting if such conditions are detected. It downloads and executes remote malicious scripts designed to abuse Instagram services for mass fake account registration.
A vulnerability in the Linux kernel's xen/netfront driver was resolved that involved improper handling of received packets with Ethernet headers shorter than expected. The issue caused a kernel bug due to insufficient validation of packet length before processing the Ethernet header, potentially leading to kernel crashes.
A vulnerability in GnuTLS version 3.0 causes legitimate Certificate Authority (CA) certificates to be rejected, resulting in a Denial of Service (DoS) condition. This disrupts normal certificate validation processes and may prevent secure connections that rely on these CA certificates. The vulnerability has a CVSS score of 5.9, indicating medium severity. Multiple specific versions of GnuTLS are affected. No explicit patch or remediation information is provided.
A vulnerability in GnuTLS version 3.8.13 and various other versions allows an attacker to obtain sensitive information by exploiting the failure to reject end-entity X.509 certificates that contain conflicting Key Usage and Extended Key Usage attributes. This flaw could lead to unintended acceptance of malformed certificates. The issue has a medium severity with a CVSS score of 3.7.