Threat database

VentureDrake Laravel CRM versions before 2.4.0 have a missing authorization vulnerability that allows authenticated users with read-only roles to bypass Spatie role permissions. This enables them to invoke sensitive Livewire action methods such as delete, won, lost, or reopen on components like DealIndex, and access unguarded Activities and Products routes to modify deals, quotes, orders, and invoices.

Kan versions 0.5.5 through 0.6.0 contain an unauthenticated server-side request forgery (SSRF) vulnerability in the /api/download/attatchment route. This vulnerability arises from an incomplete fix for a previous issue (CVE-2026-32255). When the S3_ENDPOINT environment variable is unset, attackers can supply arbitrary URL query parameters to the fetch() function, enabling them to access internal services, localhost ports, and cloud instance metadata. The vulnerability has a critical severity with a CVSS 4.0 score of 9.2. A patch is available to address this issue.

ClipBucket v5 through 5.5.3-#206 has a reflected cross-site scripting (XSS) vulnerability in the admin_area/index.php file. This flaw allows attackers to inject malicious HTML via the val parameter when mode=add_todo is used. An attacker can trick a logged-in administrator into submitting a cross-site POST form that lacks CSRF protection, leading to script execution within the admin panel context. The vulnerability has a low CVSS score of 2.1 and does not appear to have known exploits in the wild.

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting (XSS) vulnerability in the admin_area/language_settings.php file. The vulnerability arises from the unencoded edit_language GET parameter, allowing attackers to craft links that execute scripts in the admin panel context when visited by administrators with basic_settings permission.

ClipBucket v5 through 5.5.3-#206 has a reflected cross-site scripting (XSS) vulnerability in the admin panel. The flaw exists in the admin_area/flagged_item.php script via the unencoded 'type' GET parameter. This allows attackers to craft malicious links that, when visited by logged-in administrators or moderators, execute injected scripts in the context of the admin panel origin.

Papermerge Core versions up to 3.5.3 have a missing authorization vulnerability that allows authenticated users to access metadata of groups they do not belong to by supplying a group_id parameter. This affects the GET /tags/all and GET /document-types/all endpoints, which do not properly verify group membership before disclosing tags and document types.

Papermerge Core versions up to and including 3.5.3 have a missing authorization vulnerability in the shared nodes API. Authenticated users can exploit this flaw by supplying arbitrary node UUIDs to share other users' documents. This allows attackers to grant themselves any role on these documents, enabling them to read, modify, delete, or revoke shares of victims' documents.

Papermerge Core versions up to 3.5.3 have a missing authorization vulnerability that allows authenticated users to manipulate other users' pages. The vulnerability arises because certain page management and OCR endpoints do not enforce permission checks. Attackers with knowledge of page UUIDs can rotate, delete, extract pages, or trigger OCR tasks on pages they do not own.

frp versions 0.41.0 through 0.71.1 have a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints. These endpoints are registered outside of Basic Authentication, enabling attackers to query debug information such as command line, goroutine stacks, heap profiles, and trigger CPU profiling via the /debug/pprof/ paths on frps dashboard or frpc admin listeners.

SmsForwarder versions up to and including 3.5.0 have a missing authentication vulnerability in the AndServer HTTP server component. This flaw allows unauthenticated network attackers to invoke remote-control APIs that are enabled by default. Exploitation can lead to unauthorized reading of SMS messages, call logs, contacts, sending SMS messages, and exporting or overwriting configuration data via the clone API.

CVE-2026-110617 is a missing authorization vulnerability in rachelos we-mp-rss version 1.5.3 and earlier. It affects the /api/v1/wx/tools/export/download endpoint, allowing unauthenticated attackers to download export archives by exploiting a commented-out authentication dependency. Attackers can specify an mp_id and guess timestamp-based filenames to retrieve archives and optionally delete them after download.

NullHub versions up to and including 2026.5.29 have a critical missing authentication vulnerability. This flaw allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. Attackers can send requests without Authorization or Origin headers to non-loopback listeners and gain control over agent instances, rewrite configurations including provider credentials, and manage cron jobs and MCP servers.

jshERP versions up to 3.6 have a missing authorization vulnerability in the POST /user/batchSetStatus endpoint. This flaw allows authenticated users with low privileges to change the account status of other users within their tenant. Exploitation can result in disabling all non-owner accounts, including administrators, effectively locking them out, or re-enabling disabled accounts.

Yiuman citrus versions up to 0.15.0 contain an SQL injection vulnerability in the citrus-support generic query framework. This flaw allows attackers to inject SQL code via the sortBy request parameter, affecting any generic list route of controllers extending BaseQueryController or BaseQueryRestful. The vulnerability enables attackers to append unvalidated SQL to the ORDER BY clause and potentially extract database contents using boolean- or time-based blind SQL injection techniques. The vulnerability has a CVSS 4.0 score of 7.1, indicating high severity.

CVE-2026-110613 is an authorization bypass vulnerability in youlaitech's youlai-mall application. Authenticated users can exploit this flaw to access all customers' orders through the app's order list endpoint. This allows attackers to enumerate orders and view sensitive details such as order IDs, order serial numbers, member IDs, payment amounts, and order statuses.

vlife versions up to and including 2.0.1 have an authentication bypass vulnerability due to a hardcoded cryptographic key used for JWT signing. This allows unauthenticated attackers to forge JWT tokens with superUser privileges, granting super administrator access to any URL on affected vlife instances.

CVE-2026-110611 is an authorization bypass vulnerability in the getrebuild product 'rebuild' through version 4.5.0. It affects the AiBot2Controller /aibot2 endpoints, which improperly trust a caller-supplied chatid without verifying ownership. Authenticated users with low privileges can exploit this flaw to read, delete, exfiltrate, or interrupt AI assistant conversations belonging to other users.

CVE-2026-110610 is a server-side request forgery (SSRF) vulnerability in the ruoyi-vue-pro product by YunaiV, affecting versions up to and including 2026.09. Authenticated users can exploit this flaw by supplying a crafted referImageUrl to the midjourney imagine endpoint, causing the server to make HTTP requests to arbitrary URLs, including internal or cloud metadata services. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3. No patch or remediation information is provided in the available data.

CVE-2026-110609 is a SQL injection vulnerability in Dromara Skyeye that affects version 0. It allows authenticated users with low privileges to inject SQL commands via the keyword parameter in certain MyBatis queries. This can lead to unauthorized data extraction, including data from other tenants. The vulnerability is rated high severity with a CVSS score of 7.1.

CVE-2026-110608 is an authorization bypass vulnerability in BizSpring Shop's OrderController cancel and receive handlers. Authenticated users can manipulate the orderId parameter to act on orders belonging to other members. This allows attackers to cancel pending orders or confirm receipt of shipped orders without the victim's consent, potentially disrupting order fulfillment and stock allocation.