Threat database

BillionMail versions up to 4.9 contain a vulnerability where a hard-coded cryptographic key is used. This allows unauthenticated attackers to forge JWT tokens for unsubscribe and subscribe-confirm actions by deriving the key from known configuration constants. Exploitation enables attackers to deactivate contacts or force subscription confirmations via specific API endpoints.

cool-admin-midway versions up to and including 8.0.0 contain an authorization bypass vulnerability. This flaw allows department-limited administrators to manage users outside their assigned departments by supplying arbitrary user IDs. Attackers with sys:user:* permissions can exploit this to read user records, reset passwords and roles, or delete user accounts.

cool-admin-midway versions up to and including 8.0.0 contain an authorization bypass vulnerability. This flaw allows non-superadmin administrators with ordinary sys:role permissions to read, modify, or delete roles of other administrators by supplying arbitrary role IDs. Exploiting this vulnerability enables attackers to alter menu and department grants, effectively changing other users' access rights.

MinDoc versions up to 2.2-beta.2 have an authorization bypass vulnerability in the DocumentController.Content component. Authenticated users with any non-observer role can access documents from books they are not authorized to view by iterating document IDs. This allows unauthorized reading of markdown and HTML content from private books.

BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.

SendPortal sendportal-core versions up to 4.0.1 contain an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to tags belonging to other workspaces by supplying unvalidated tag IDs. This can lead to unauthorized access to victim campaign content and manipulation of campaign reports.

MacCMS versions from 0 up to and including 2026.1000.4056 have a vulnerability where the system does not limit attempts on the six-digit password recovery code. This allows unauthenticated attackers who know a victim's email or phone number to brute-force the recovery code and reset the member's password, leading to account takeover.

CVE-2026-111355 is an authorization bypass vulnerability in zhontai Admin.Core up to version 10.1.0. Authenticated users with certain permissions can bypass department DataScope restrictions by supplying out-of-scope record IDs. This allows them to access and modify user and organization data across departments, including reading, modifying, disabling, and deleting users outside their authorized scope.

crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.

Peppermint versions up to 0.5.5 have a missing authorization vulnerability allowing any authenticated user to create time entries and attachments as other users by specifying a user ID in requests. This affects the POST endpoints /api/v1/time/new and /api/v1/storage/ticket/:id/upload/single, enabling unauthorized actions under another user's identity.

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.

go-ldap-admin versions up to 0.6.2 embed a hard-coded RSA private key in their public repository. This key is used to protect encrypted login passwords. An unauthenticated attacker who obtains encrypted passwords can decrypt them offline or through a specific endpoint, exposing cleartext LDAP credentials.

ZenTao PMS versions up to and including 22.6 have an authorization bypass vulnerability in the editComment action. Authenticated users can exploit this flaw by supplying arbitrary actionIDs to read and overwrite comments made by other users on bugs, stories, tasks, and documents. This allows unauthorized modification and viewing of content in products and projects that the attacker should not have access to.

Trudesk versions up to and including 1.2.11 have an authorization bypass vulnerability that allows any authenticated user to access private conversations by specifying another conversation's ID. The API endpoint GET /api/v1/messages/conversation/:id does not verify if the requester is a participant in the conversation, exposing message history and participant details such as usernames, full names, and email addresses.

pig versions up to and including 4.1.1 have a missing authorization vulnerability in the SysUserController.user endpoint. This flaw allows any authenticated user to access other users' profile details via a GET request to /admin/user/details/{id}. Attackers with low privileges can enumerate user IDs sequentially to obtain sensitive information such as usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.

OxiCloud versions 0.9.1 through 0.9.3 have an incorrect authorization vulnerability that allows anonymous users to retain share access after password protection is enabled. Attackers with a valid oxi_shares share-ring cookie can access shared files or folder contents via the API despite password protection.

rustdesk-api versions up to 2.7 have an authorization bypass vulnerability allowing unauthenticated attackers to overwrite peer records by supplying a target device ID to the POST /api/sysinfo endpoint. This lets attackers modify hostname, username, OS, and uuid fields without uuid verification and subsequently log in using the forged uuid to rebind the peer to their account.

RedAmon versions up to and including 7.0.1 have an unauthenticated server-side request forgery (SSRF) vulnerability in the agent POST /tradecraft/verify endpoint. The vulnerability arises because the validate_url function only checks the initial hostname, allowing attackers to submit URLs that redirect or DNS-rebind to internal addresses such as cloud metadata services. This enables attackers to retrieve internal content through the model-generated summary feature. The CVSS 4.0 score is 6.9, indicating a medium severity vulnerability.

Archon versions 0.2.13 through 0.11.1 have a critical missing authentication vulnerability that allows unauthenticated attackers to access the control API bound to all network interfaces. This flaw enables attackers with network access to send commands to the AI coding agent running with elevated permissions, potentially executing arbitrary commands on the host as the Archon user.

ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider base_url. Attackers can set base_url via the provider config endpoint and trigger POST /api/v1/models/check to reach internal or metadata addresses, read error responses, and capture stored provider API keys.