Threat database

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission.

OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.

ZKEACMS versions up to and including 4.4 contain an authentication bypass vulnerability due to a hard-coded cryptographic key used for signing JWT bearer tokens. This flaw allows unauthenticated attackers to forge tokens with administrative privileges, enabling unauthorized modification of articles and products and access to form submissions.

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection credentials to attacker-controlled servers, or abuse dt_begin_authorization to create connections.

abp-next-admin versions 10.2.0 through 10.6.0 contain an authorization bypass vulnerability in the LINGYUN.Abp.AIManagement module. Authenticated users with the Chat permission can access or manipulate other users' AI chat conversations by supplying the victim's ConversationId GUID. This allows reading chat messages and injecting messages into conversations without proper authorization.

CVE-2026-111628 is a PHP object injection vulnerability in 10up Distributor versions before 2.3.2. It allows Contributor-level users to inject serialized PHP objects by double unserializing distributed post meta data. The vulnerability arises because the set_meta() function unserializes attacker-controlled serialized strings, potentially instantiating malicious objects. The impact depends on the presence of gadget classes loaded on the destination site. The CVSS score is low (2.3), reflecting limited impact and attack complexity.

Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.

10up Distributor versions prior to 2.3.2 have a missing authorization vulnerability in the ajax_push() function. This flaw allows Contributor-level multisite users to publish posts on other network sites without proper permissions by exploiting the dt-push nonce with a chosen connection ID and post status. The vulnerability enables unauthorized creation of draft or published posts on sites the attacker cannot normally access.

Umbraco CMS versions before 17.7.1 and 18.2.1 have a missing authorization vulnerability that allows unauthenticated clients to connect to certain backoffice SignalR hubs. This flaw permits attackers to complete the SignalR negotiate step and receive notifications disclosing content keys, including unpublished content, and revealing editorial activity timing.

xiaozhi-esp32-server-java versions up to 6.1.0 contain an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting the /api/device/ota endpoint with any MAC address. This enables attackers to open a victim device's WebSocket channel to read private system prompts, write conversation history, consume credentials, and overwrite device metadata.

smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.

FilePress versions up to 3.0.1 contain an SQL injection vulnerability that allows authenticated low-privilege users to inject SQL code via the 'asc' parameter in ORDER BY clauses. This vulnerability affects specific PHP scripts and can be exploited using blind boolean or time-based subqueries to extract sensitive database information, including administrator credential hashes.

CoAI (Chat Nio) versions up to 4.0.0 contain an unauthenticated path traversal vulnerability in the generation and article archive download endpoints. Attackers can exploit the hash query parameter by including ../ sequences to download any readable .tar.gz or .zip file on the server, including archives generated by other users. This vulnerability allows unauthorized access to potentially sensitive files without requiring authentication.

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.

Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values.

Mall4cloud versions up to 4.0 contain an insecure direct object reference vulnerability that allows authenticated merchants to access other shops' buyer shipping addresses. This occurs via the OrderController's getOrderAddr handler, where attackers can enumerate orderAddrId values to retrieve consignee names, mobile numbers, addresses, and post codes across the platform.

DataCap through version 2025.1.1 contains an insecure direct object reference vulnerability in the BaseController.getInfoForPath function. This flaw allows authenticated users with low privileges to access other users' datasources, snippets, and dashboards by enumerating numeric IDs. Sensitive information such as datasource host, port, username, and cleartext passwords can be retrieved by exploiting this vulnerability.

AllData versions up to 0.7.1 contain an unauthenticated JDBC injection vulnerability in the data-dts /jobJdbcDatasource/test endpoint. This flaw allows remote attackers to supply arbitrary jdbcUrl and jdbcDriverClass parameters, potentially opening arbitrary database connections. By using a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server, attackers can read arbitrary files from the host running data-dts. The vulnerability has a high severity CVSS score of 8.7.

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords.