Threat database

CVE-2026-111723 is a missing authorization vulnerability in LingGuoAI's LingGuo-Drama product up to commit 8a6924a. It allows any registered user to access the /admin/v1/admins API, which is protected only by AuthAdminJWT, enabling unauthorized management of all accounts. Exploitation permits attackers to self-register, read bcrypt password hashes of all accounts, reset the bootstrap administrator's password, escalate their authority level, and delete accounts.

CVE-2026-111722 is an authorization bypass vulnerability in LingGuoAI LingGuo-Drama version 0. It allows registered users to access and manipulate other users' short-drama projects by exploiting a lack of owner verification in the projects.Get API endpoint. Attackers can enumerate project IDs via GET, PUT, and DELETE requests to read, overwrite, reassign, or delete projects they do not own.

Open WES versions up to 1.0.0 have an authorization bypass vulnerability that allows authenticated users with menu permission to modify stock records of other warehouses. This occurs because the GlobalGatewayFilter does not enforce warehouse-specific authorization scoping. Attackers can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in warehouses they should not control.

fish-island-backend version 0 contains an unauthenticated server-side request forgery (SSRF) vulnerability. This flaw allows remote attackers to make the server fetch arbitrary URLs via the url parameter of the GET /api/web/parse endpoint. Exploitation can target internal hosts, loopback services, or cloud metadata endpoints by following redirects in OkHttp requests, enabling attackers to read page titles, meta descriptions, and favicons.

CVE-2026-111719 is a high-severity vulnerability in roncoo-pay where the F2FPayController.orderQuery function lacks proper authentication. This flaw allows unauthenticated attackers to retrieve serialized payment records by guessing transaction numbers formatted with a '7' prefix plus a snowflake ID. The vulnerability affects version 0 of roncoo-pay. A patch is available, and the product is a cloud service, so the vendor manages remediation.

CVE-2026-111718 is a high-severity SQL injection vulnerability in kuafuai's AipexBase product. It affects version 0 and allows attackers to inject SQL commands via the order_by and group_by parameters of the /api/data/invoke endpoint. The vulnerability enables bypassing of SqlGuard denylist and row-level security controls, potentially exposing other users' data.

Arkon versions up to 0.9.2 have an authorization bypass vulnerability in the list_skill_versions API endpoint. Authenticated users with the default skill:read permission can access skill version metadata from other departments without proper authorization checks. This allows them to retrieve version numbers, hashes, storage paths, and changelogs of skills they should not have access to.

Arkon versions up to 0.9.2 have an authorization bypass vulnerability allowing authenticated employees to access and modify sources from other departments. This occurs because certain routes in the application skip access control checks, enabling unauthorized reading and modification of data.

Arkon versions up to 0.9.2 have an authorization bypass vulnerability in the GET /api/wiki/graph endpoint. Authenticated users with limited wiki read permissions can access wiki metadata from other departments by supplying a foreign slug. This allows unauthorized reading of page slugs, titles, types, and link edges up to depth 3.

tarteaucitron.js versions before 1.37.0 have a regular expression denial of service (ReDoS) vulnerability. This flaw arises from inefficient regular expression handling in the cookie.purge function, which can be exploited by attackers supplying unescaped cookie names or injecting a specially crafted purgeBtn element. Triggering the vulnerability causes catastrophic backtracking in the regex engine, freezing the page when the purge button is clicked. The CVSS score is low (2.3), reflecting the requirement for user interaction and high attack complexity.

tarteaucitron.js versions from 1.20.1 up to but not including 1.37.0 contain a cross-site scripting (XSS) vulnerability. This occurs because the function getElemAttr resolves 'data-' prefixed attributes, but the validation for https-only URLs only checks the unprefixed attribute. An attacker with the ability to insert markup, such as a CMS author, can exploit this by adding a data-url attribute with a javascript: URL alongside a benign URL, leading to script execution in the site's origin via an iframe src.

Netcore NR256CN devices up to version 1.5.140116 have an authentication bypass vulnerability. This flaw allows unauthenticated attackers to access protected management CGI handlers by prefixing the URI with certain public routes such as l7_web_auth.cgi or .ico paths. The vulnerability enables attackers to invoke management functions without valid credentials. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.

Netcore NR256CN devices up to version 1.5.140116 have a critical pre-authentication stack-based buffer overflow vulnerability in the Boa web server's user_ok() function. This flaw arises from unbounded strcpy() calls copying Basic-auth usernames into fixed 64-byte stack buffers. An unauthenticated attacker can exploit this by sending a username longer than 63 bytes to any protected /router/*.cgi route, potentially crashing the Boa process or executing arbitrary code.

Netcore NR256CN devices up to version 1.5.140116 have a NULL pointer dereference vulnerability in the Boa web server's user_auth() function. This flaw allows unauthenticated attackers to crash the server by sending a malformed Basic Authorization header lacking a colon, such as one decoding to a single character. Exploiting this vulnerability results in denial of access to the device's management interface by killing the main Boa process.

WhaTicket Community version 0 contains an authorization bypass vulnerability due to lack of ownership or queue checks in ShowTicketService. Authenticated agents can access tickets and message histories of other agents by supplying another agent's ticket ID. This allows reading full message history and posting WhatsApp replies on behalf of other agents.

CVE-2026-111708 is a critical authentication bypass vulnerability in WhaTicket Community (canove project) version 0. It allows unauthenticated attackers to self-register as administrators by exploiting the POST /auth/signup endpoint, either by omitting the profile field or setting it to 'admin'. This grants full administrative privileges including user management, settings modification, and access to all tickets, contacts, messages, and WhatsApp connections.

99AI versions up to 4.3.0 have an insecure direct object reference vulnerability that allows unauthenticated attackers to access other users' chat messages. The flaw exists because the querySingleChat function does not verify ownership of the requested chat data. Attackers can exploit this by sending a fingerprint header to obtain a visitor JWT and then sequentially iterate chatId values to retrieve message content and task data belonging to other users.

99AI versions up to and including 4.3.0 have a missing authentication vulnerability in the POST /api/chatLog/exportExcel endpoint. This flaw allows unauthenticated attackers to export all users' chat logs, including usernames, emails, prompts, and AI-generated answers, by sending crafted requests. The vulnerability has a high severity with a CVSS score of 8.7.

CVE-2026-111705 is an authorization bypass vulnerability in fushengqian fuint version 0. Authenticated users can access other members' booking records by manipulating the bookId parameter in the /clientApi/book/myBookDetail endpoint. This allows attackers to retrieve sensitive booking information such as contact names, mobile numbers, verification codes, service dates, stores, and remarks.

yshop-crm versions up to 2.1.3 contain an insecure direct object reference vulnerability that allows authenticated sales users to access, modify, or delete other users' customer records by supplying arbitrary IDs. This affects the get, update, delete, and do-open endpoints, enabling unauthorized enumeration and manipulation of customer data.