Threat database

waynboot-mall versions up to 2.0.0 have a missing authentication vulnerability in the /callback/order/unpaid endpoint. This flaw allows unauthenticated attackers to cancel any member's pending unpaid order by submitting predictable orderSn values. The vulnerability can be exploited to manipulate product stock levels by auto-cancelling unpaid orders.

Waynboot-mall versions up to 2.0.0 have a missing authentication vulnerability in the internal /callback/order/submit endpoint. This flaw allows unauthenticated attackers to forge orders by supplying arbitrary user, address, and cart identifiers. Exploitation can lead to unauthorized order creation, exposure of stored shipping details, cart clearing, and stock decrementing.

SiteServer SSCMS versions up to 7.4.0 have an authorization bypass vulnerability in the ChannelsController component. This flaw allows site-scoped administrators with Channels permission on one site to access and modify channels belonging to other sites by supplying foreign channel IDs. The vulnerability breaks multi-site isolation by permitting unauthorized reading and overwriting of channel names, file paths, templates, link URLs, and custom fields across sites.

ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order.

ThinkAdmin think-plugs-admin versions up to 1.0.81 contain an insecure direct object reference vulnerability that allows non-super administrators with the admin/file.edit permission to read and modify other administrators' file records. This flaw enables attackers to view download URLs, tamper with records, or reassign ownership by submitting crafted requests with target IDs and specific columns such as xurl, hash, or uuid.

FastBee versions up to 2.1.0 have an insecure direct object reference vulnerability that allows authenticated low-privilege users to access and manipulate other users' device groups. This occurs because the GroupController does not verify ownership when querying groups. Attackers can read, overwrite, reassign, or delete device groups belonging to other users by supplying sequential group IDs.

53AIHub versions up to 0.5.3 have a missing authentication vulnerability allowing unauthenticated attackers to overwrite enterprise profiles via PUT requests to /api/enterprises/:id. This flaw enables attackers to change logos, display names, and branding, facilitating defacement and phishing. The vulnerability exists because authentication checks are only enforced when IS_SAAS is true, which is not the case here.

Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks.

Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with names, login names, organization paths, mobile numbers, and emails.

ChronoFrame versions up to 1.0.0 have a missing authentication vulnerability in the server/api/wizard/ handlers. This flaw allows unauthenticated attackers to reconfigure instances by sending POST requests to /api/wizard/storage, enabling them to redirect uploads and storage reads to attacker-controlled S3 or OpenList providers and overwrite site and map settings. The vulnerability has a high severity with a CVSS score of 8.8. A patch is available, and since this is a cloud service, the vendor manages remediation.

CVE-2026-111649 is an authorization bypass vulnerability in rocboss paopao-ce versions up to 0.6.0-alpha.3. Authenticated users can exploit an insecure direct object reference in the DownloadAttachment function to access private media belonging to other users by supplying arbitrary content IDs. Attackers can enumerate sequential post_content IDs via the /v1/attachment endpoint to obtain signed download URLs for private, friend-only, and following-only images, videos, and attachments.

BuildAdmin versions up to 2.3.9 have an authorization bypass vulnerability that allows authenticated backend administrators with specific permissions to modify other administrators' profiles via the id parameter. This includes changing sensitive fields such as avatar, nickname, email, mobile, and motto, even for super administrators.

PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check. Attackers can supply another buyer's receipt id to GET /buyer/trade/receipt/{id} to obtain invoice titles, taxpayer identification numbers, order numbers, member ids and member names.

SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in FileServiceImpl.loadFile to read private survey attachments and respondent uploads.

MrDoc versions up to 1.1.1 have a missing object-level authorization vulnerability in the ImportLocalDoc API. Authenticated users can exploit this flaw to modify other users' documents and projects by sending crafted PUT or POST requests. This allows publishing private drafts, reparenting documents, or injecting documents without proper authorization.

Misaka Danmu Server versions up to 2.8.9 have a missing authentication vulnerability in several critical API routes under /api/ui. This flaw allows unauthenticated attackers to access sensitive audit, diagnostics, and data management functions, including reading audit logs with login IPs, server logs, environment paths, deleting episode rows, clearing media-server mappings, and wiping audit history. The vulnerability has a medium severity with a CVSS score of 6.9.

Misaka Danmu Server versions up to 2.8.9 have an authentication bypass vulnerability in the POST /api/ui/config-history/rollback endpoint. This flaw allows unauthenticated attackers to write arbitrary configuration keys, including ipWhitelist, trustedProxies, and webhookApiKey, enabling them to gain administrator-level access to all protected endpoints.

DooTask versions up to 1.9.66 have an authorization bypass vulnerability in the WebSocketDialog::checkDialog() function. This flaw allows authenticated users to bypass membership checks for dialogs with the group_type 'okr'. Exploiting this, attackers can read and send messages in OKR comment dialogs by supplying the dialog_id to certain endpoints.

mlogclub bbs-go versions up to 4.4.6 contain an authentication bypass vulnerability in the /api/login/google_one_tap endpoint. This flaw allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client without proper audience validation. Attackers can replay a victim's Google-signed ID token obtained from their own OAuth client to gain unauthorized access to the victim's Google-linked account.

sshportal versions up to 1.19.5 have a missing authorization vulnerability in the management shell 'key show' command. This flaw allows authenticated non-admin users to retrieve decrypted backend private SSH keys by requesting predictable key names such as 'default' or 'host'. Exploiting this vulnerability enables attackers to connect directly to backend hosts, bypassing access control lists (ACLs) and session recording mechanisms.