Threat database

Tamery versions from 0.26.1 up to but not including 0.99.0 contain an authorization bypass vulnerability in the cloud sync API's chatsMessages.update handler. This flaw allows authenticated Pro subscribers to manipulate the client-supplied chatId parameter, enabling them to move messages with arbitrary content into another user's AI chat history. The vulnerability is fixed in version 0.99.0.

Tamery versions from 0.32.0 up to but not including 0.99.0 contain an authorization bypass vulnerability in the cloud sync API's connectionsResources.create handler. This flaw allows authenticated users to attach resources to other users' connections by including a victim's connectionId in batch requests. The issue is fixed in version 0.99.0.

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration settings and install JavaScript plugins running in QuickJS.

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.

MuseBot versions prior to 2.0.0 contain a critical authentication bypass vulnerability due to the use of a hard-coded default session key. This flaw allows unauthenticated attackers to forge admin sessions by signing session cookies with the default key, granting full administrative access. Exploitation enables attackers to read sensitive data such as password hashes, chat records, and bot configurations, and to stop bots. The vulnerability is fixed in MuseBot version 2.0.0.

Blossom versions up to 1.17.1 have an authorization bypass vulnerability that allows authenticated users to access and manipulate other users' folders. This occurs because the FolderService only filters queries by folder ID, enabling attackers to supply another user's folder ID to endpoints such as /folder/info, /folder/upd, /folder/open, or /folder/del. Exploitation can lead to unauthorized reading of storage paths, renaming, toggling visibility, or deletion of folders.

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses.

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.

CoreShop by CoreUnion versions up to 1.5.5 contain an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint. The flaw arises from improper neutralization of special elements in the 'order' parameter used in an ORDER BY clause, allowing anonymous attackers to inject subqueries. Exploitation can lead to extraction of member accounts and orders via boolean-based or time-based blind SQL injection techniques.

CoreShop versions up to 1.5.5 have an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint. The flaw arises from improper validation of the 'order' parameter used in the ORDER BY clause, allowing attackers to inject subqueries. This can lead to extraction of sensitive data such as member accounts and orders using blind SQL injection techniques.

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.

Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist.

HuLa-Server versions up to 3.0.7 have an insecure direct object reference vulnerability in the FriendController.friendList endpoint. Authenticated users can bypass authorization checks by supplying a user ID (uid) parameter in GET requests to /user/friend/page, allowing them to view other users' friend lists without proper permission.

HuLa-Server versions up to 3.0.7 have an authorization bypass vulnerability in the FeedController.delFeed function. Authenticated users can delete moments belonging to other users by providing arbitrary feedId values in POST requests to /feed/del. This allows attackers to remove other users' moments, including associated media, comments, and likes.

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().

Tencent BlueKing CMDB (bk-cmdb) versions up to 3.14.6 have a missing authorization vulnerability that allows authenticated users to access host information from other businesses. This occurs via the POST /api/v3/hosts/search/asstdetail endpoint, which improperly skips authorization checks, enabling unauthorized host data retrieval.

RuoYi-Vue-Plus versions up to 6.0.0 have an authorization bypass vulnerability in the SysUserServiceImpl.selectUserListByDept function. Authenticated users with the system:user:list permission under a department-restricted role can access user information from any department by specifying arbitrary department IDs. This allows them to retrieve usernames, nicknames, account status, last login IP and time, and remarks of users outside their authorized scope.

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site can supply that siteId with another site's session_id or order_id to read its visit history, IP addresses, user agents and order data.

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.