SurveyKing versions 1.12.0 through 1.13.2 have an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses. The flaw exists because the AnswerServiceImpl.saveAnswer function skips login and survey password checks. Attackers can submit responses to protected surveys and impersonate other users by setting the createBy field in the request body, potentially corrupting survey results.
ragent versions 1.0.0 through 1.1.0 have a missing authorization vulnerability in the RagTraceController component. This flaw allows any authenticated user to access and view RAG traces belonging to other users. The exposed information includes usernames, user IDs, conversation IDs, questions, and detailed per-node execution data. The vulnerability does not allow modification or denial of service but results in unauthorized information disclosure.
paicoding versions 1.0.0 through 1.0.3 have a stored cross-site scripting (XSS) vulnerability. This occurs because the SeoInjectService embeds user profile text directly into an inline JSON-LD script element without proper escaping. Authenticated attackers can exploit this by injecting a closing script tag and arbitrary HTML into their profile, which executes scripts in the context of visitors viewing the profile page. This can lead to theft of non-HttpOnly f-session cookies.
free-fs versions 2.0.1 through 2.3.1 have an SQL injection vulnerability in the FileShareServiceImpl.getPages method. This flaw allows authenticated users to inject SQL via the orderBy parameter in the /apis/share/pages endpoint, enabling them to read arbitrary database contents such as share codes.
SurveyKing versions 1.12.0 through 1.13.2 have an authorization bypass vulnerability in the linked survey feature. This flaw allows authenticated attackers to manipulate linked surveys belonging to other users by bypassing verification of the linked survey ID ownership. Attackers can read, modify, or create survey responses in surveys they do not own.
DjangoBlog versions between commit d186b1c and commit 6134ed6 contain a stored cross-site scripting (XSS) vulnerability. Authenticated OAuth users can exploit this by injecting malicious script through an unescaped nickname in comment reactions. This allows attackers to execute arbitrary script in the browsers of visitors viewing the affected articles.
paicoding version 1.0.3 has a payment bypass vulnerability that enables authenticated attackers to unlock paid articles without proper payment. The flaw arises from weak payment confirmation codes that can be guessed by enumerating approximately 2000 counter values. By submitting a matching verification code to an unauthenticated callback, attackers can mark payments as completed and access paid content.
ragent version 1.1.0 has a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts by uploading SVG documents. These SVG files are served inline with the image/svg+xml MIME type, causing scripts within them to execute in the context of the application when other users view the documents. This can lead to account takeover scenarios.
A stored cross-site scripting (XSS) vulnerability exists in paicoding between commits 766c48b and 903adce. The flaw occurs in payment notifications where the payer's display name is inserted without escaping and rendered unsafely, allowing authenticated attackers to inject malicious scripts. This script executes in the author's browser when viewing notifications related to pending payments on paid articles.
paicoding versions from commit b8206b9 through commit 903adce have a vulnerability where accounts created via ZSXQ login use predictable credentials. The username and password are derived solely from the member's ZSXQ number, which is publicly accessible via the victim's profile page. This allows unauthenticated attackers to compute the credentials and log in to the victim's account without authorization.
Paicoding versions 1.0.0 through 1.0.3 contain a stored cross-site scripting (XSS) vulnerability in the image upload functionality. The vulnerability arises because the ImageServiceImpl.validateStaticImg method accepts SVG files, which can include embedded scripts. When these SVG images are uploaded by authenticated attackers and served from the site origin using local storage, the scripts execute in the context of users viewing the images. This can lead to theft of non-HttpOnly f-session cookies and account hijacking.
Dental practice websites hosted with iDentalSoft were found to expose sensitive information via JSON responses on certain pages. This data leakage included OAuth credentials, password hashes, and personally identifiable information (PII). The vulnerability has been addressed and fixed in iDentalSoft version 14.0.3.
Omnispace Agora Project versions through 26.10.0 have a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL via the personsSort session value. This value is used unsanitized in ORDER BY clauses in MdlUser.php and MdlSpace.php. Exploitation can leak database information such as the MariaDB version through error-based payloads on user and space listing pages.
Omnispace Agora Project versions through 26.10.0 have a vulnerability in token generation where the shared-calendar iCal share token can be predicted and forged by unauthenticated attackers. This is due to the token being derived from predictable fields such as object creation time, which is disclosed in the calendar metadata. Exploiting this allows unauthorized reading of shared calendar iCal feeds.
A vulnerability in dnf5daemon-server allows unauthenticated local users to invoke root-privileged commands via D-Bus methods that accept caller-controlled URLs or RPM path patterns. This can lead to disclosure of privileged content through a world-readable cache and denial of service by exhausting disk space. Red Hat Enterprise Linux is not affected as it does not ship dnf5daemon-server. Mitigations include removing or disabling dnf5daemon-server if not required or restricting D-Bus access to trusted users.
Apache APISIX versions 0.9 through 3.19.0 contain an interpretation conflict vulnerability that allows unauthenticated clients to access upstream paths protected by route-level authentication plugins if a route without authentication exists on the same upstream and the upstream does not collapse encoded dot segments. This incorrect authorization issue is fixed in version 3.20.0.
Apache APISIX versions from 3.19.0 up to but not including 3.20.0 contain a relative path traversal vulnerability combined with an unintended proxy behavior. This flaw allows a caller of the MCP endpoint to invoke endpoints not declared in the OpenAPI document, using the HTTP method declared for the tool and the credentials associated with the Route. The issue is resolved in version 3.20.0.
CVE-2026-124719 is an authentication bypass vulnerability in Apache APISIX versions from 3.19.0 up to but not including 3.20.0. The flaw occurs when a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, allowing an attacker to spoof another identity against the upstream API. The issue is fixed in version 3.20.0.
Apache APISIX versions 3.18.0 through 3.19.0 contain an authentication bypass vulnerability due to spoofing. This occurs on routes using jwe-decrypt with strict mode disabled and a forward_header different from the token header, allowing unauthenticated clients to supply values treated as decrypted plaintext by the upstream. A similar issue arises when forward-auth is configured with allow_degradation set to true and the authentication service is unavailable. The vulnerability is fixed in version 3.20.0.
Apache APISIX versions 3.18.0 through 3.19.0 contain an interpretation conflict vulnerability that leads to incorrect authorization. When the match_uri_encoded_slash option is enabled along with skip_mtls_uri_regex configuration, a client without a certificate can access upstream services behind routes that require client certificates, but only for request paths that decode to an exempted URI. This issue is resolved in version 3.20.0.