FileCodeBox versions 2.2.1 through 2.8.4 have a stored cross-site scripting (XSS) vulnerability in the renderMarkdownPreview function. This flaw occurs because the function returns unsanitized text when the marked parser throws an error. Unauthenticated attackers can exploit this by sharing text containing thousands of nested blockquote markers followed by malicious HTML payloads, which execute scripts that steal the admin token from localStorage.
Dromara free-fs versions 2.0.1 through 2.3.1 have a missing authentication vulnerability in the FileStreamController.preview endpoint. This flaw allows unauthenticated attackers to download stored files by using a file ID obtained from share listings or preview links. The vulnerability enables unauthorized access to any user's or workspace's files without requiring authentication.
PMail versions 2.9.1 through 2.9.8 have a stored cross-site scripting (XSS) vulnerability in the /attachments/{id}/{cid} endpoint. This endpoint returns email attachments with the sender-supplied Content-Type after rewriting cid references into attachment links. Unauthenticated SMTP senders can exploit this by sending a text/html attachment and a page-covering cid link, causing the recipient's webmail session to execute malicious scripts, potentially allowing password changes including for administrators.
Dromara free-fs versions 2.0.1 through 2.3.1 have a vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes. This occurs via the PUT /apis/user/forget-password endpoint, where attackers can request a reset code for a known email and submit unlimited guesses within the code's 300-second validity period. Successful exploitation enables attackers to set a new password and take over user accounts.
Dromara free-fs versions 2.0.1 through 2.3.1 have an authorization bypass vulnerability. This flaw allows attackers to access code-protected shares without providing the required share code, as the enforcement is only done client-side. Attackers who know a share ID can list and download files from these shares, including preview-only shares, without authorization.
paicoding version 1.0.3 has a missing authorization vulnerability in the ArticleRestController's article detail endpoint. This flaw allows unauthenticated attackers to access restricted articles, including paid, login-only, member-only, and draft content, by enumerating article IDs via the GET /article/api/data/detail/{articleId} endpoint.
SurveyKing versions 1.13.0 through 1.13.2 have a stored cross-site scripting (XSS) vulnerability. The server accepts respondent-supplied survey snapshots, and the frontend renders survey titles using innerHTML, allowing malicious scripts embedded in these snapshots to execute in an administrator's browser. This vulnerability can be triggered by anonymous respondents submitting crafted snapshots with event handlers like img onerror. The CVSS score is 6.1, indicating a medium severity impact.
SurveyKing version 1.13.2 has a missing authorization vulnerability in its result lookup feature. The anonymous survey view leaks the lookup configuration, including the password. Additionally, the lookup password check is bypassed when no answer is provided. This allows unauthenticated attackers with access to a public survey link to inject a wildcard character into the query, enabling them to retrieve all survey responses, including hidden fields.
DjangoBlog versions 2.0.0.0 through 2.1.0.0 contain a stored cross-site scripting (XSS) vulnerability. The issue arises because the class_filter comment sanitizer improperly allows event-handler attributes on certain HTML tags, enabling authenticated commenters to inject scripts that execute automatically when a page is viewed, including by administrators.
SurveyKing versions 1.12.0 through 1.13.2 have an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses. The flaw exists because the AnswerServiceImpl.saveAnswer function skips login and survey password checks. Attackers can submit responses to protected surveys and impersonate other users by setting the createBy field in the request body, potentially corrupting survey results.
ragent versions 1.0.0 through 1.1.0 have a missing authorization vulnerability in the RagTraceController component. This flaw allows any authenticated user to access and view RAG traces belonging to other users. The exposed information includes usernames, user IDs, conversation IDs, questions, and detailed per-node execution data. The vulnerability does not allow modification or denial of service but results in unauthorized information disclosure.
paicoding versions 1.0.0 through 1.0.3 have a stored cross-site scripting (XSS) vulnerability. This occurs because the SeoInjectService embeds user profile text directly into an inline JSON-LD script element without proper escaping. Authenticated attackers can exploit this by injecting a closing script tag and arbitrary HTML into their profile, which executes scripts in the context of visitors viewing the profile page. This can lead to theft of non-HttpOnly f-session cookies.
free-fs versions 2.0.1 through 2.3.1 have an SQL injection vulnerability in the FileShareServiceImpl.getPages method. This flaw allows authenticated users to inject SQL via the orderBy parameter in the /apis/share/pages endpoint, enabling them to read arbitrary database contents such as share codes.
SurveyKing versions 1.12.0 through 1.13.2 have an authorization bypass vulnerability in the linked survey feature. This flaw allows authenticated attackers to manipulate linked surveys belonging to other users by bypassing verification of the linked survey ID ownership. Attackers can read, modify, or create survey responses in surveys they do not own.
DjangoBlog versions between commit d186b1c and commit 6134ed6 contain a stored cross-site scripting (XSS) vulnerability. Authenticated OAuth users can exploit this by injecting malicious script through an unescaped nickname in comment reactions. This allows attackers to execute arbitrary script in the browsers of visitors viewing the affected articles.
paicoding version 1.0.3 has a payment bypass vulnerability that enables authenticated attackers to unlock paid articles without proper payment. The flaw arises from weak payment confirmation codes that can be guessed by enumerating approximately 2000 counter values. By submitting a matching verification code to an unauthenticated callback, attackers can mark payments as completed and access paid content.
ragent version 1.1.0 has a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts by uploading SVG documents. These SVG files are served inline with the image/svg+xml MIME type, causing scripts within them to execute in the context of the application when other users view the documents. This can lead to account takeover scenarios.
A stored cross-site scripting (XSS) vulnerability exists in paicoding between commits 766c48b and 903adce. The flaw occurs in payment notifications where the payer's display name is inserted without escaping and rendered unsafely, allowing authenticated attackers to inject malicious scripts. This script executes in the author's browser when viewing notifications related to pending payments on paid articles.
paicoding versions from commit b8206b9 through commit 903adce have a vulnerability where accounts created via ZSXQ login use predictable credentials. The username and password are derived solely from the member's ZSXQ number, which is publicly accessible via the victim's profile page. This allows unauthenticated attackers to compute the credentials and log in to the victim's account without authorization.
Paicoding versions 1.0.0 through 1.0.3 contain a stored cross-site scripting (XSS) vulnerability in the image upload functionality. The vulnerability arises because the ImageServiceImpl.validateStaticImg method accepts SVG files, which can include embedded scripts. When these SVG images are uploaded by authenticated attackers and served from the site origin using local storage, the scripts execute in the context of users viewing the images. This can lead to theft of non-HttpOnly f-session cookies and account hijacking.