Threats tagged 'ghsa-7q7r-9wvx-j8cq'

VanBlog versions through 0.54.0 have an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles. The flaw exists in the POST /api/public/article/:id endpoint, where private articles without effective passwords can be accessed by submitting any non-empty password. Additionally, hidden articles are exposed because the function handling article retrieval does not check the hidden flag, allowing full content disclosure.