Bobur Abdugafforov

CSZ CMS CSZ CMS - Broken Access Control

AsyncFuncAI deepwiki-open - Path Traversal

wg-easy wg-easy - OS Command Injection

lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload

deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and Delete

automatisch - Server-Side Request Forgery via HTTP Request Custom Action

Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass

fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication

Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint

Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding