https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-20T00:29:28.210838+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-111652 fkie_cve-2026-111652 2026-10-20T00:29:28.228957+00:00

Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks.

 https://db.gcve.eu/vuln/ghsa-mq27-6p96-cfjc GHSA-mq27-6p96-cfjc 2026-10-20T00:29:28.229041+00:00

Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks.