https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 07 Nov 2026 16:07:12 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-118691 <p>xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users&#39; accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user&#39;s cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.</p> <p>xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users&#39; accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user&#39;s cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.</p> https://db.gcve.eu/vuln/fkie_cve-2026-118691 https://db.gcve.eu/vuln/ghsa-8xg3-rxxw-rm99 <p>xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users&#39; accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user&#39;s cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.</p> <p>xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenticated attackers to send messages from other users&#39; accounts using publicly known default API secrets. Attackers can supply the hard-coded api_key and another user&#39;s cookie_id, plus chosen chat_id, to_user_id and message values, to send arbitrary Xianyu messages to buyers from that merchant account.</p> https://db.gcve.eu/vuln/ghsa-8xg3-rxxw-rm99