Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "art-template",
          "programFiles": [
            "src/compile/adapter/resolve-filename.js",
            "src/compile/adapter/loader.js"
          ],
          "vendor": "art-template",
          "versions": [
            {
              "lessThanOrEqual": "4.13.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "muhammadsiddiq"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "art-template\u0027s sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include() and extend() template directives, resolves the target file path via path.resolve(root, filename) with no check afterward that the result remains inside root. Because path.resolve() discards root entirely when filename is an absolute path, and does not block \u0027../\u0027 traversal sequences, and the resolved path is passed directly to fs.readFileSync() in loader.js with its contents compiled and rendered, an application that lets a sub-template name be influenced by external input (e.g. a query parameter passed into {{include page}}) allows an attacker to read arbitrary files on disk that the Node process can access."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "HIGH"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:59:35.983Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/aui/art-template"
        }
      ],
      "title": "art-template: Path Traversal in Sub-Template Resolution via include()/extend()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71215",
    "datePublished": "2026-08-05T06:59:35.983Z",
    "dateReserved": "2026-08-05T06:56:15.799Z",
    "dateUpdated": "2026-08-05T06:59:35.983Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "plandev (sequencing-server)",
          "programFiles": [
            "sequencing-server/src/app.ts",
            "sequencing-server/src/utils/hasura.ts"
          ],
          "vendor": "NASA-AMMOS",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sardor Shoakbarov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Aerie/PlanDev sequencing-server\u0027s authorization middleware (sequencing-server/src/app.ts) derives the caller\u0027s Hasura session role via getHasuraSession(), which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header\u0027s JWT claims, with no verification that the request actually originated from Hasura. By setting {\"session_variables\":{\"x-hasura-role\":\"aerie_admin\"}} in the body of a request to POST /command-expansion/put-expansion with no Authorization header, an unauthenticated attacker satisfies the role check and can insert arbitrary expansion rules into sequencing.expansion_rule, which govern how spacecraft activities are translated into commands. Separately, POST /put-dictionary is explicitly listed in the ENDPOINTS_WHITELIST and is exempt from any authentication, allowing unauthenticated writes of command dictionaries."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "CRITICAL"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:59:32.771Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/NASA-AMMOS/plandev"
        }
      ],
      "title": "NASA-AMMOS plandev: Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71214",
    "datePublished": "2026-08-05T06:59:32.771Z",
    "dateReserved": "2026-08-05T06:56:15.799Z",
    "dateUpdated": "2026-08-05T06:59:32.771Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "typemill",
          "programFiles": [
            "system/typemill/Controllers/ControllerWebAuth.php"
          ],
          "vendor": "typemill",
          "versions": [
            {
              "lessThanOrEqual": "2.25.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Shaxriyor Abdullayev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Typemill\u0027s login endpoint (POST /tm/login, ControllerWebAuth::login()) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling. The only attempt-counting/lockout logic present in the same file protects an optional secondary email-authcode step and does not apply to the primary password check."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "HIGH"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:59:29.622Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/typemill/typemill"
        }
      ],
      "title": "typemill: No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71213",
    "datePublished": "2026-08-05T06:59:29.622Z",
    "dateReserved": "2026-08-05T06:56:15.799Z",
    "dateUpdated": "2026-08-05T06:59:29.622Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "xidown",
          "programFiles": [
            "xidown/core/scanner.py",
            "xidown/core/downloader.py"
          ],
          "vendor": "indravoyager",
          "versions": [
            {
              "lessThanOrEqual": "1.25.1.19",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Muhammadsiddiq"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no \u0027--\u0027 end-of-options marker and no scheme validation anywhere in the codebase. Because yt-dlp parses any argument beginning with \u0027-\u0027 as a CLI option rather than link text, a crafted \u0027URL\u0027 value such as -U (yt-dlp\u0027s self-update flag) or --exec=... is parsed as a real yt-dlp option instead of a URL, altering the tool\u0027s control flow before its own URL validation runs. Full code execution via --exec was not demonstrated in the single-URL flow tested, but the underlying argument-injection primitive is confirmed and unmitigated across all call sites."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "MEDIUM"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88 Argument Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:59:26.576Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://cwe.mitre.org/data/definitions/88.html"
        }
      ],
      "title": "xidown: Argument Injection via Unterminated yt-dlp Command Line Construction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71212",
    "datePublished": "2026-08-05T06:59:26.576Z",
    "dateReserved": "2026-08-05T06:56:15.799Z",
    "dateUpdated": "2026-08-05T06:59:26.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "mlflow",
          "programFiles": [
            "mlflow/server/handlers.py",
            "mlflow/server/gateway_api.py"
          ],
          "vendor": "mlflow",
          "versions": [
            {
              "lessThanOrEqual": "3.14.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abdivasiyev Sunnatillo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MLflow\u0027s AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body. MLflow\u0027s existing SSRF guard, _validate_webhook_url (which blocks non-global and metadata IPs), is never invoked anywhere in this gateway secret/proxy code path. The CreateGatewaySecret action additionally has no entry in the permission-validator map, so it requires only basic authentication rather than any specific scope, meaning any authenticated user \u2014 including read-only accounts \u2014 can create a secret pointing at an internal address and reach it via the proxy endpoint, potentially exposing cloud-instance IAM credentials via metadata services. This is related to CVE-2026-4035, which addresses a distinct mechanism in the same gateway-secret feature (server-side $ENV_VAR resolution inside the api_key field leaking credentials to the configured upstream); the finding here is an independent missing-validation gap in the api_base destination itself, unaffected by that fix."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "HIGH"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:59:23.394Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/mlflow/mlflow/tree/v3.14.0/mlflow"
        }
      ],
      "title": "mlflow: Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71211",
    "datePublished": "2026-08-05T06:59:23.394Z",
    "dateReserved": "2026-08-05T06:56:15.799Z",
    "dateUpdated": "2026-08-05T06:59:23.394Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "mealie",
          "programFiles": [
            "mealie/pkgs/safehttp/transport.py"
          ],
          "vendor": "mealie-recipes",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sarvar Omonov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mealie\u0027s AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently. Because the validated IP is never pinned to the actual connection, a DNS-rebinding attacker (returning a public IP to the validation lookup and a private/metadata IP to the real connection) defeats the guard. This is reachable by any authenticated user via /api/recipes/create/url, /api/recipes/test-scrape-url, and /api/recipes/{slug}/image, and the scraper reflects fetched content back to the requester, allowing an authenticated user to read internal HTTP services and cloud-metadata endpoints."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "MEDIUM"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:59:19.902Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/mealie-recipes/mealie"
        }
      ],
      "title": "mealie: DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71210",
    "datePublished": "2026-08-05T06:59:19.902Z",
    "dateReserved": "2026-08-05T06:56:15.799Z",
    "dateUpdated": "2026-08-05T06:59:19.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "audiobookshelf",
          "programFiles": [
            "server/routers/Auth.js",
            "server/managers/CacheManager.js"
          ],
          "vendor": "advplyr",
          "versions": [
            {
              "lessThanOrEqual": "2.35.1",
              "status": "affected",
              "version": "2.19.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sarvar Omonov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "audiobookshelf\u0027s authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. Express\u0027s router decodes the :id route parameter before handler code runs, so a %2F-encoded \u0027../\u0027 sequence in :id (e.g. ..%2f..%2f..%2ftmp%2fpwned) passes the literal-path auth-exemption check while resolving to a real path-traversal payload once decoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check. This bypasses the fix applied for CVE-2025-25205 (which anchored the exemption regex and switched it to req.path) and results in unauthenticated arbitrary file read of any file matching the pattern *_\u003cwidth\u003e[x\u003cheight\u003e].\u003cext\u003e that the service account can read."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "HIGH"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:59:16.579Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw"
        },
        {
          "url": "https://github.com/advplyr/audiobookshelf"
        }
      ],
      "title": "audiobookshelf: %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71209",
    "datePublished": "2026-08-05T06:59:16.579Z",
    "dateReserved": "2026-08-05T06:56:15.799Z",
    "dateUpdated": "2026-08-05T06:59:16.579Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "KubeSphere",
          "programFiles": [
            "pkg/utils/clusterclient/clusterclient.go"
          ],
          "vendor": "kubesphere",
          "versions": [
            {
              "lessThanOrEqual": "4.1.3-rc.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ashik Mohamed"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "KubeSphere\u0027s cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource\u0027s connection configuration and immediately calls Discovery().ServerVersion() against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254). A user able to create or update a Cluster CRD can force the controller-manager and apiserver pods to issue outbound requests to arbitrary internal or metadata endpoints."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "HIGH"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:59:13.308Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/ashikmd7/kubeSphere/blob/main/SSRF%20via%20Cluster%20CRD%20KubeConfig/README.md"
        },
        {
          "url": "https://github.com/kubesphere/kubesphere"
        }
      ],
      "title": "KubeSphere: SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71208",
    "datePublished": "2026-08-05T06:59:13.308Z",
    "dateReserved": "2026-08-05T06:56:15.799Z",
    "dateUpdated": "2026-08-05T06:59:13.308Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Stock-Inventory-Management-System",
          "programFiles": [
            "login.php"
          ],
          "vendor": "mrswapnilsahu",
          "versions": [
            {
              "lessThanOrEqual": "1.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Behruzbek Zokiraliyev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Stock-Inventory-Management-System application\u0027s login.php assigns raw $_POST username/password values to $_SESSION and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. An unauthenticated remote attacker can submit a payload such as \u0027 OR \u00271\u0027=\u00271 in the login form to bypass authentication entirely. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "CRITICAL"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:59:10.082Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/mrswapnilsahu/Stock-Inventory-Management-System/blob/master/login.php"
        }
      ],
      "title": "Stock-Inventory-Management-System: Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71207",
    "datePublished": "2026-08-05T06:59:10.082Z",
    "dateReserved": "2026-08-05T06:56:15.799Z",
    "dateUpdated": "2026-08-05T06:59:10.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "shiori",
          "programFiles": [
            "internal/domains/auth.go"
          ],
          "vendor": "go-shiori",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eldor Nabijonov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shiori\u0027s CheckToken function (internal/domains/auth.go) validates only the JWT\u0027s HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. Deleting an account or demoting it from owner to a regular role has no effect on tokens already issued to that account \u2014 a deleted or demoted owner\u0027s token continues authenticating with its original owner-level privileges until natural expiry, which can be up to 30 days with \u0027remember me\u0027 enabled."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "HIGH"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:59:06.908Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/go-shiori/shiori"
        }
      ],
      "title": "shiori: JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71206",
    "datePublished": "2026-08-05T06:59:06.908Z",
    "dateReserved": "2026-08-05T06:56:15.799Z",
    "dateUpdated": "2026-08-05T06:59:06.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "changedetection.io",
          "programFiles": [
            "changedetectionio/flask_app.py"
          ],
          "vendor": "dgtlmoon",
          "versions": [
            {
              "status": "affected",
              "version": "0.55.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eldor Nabijonov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "changedetection.io\u0027s /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt). Because the entire application is protected by one shared password with no per-user accounts, a successful brute-force guess grants full administrative access, including the ability to view/regenerate the API token."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "MEDIUM"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:59:03.879Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/dgtlmoon/changedetection.io"
        }
      ],
      "title": "changedetection.io: No Rate Limiting on /login Enables Unlimited Password Brute-Force"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71205",
    "datePublished": "2026-08-05T06:59:03.879Z",
    "dateReserved": "2026-08-05T06:56:15.799Z",
    "dateUpdated": "2026-08-05T06:59:03.879Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "changedetection.io",
          "programFiles": [
            "changedetectionio/blueprint/settings/__init__.py",
            "changedetectionio/forms.py"
          ],
          "vendor": "dgtlmoon",
          "versions": [
            {
              "status": "affected",
              "version": "0.55.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eldor Nabijonov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "changedetection.io\u0027s /settings save handler builds an update dict from form.data[\u0027application\u0027] and blind-merges it into the stored application settings via .update(). Because WTForms represents an unchecked checkbox as False rather than \u0027unchanged\u0027, and only the \u0027password\u0027 field is special-cased against this problem, a POST to /settings that omits the api_access_token_enabled field (e.g. a minimal scripted request) silently disables API key enforcement for the entire REST API, exposing the full watch list, history, and configuration to unauthenticated requests."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "MEDIUM"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:59:00.078Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/dgtlmoon/changedetection.io"
        }
      ],
      "title": "changedetection.io: Omitted Checkbox in /settings Save Silently Disables API Key Enforcement"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71204",
    "datePublished": "2026-08-05T06:59:00.078Z",
    "dateReserved": "2026-08-05T06:56:15.799Z",
    "dateUpdated": "2026-08-05T06:59:00.078Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "changedetection.io",
          "programFiles": [
            "changedetectionio/api/Spec.py"
          ],
          "vendor": "dgtlmoon",
          "versions": [
            {
              "status": "affected",
              "version": "0.55.7"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eldor Nabijonov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "changedetection.io\u0027s REST API resources are protected by an @auth.check_token decorator validating the caller\u0027s x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get() method carries neither @auth.check_token nor @validate_openapi_request. An unauthenticated client can retrieve the full merged OpenAPI schema (all endpoint paths, parameters, and registered processor plugins) even when API access control is enabled and every sibling /api/v1/* route correctly requires the key."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "MEDIUM"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:58:56.911Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/dgtlmoon/changedetection.io"
        }
      ],
      "title": "changedetection.io: Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71203",
    "datePublished": "2026-08-05T06:58:56.911Z",
    "dateReserved": "2026-08-05T06:56:15.798Z",
    "dateUpdated": "2026-08-05T06:58:56.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "raster",
          "programFiles": [
            "src/editor.rs"
          ],
          "vendor": "kosinix",
          "versions": [
            {
              "lessThanOrEqual": "0.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "agrresore"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The raster Rust crate\u0027s crop() function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height. When an offset exceeds the corresponding source dimension, `width2 - offset_x` (or the height equivalent) underflows to a negative i32, which release builds do not trap; the negative value is then cast to usize inside Image::blank()\u0027s Vec::with_capacity() call, triggering a capacity-overflow panic and crashing the process on a single crafted crop request."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "HIGH"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "CWE-191 Integer Underflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:58:53.827Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/kosinix/raster/issues/30"
        }
      ],
      "title": "raster: Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71202",
    "datePublished": "2026-08-05T06:58:53.827Z",
    "dateReserved": "2026-08-05T06:56:15.798Z",
    "dateUpdated": "2026-08-05T06:58:53.827Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "imagecli",
          "programFiles": [
            "src/image_ops.rs"
          ],
          "vendor": "theotherphil",
          "versions": [
            {
              "lessThanOrEqual": "0.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "agrresore"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "imagecli\u0027s `carve \u003cratio\u003e` pipeline operation (Carve::apply() in src/image_ops.rs) only asserts `ratio \u003c= 1.0`, never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust\u0027s defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width \u2014 a function that panics when given a width below 2, crashing the process. This shares the same missing-input-validation root cause as the sibling `scale` finding in the same file but is an independently fixable, distinct code path."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "HIGH"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:58:50.621Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/theotherphil/imagecli/issues/67"
        }
      ],
      "title": "imagecli: Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-70378",
    "datePublished": "2026-08-05T06:58:50.621Z",
    "dateReserved": "2026-08-04T07:13:07.993Z",
    "dateUpdated": "2026-08-05T06:58:50.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "imagecli",
          "programFiles": [
            "src/image_ops.rs"
          ],
          "vendor": "theotherphil",
          "versions": [
            {
              "lessThanOrEqual": "0.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "agrresore"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "imagecli\u0027s `scale \u003cratio\u003e` pipeline operation (Scale::apply() in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. A large ratio (e.g. 100000) causes an attempted allocation of hundreds of terabytes, aborting the process. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "HIGH"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789 Uncontrolled Memory Allocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:58:47.554Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/theotherphil/imagecli/issues/66"
        }
      ],
      "title": "imagecli: Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-70377",
    "datePublished": "2026-08-05T06:58:47.554Z",
    "dateReserved": "2026-08-04T07:13:07.993Z",
    "dateUpdated": "2026-08-05T06:58:47.554Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Pluck CMS",
          "programFiles": [
            "admin.php",
            "data/inc/functions.admin.php"
          ],
          "vendor": "pluck-cms",
          "versions": [
            {
              "lessThan": "4.7.21",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ILHOMJON RUSTAMOV"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pluck CMS\u0027s admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the function\u0027s elseif branch returns true, treating the request as same-origin. Because a cross-site attacker page can suppress the Referer header (e.g. via \u003cmeta name=referrer content=no-referrer\u003e), it can force an authenticated administrator\u0027s browser to submit forged admin actions with no valid Referer, including creating pages with raw HTML (stored XSS via the rendered page) and installing PHP modules/themes (remote code execution)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "CRITICAL"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:58:44.471Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/pluck-cms/pluck"
        }
      ],
      "title": "Pluck CMS: CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-70376",
    "datePublished": "2026-08-05T06:58:44.471Z",
    "dateReserved": "2026-08-04T07:13:07.993Z",
    "dateUpdated": "2026-08-05T06:58:44.471Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "PocketFlow (pocketflow-coding-agent cookbook example)",
          "programFiles": [
            "cookbook/pocketflow-coding-agent/nodes.py"
          ],
          "vendor": "The-Pocket",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Muhammadrasul Zohidjonov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a `_path(workdir, p)` helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Because os.path.join returns an absolute `p` unchanged (ignoring workdir) and does not resolve \u0027../\u0027 sequences, an agent invocation whose file-tool arguments include an absolute path or a traversal sequence can read or write files outside the configured working directory. Severity reflects that this affects an illustrative cookbook example rather than a core library API; applications that copy this pattern into production are affected."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "HIGH"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:58:41.309Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/The-Pocket/PocketFlow"
        }
      ],
      "title": "PocketFlow: Path Traversal in pocketflow-coding-agent Cookbook Example File Tools"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-55747",
    "datePublished": "2026-08-05T06:58:41.309Z",
    "dateReserved": "2026-06-17T12:59:17.621Z",
    "dateUpdated": "2026-08-05T06:58:41.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Crater",
          "programFiles": [
            "app/Policies/CustomerPolicy.php",
            "app/Models/Customer.php"
          ],
          "vendor": "crater-invoice",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.6"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bobur Abdugafforov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and $user-\u003ehasCompany($model-\u003ecompany_id). CustomerPolicy\u0027s view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers() method are similarly unscoped (self::find($id) with no company filter). Any authenticated user of one company can read, reassign (steal), or delete another company\u0027s customer records, with deletion cascading to that customer\u0027s invoices and payments."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "HIGH"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:58:38.155Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/crater-invoice/crater"
        }
      ],
      "title": "Crater: Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-55739",
    "datePublished": "2026-08-05T06:58:38.155Z",
    "dateReserved": "2026-06-17T12:59:17.620Z",
    "dateUpdated": "2026-08-05T06:58:38.155Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Leantime",
          "programFiles": [
            "app/Domain/TwoFA/Services/TwoFA.php"
          ],
          "vendor": "Leantime",
          "versions": [
            {
              "lessThanOrEqual": "3.6.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Bobur Abdugafforov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher). Any authenticated user can invoke getSetupData with an arbitrary userId to read that user\u0027s live TOTP secret, or disable2FA to strip another account\u0027s two-factor authentication entirely, fully defeating account-level 2FA protection. This is related to CVE-2026-15509, which covers a similar missing-authorization pattern in the JSON-RPC editUser/addUser role-assignment path in the same application; the TwoFA service methods addressed here are a distinct, independently fixable set of RPC endpoints."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "HIGH"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:58:34.770Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/Leantime/leantime"
        }
      ],
      "title": "Leantime: Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-54418",
    "datePublished": "2026-08-05T06:58:34.770Z",
    "dateReserved": "2026-06-13T16:39:46.122Z",
    "dateUpdated": "2026-08-05T06:58:34.770Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Pluck CMS",
          "programFiles": [
            "data/inc/files.php"
          ],
          "vendor": "pluck-cms",
          "versions": [
            {
              "lessThanOrEqual": "4.7.21",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alijonov Alisher"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php (\u0027.php\u0027,\u0027php3\u0027,\u0027php4\u0027,\u0027php5\u0027,\u0027php6\u0027,\u0027php7\u0027,\u0027phtml\u0027,\u0027.phtm\u0027,\u0027.pht\u0027,\u0027.ph3\u0027,\u0027.ph4\u0027,\u0027.ph5\u0027,\u0027.asp\u0027,\u0027.cgi\u0027,\u0027.phar\u0027), checked against the last 4-5 characters of the filename. The blacklist omits the \u0027.php8\u0027 extension. An authenticated administrator can upload a file named e.g. shell.php8, which is stored unmodified and, on servers running PHP 8.x, is executed as PHP by the web server, resulting in remote code execution."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "value": "HIGH"
            },
            "type": "CVSS_3.1_severity"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T06:58:23.512Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/pluck-cms/pluck"
        }
      ],
      "title": "Pluck CMS: Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-54416",
    "datePublished": "2026-08-05T06:58:23.512Z",
    "dateReserved": "2026-06-13T16:39:46.122Z",
    "dateUpdated": "2026-08-05T06:58:23.512Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "hashbrown-cms",
          "programFiles": [
            "src/Server/Entity/Deployer/GitDeployer.js"
          ],
          "repo": "https://github.com/HashBrownCMS/hashbrown-cms",
          "vendor": "HashBrownCMS",
          "versions": [
            {
              "lessThanOrEqual": "1.4.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alijonov Alisher"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo() in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec(`git checkout ${this.branch || \u0027master\u0027}`), interpolating the configured branch value directly into a shell command with no escaping. GitDeployer.validate() only rejects a single-quote character in the repo, branch, username, and password fields; shell metacharacters such as \u0027;\u0027, \u0027\u0026\u0026\u0027, \u0027|\u0027, backticks, and \u0027$()\u0027 are not filtered. A user able to configure a project\u0027s Git deployer settings can set a malicious branch value (e.g. \u0027master;\u003ccommand\u003e#\u0027) that executes automatically on every subsequent deployer operation (media upload, content save, etc.), since pullRepo() is invoked unconditionally at the start of each such operation. This is related to CVE-2020-6948, which addressed single-quote escaping of the repo, username, and password fields in the same file\u0027s git clone invocation; the branch field used in the unquoted git checkout command was not covered by that fix and remains injectable."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T05:46:26.004Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/HashBrownCMS/hashbrown-cms"
        },
        {
          "url": "https://cve.turansec.uz/advisories/TRN-B571F773"
        }
      ],
      "title": "HashBrown CMS: OS Command Injection via Git Deployer Branch Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-70375",
    "datePublished": "2026-08-05T05:46:26.004Z",
    "dateReserved": "2026-08-04T07:13:07.993Z",
    "dateUpdated": "2026-08-05T05:46:26.004Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "hashbrown-cms",
          "programFiles": [
            "src/Server/Entity/Resource/Media.js",
            "src/Common/utilities.js"
          ],
          "repo": "https://github.com/HashBrownCMS/hashbrown-cms",
          "vendor": "HashBrownCMS",
          "versions": [
            {
              "lessThanOrEqual": "1.4.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alijonov Alisher"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail() in src/Server/Entity/Resource/Media.js builds a temporary file path as \u0027thumbnail\u0027 + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec() (\u0027convert \u0027 + tempFile + ...). The MIME-type filter in getMIMEType() (src/Common/utilities.js) truncates the extracted extension at the first \u0027?\u0027 character, while Path.extname() does not, allowing a filename such as \u0027x.jpg?$(command)\u0027 to pass the image-type check while still injecting a shell command substitution into the exec() call. An authenticated user holding the media resource scope can achieve arbitrary OS command execution in the context of the Node.js process via POST /api/{project}/{environment}/media/new."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T05:46:19.284Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/HashBrownCMS/hashbrown-cms"
        },
        {
          "url": "https://cve.turansec.uz/advisories/TRN-11FC0D88"
        }
      ],
      "title": "HashBrown CMS: OS Command Injection in Media Upload Thumbnail Generation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-70374",
    "datePublished": "2026-08-05T05:46:19.284Z",
    "dateReserved": "2026-08-04T07:13:07.993Z",
    "dateUpdated": "2026-08-05T05:46:19.284Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T17:23:16.261202Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T17:23:32.580Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://koha-community.org/",
          "defaultStatus": "unaffected",
          "product": "Koha",
          "programFiles": [
            "reports/issues_stats.pl"
          ],
          "repo": "https://gitlab.com/koha-community/Koha",
          "vendor": "Koha Community",
          "versions": [
            {
              "lessThan": "24.11.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "25.05.12",
              "status": "affected",
              "version": "25.05.00",
              "versionType": "semver"
            },
            {
              "lessThan": "25.11.06",
              "status": "affected",
              "version": "25.11.00",
              "versionType": "semver"
            },
            {
              "lessThan": "26.05.01",
              "status": "affected",
              "version": "26.05.00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Koha\u0027s reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T03:59:31.290Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42735"
        },
        {
          "url": "https://koha-community.org/koha-25-05-12-released/"
        },
        {
          "url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
        }
      ],
      "title": "Koha: SQL Injection in reports/issues_stats.pl"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-70373",
    "datePublished": "2026-08-04T13:00:15.197Z",
    "dateReserved": "2026-08-04T07:13:07.993Z",
    "dateUpdated": "2026-08-05T03:59:31.290Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70372",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T17:22:31.575799Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T17:23:04.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://koha-community.org/",
          "defaultStatus": "unaffected",
          "product": "Koha",
          "programFiles": [
            "reports/bor_issues_top.pl"
          ],
          "repo": "https://gitlab.com/koha-community/Koha",
          "vendor": "Koha Community",
          "versions": [
            {
              "lessThan": "24.11.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "25.05.12",
              "status": "affected",
              "version": "25.05.00",
              "versionType": "semver"
            },
            {
              "lessThan": "25.11.06",
              "status": "affected",
              "version": "25.11.00",
              "versionType": "semver"
            },
            {
              "lessThan": "26.05.01",
              "status": "affected",
              "version": "26.05.00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Koha\u0027s reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY); Filter values are concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments, and the Limit parameter is appended raw to a LIMIT clause. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T03:59:28.111Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42369"
        },
        {
          "url": "https://koha-community.org/koha-25-05-12-released/"
        },
        {
          "url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
        }
      ],
      "title": "Koha: SQL Injection in reports/bor_issues_top.pl"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-70372",
    "datePublished": "2026-08-04T13:00:12.836Z",
    "dateReserved": "2026-08-04T07:13:07.992Z",
    "dateUpdated": "2026-08-05T03:59:28.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T17:21:38.231269Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T17:21:56.672Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://koha-community.org/",
          "defaultStatus": "unaffected",
          "product": "Koha",
          "programFiles": [
            "reports/issues_avg_stats.pl"
          ],
          "repo": "https://gitlab.com/koha-community/Koha",
          "vendor": "Koha Community",
          "versions": [
            {
              "lessThan": "24.11.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "25.05.12",
              "status": "affected",
              "version": "25.05.00",
              "versionType": "semver"
            },
            {
              "lessThan": "25.11.06",
              "status": "affected",
              "version": "25.11.00",
              "versionType": "semver"
            },
            {
              "lessThan": "26.05.01",
              "status": "affected",
              "version": "26.05.00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Koha\u0027s reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T03:59:25.484Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42368"
        },
        {
          "url": "https://koha-community.org/koha-25-05-12-released/"
        },
        {
          "url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
        }
      ],
      "title": "Koha: SQL Injection in reports/issues_avg_stats.pl"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-70371",
    "datePublished": "2026-08-04T13:00:10.726Z",
    "dateReserved": "2026-08-04T07:13:07.992Z",
    "dateUpdated": "2026-08-05T03:59:25.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70370",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T17:20:50.487239Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T17:21:08.809Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://koha-community.org/",
          "defaultStatus": "unaffected",
          "product": "Koha",
          "programFiles": [
            "reports/catalogue_stats.pl"
          ],
          "repo": "https://gitlab.com/koha-community/Koha",
          "vendor": "Koha Community",
          "versions": [
            {
              "lessThan": "24.11.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "25.05.12",
              "status": "affected",
              "version": "25.05.00",
              "versionType": "semver"
            },
            {
              "lessThan": "25.11.06",
              "status": "affected",
              "version": "25.11.00",
              "versionType": "semver"
            },
            {
              "lessThan": "26.05.01",
              "status": "affected",
              "version": "26.05.00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Koha\u0027s reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation. When Line contains itemcallnumber and the cotedigits parameter is truthy, cotedigits is additionally concatenated raw as the numeric argument of a LEFT() call. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T03:59:22.689Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42363"
        },
        {
          "url": "https://koha-community.org/koha-25-05-12-released/"
        },
        {
          "url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
        }
      ],
      "title": "Koha: SQL Injection in reports/catalogue_stats.pl"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-70370",
    "datePublished": "2026-08-04T13:00:07.967Z",
    "dateReserved": "2026-08-04T07:13:07.992Z",
    "dateUpdated": "2026-08-05T03:59:22.689Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-70369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T17:20:31.267167Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T17:20:36.590Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://koha-community.org/",
          "defaultStatus": "unaffected",
          "product": "Koha",
          "programFiles": [
            "reports/acquisitions_stats.pl"
          ],
          "repo": "https://gitlab.com/koha-community/Koha",
          "vendor": "Koha Community",
          "versions": [
            {
              "lessThan": "24.11.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "25.05.12",
              "status": "affected",
              "version": "25.05.00",
              "versionType": "semver"
            },
            {
              "lessThan": "25.11.06",
              "status": "affected",
              "version": "25.11.00",
              "versionType": "semver"
            },
            {
              "lessThan": "26.05.01",
              "status": "affected",
              "version": "26.05.00",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sanjar Tulkinov Anvar o\u0027g\u0027li"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Koha\u0027s reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2. The statement is prepared and executed with no bound parameters. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), borrower_password_recovery, api_keys, and sessions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T03:59:08.403Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42360"
        },
        {
          "url": "https://koha-community.org/koha-25-05-12-released/"
        },
        {
          "url": "https://download.koha-community.org/koha-25.05.12.tar.gz"
        }
      ],
      "title": "Koha: SQL Injection in reports/acquisitions_stats.pl"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-70369",
    "datePublished": "2026-08-04T12:59:55.938Z",
    "dateReserved": "2026-08-04T07:13:07.992Z",
    "dateUpdated": "2026-08-05T03:59:08.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54414",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T15:04:58.077602Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T15:05:07.724Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/error311/FileRise",
          "defaultStatus": "unaffected",
          "product": "FileRise",
          "programFiles": [
            "src/FileRise/Domain/UploadModel.php",
            "src/FileRise/Support/UploadNamePolicy.php",
            "src/FileRise/Http/Controllers/FolderController.php"
          ],
          "repo": "https://github.com/error311/FileRise",
          "vendor": "error311",
          "versions": [
            {
              "lessThan": "3.16.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Shaxzod Turg\u0027unov (j33d1)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (\u003ccode\u003e/api/folder/uploadToSharedFolder.php\u003c/code\u003e), leading to arbitrary file write and administrator account takeover. The upload filename is validated by \u003ccode\u003eFolderController\u003c/code\u003e with \u003ccode\u003ebasename()\u003c/code\u003e and \u003ccode\u003eREGEX_FILE_NAME\u003c/code\u003e, which permit URL-encoded sequences (the regex blocks \u003ccode\u003e/\u003c/code\u003e and \u003ccode\u003e\\\u003c/code\u003e but not \u003ccode\u003e%\u003c/code\u003e). The raw filename is then passed to \u003ccode\u003eUploadModel::handleUpload\u003c/code\u003e, where it is reconstructed as \u003ccode\u003etrim(urldecode(basename($fileName)))\u003c/code\u003e, re-introducing path separators after validation (e.g. \u003ccode\u003e..%2fusers%2fusers.txt\u003c/code\u003e becomes \u003ccode\u003e../users/users.txt\u003c/code\u003e). \u003ccode\u003eUploadNamePolicy::isAllowedForWrite()\u003c/code\u003e applies \u003ccode\u003ebasename()\u003c/code\u003e internally and therefore only evaluates the final component (\u003ccode\u003eusers.txt\u003c/code\u003e), allowing the traversal sequence to pass the extension policy. The destination path is then used directly in \u003ccode\u003emove_uploaded_file()\u003c/code\u003e with no realpath containment check, allowing a write outside the intended upload directory. An attacker who possesses a valid, non-expired, upload-enabled shared-folder link/token (which are designed to be shared publicly) can overwrite \u003ccode\u003eusers/users.txt\u003c/code\u003e to create an administrator account, resulting in unauthenticated admin takeover and, depending on configuration, remote code execution. Exploitation requires possession of a valid, non-expired, upload-enabled shared-folder link/token. This issue is fixed in 3.16.0, which URL-decodes before validation and rejects any path separators in the upload filename.\u003c/p\u003e"
            }
          ],
          "value": "FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename() and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \\ but not %). The raw filename is then passed to UploadModel::handleUpload, where it is reconstructed as trim(urldecode(basename($fileName))), re-introducing path separators after validation (e.g. ..%2fusers%2fusers.txt becomes ../users/users.txt). UploadNamePolicy::isAllowedForWrite() applies basename() internally and therefore only evaluates the final component (users.txt), allowing the traversal sequence to pass the extension policy. The destination path is then used directly in move_uploaded_file() with no realpath containment check, allowing a write outside the intended upload directory. An attacker who possesses a valid, non-expired, upload-enabled shared-folder link/token (which are designed to be shared publicly) can overwrite users/users.txt to create an administrator account, resulting in unauthenticated admin takeover and, depending on configuration, remote code execution. Exploitation requires possession of a valid, non-expired, upload-enabled shared-folder link/token. This issue is fixed in 3.16.0, which URL-decodes before validation and rejects any path separators in the upload filename."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T12:56:06.937Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "name": "Fixed release v3.16.0",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/error311/FileRise/releases/tag/v3.16.0"
        },
        {
          "name": "Vulnerable decode-after-validate (UploadModel.php, v3.15.0)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/error311/FileRise/blob/v3.15.0/src/FileRise/Domain/UploadModel.php#L1023"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/error311/FileRise"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-54414",
    "datePublished": "2026-06-19T05:41:44.782Z",
    "dateReserved": "2026-06-13T16:39:46.122Z",
    "dateUpdated": "2026-06-22T15:05:07.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54419",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-18T12:01:03.819166Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-18T12:05:05.175Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/claudiopizzillo/PIAF-HMS",
          "defaultStatus": "affected",
          "product": "PIAF-HMS",
          "programFiles": [
            "checkin.php",
            "checkout.php",
            "rates.php",
            "rooms.php",
            "bills.php",
            "wakeup.php",
            "checkuser.php",
            "ec.php"
          ],
          "repo": "https://github.com/claudiopizzillo/PIAF-HMS",
          "vendor": "claudiopizzillo"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eshmirzayev Abbos"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eclaudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit \u003ccode\u003e389d2633441b65ced1c104212cd62be2bfca21e5\u003c/code\u003e) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated \u003ccode\u003emysql_query()\u003c/code\u003e calls via string concatenation, without sanitization, escaping, or parameterization. Affected sinks include \u003ccode\u003erooms.php\u003c/code\u003e (\u003ccode\u003eDELETE FROM Rooms WHERE ID = $_GET[\u0027ID\u0027]\u003c/code\u003e, unquoted numeric context), \u003ccode\u003echeckuser.php\u003c/code\u003e (\u003ccode\u003eWHERE Ext = \u0027$_GET[\"Ext\"]\u0027\u003c/code\u003e), \u003ccode\u003eec.php\u003c/code\u003e (date/extension parameters in a \u003ccode\u003eWHERE\u003c/code\u003e), \u003ccode\u003echeckin.php\u003c/code\u003e and \u003ccode\u003ewakeup.php\u003c/code\u003e (\u003ccode\u003e$_POST\u003c/code\u003e values into \u003ccode\u003eINSERT\u003c/code\u003e statements), \u003ccode\u003ebills.php\u003c/code\u003e (\u003ccode\u003e$_POST\u003c/code\u003e fields built into a \u003ccode\u003eWHERE\u003c/code\u003e clause), and \u003ccode\u003erates.php\u003c/code\u003e and \u003ccode\u003echeckout.php\u003c/code\u003e. A remote, unauthenticated attacker can inject arbitrary SQL to read, modify, or delete arbitrary records in the backing database (e.g. \u003ccode\u003erooms.php?ID=1 OR 1=1\u003c/code\u003e deletes all room records). Note: queries run via the legacy mysql_* extension, which does not permit stacked statements.\u003c/p\u003e"
            }
          ],
          "value": "claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query() calls via string concatenation, without sanitization, escaping, or parameterization. Affected sinks include rooms.php (DELETE FROM Rooms WHERE ID = $_GET[\u0027ID\u0027], unquoted numeric context), checkuser.php (WHERE Ext = \u0027$_GET[\"Ext\"]\u0027), ec.php (date/extension parameters in a WHERE), checkin.php and wakeup.php ($_POST values into INSERT statements), bills.php ($_POST fields built into a WHERE clause), and rates.php and checkout.php. A remote, unauthenticated attacker can inject arbitrary SQL to read, modify, or delete arbitrary records in the backing database (e.g. rooms.php?ID=1 OR 1=1 deletes all room records). Note: queries run via the legacy mysql_* extension, which does not permit stacked statements."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-18T10:21:47.135Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "name": "Vulnerable sink: rooms.php DELETE WHERE ID = $_GET[\u0027ID\u0027]",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/claudiopizzillo/PIAF-HMS/blob/389d2633441b65ced1c104212cd62be2bfca21e5/rooms.php#L16"
        },
        {
          "name": "Vulnerable sink: ec.php WHERE with $_GET parameters",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/claudiopizzillo/PIAF-HMS/blob/389d2633441b65ced1c104212cd62be2bfca21e5/ec.php#L57"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/claudiopizzillo/PIAF-HMS"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "PIAF-HMS multiple unauthenticated SQL injection vulnerabilities via mysql_query"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-54419",
    "datePublished": "2026-06-18T10:21:47.135Z",
    "dateReserved": "2026-06-13T16:39:46.122Z",
    "dateUpdated": "2026-06-18T12:05:05.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}