Search
Find a vulnerability
Search criteria
8333 vulnerabilities
CVE-2026-107831 (GCVE-0-2026-107831)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:51 – Updated: 2026-10-08 21:51
VLAI
EPSS
VEX
Title
Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions
Summary
Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll, /account/protected/sub/delSub, or /message/updateAction to delete private messages and subscriptions or rename threads.
Severity
4.3 (Medium)
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/banq/jivejdon/issues/28 | issue-tracking |
| https://github.com/banq/jivejdon | product |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://www.vulncheck.com/advisories/jivejdon-thr… | third-party-advisory |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jivejdon",
"repo": "https://github.com/banq/jivejdon",
"vendor": "banq",
"versions": [
{
"lessThanOrEqual": "5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll, /account/protected/sub/delSub, or /message/updateAction to delete private messages and subscriptions or rename threads."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:51:34.780Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #28",
"tags": [
"issue-tracking"
],
"url": "https://github.com/banq/jivejdon/issues/28"
},
{
"tags": [
"product"
],
"url": "https://github.com/banq/jivejdon"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/WEB-INF/struts-config-shortmessage.xml#L112-L118"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/WEB-INF/struts-config-subscription.xml#L75-L79"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/message/UpdateThreadNameAction.java#L19-L36"
},
{
"name": "VulnCheck Advisory: Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jivejdon-through-5.0-csrf-via-get-based-account-and-thread-actions"
}
],
"title": "Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107831",
"datePublished": "2026-10-08T21:51:34.780Z",
"dateReserved": "2026-10-08T21:43:59.391Z",
"dateUpdated": "2026-10-08T21:51:34.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107830 (GCVE-0-2026-107830)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:51 – Updated: 2026-10-08 21:51
VLAI
EPSS
VEX
Title
Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint
Summary
Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator's Tencent Cloud SMS balance.
Severity
5.3 (Medium)
CWE
- CWE-799 - Improper Control of Interaction Frequency
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/banq/jivejdon/issues/28 | issue-tracking |
| https://github.com/banq/jivejdon | product |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://www.vulncheck.com/advisories/jivejdon-thr… | third-party-advisory |
Impacted products
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jivejdon",
"repo": "https://github.com/banq/jivejdon",
"vendor": "banq",
"versions": [
{
"lessThanOrEqual": "ee67a65e65228644a71c8317d7e34deea50f95ef",
"status": "affected",
"version": "e03060885db5726e46d30f55ac67920318d0d1fc",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator\u0027s Tencent Cloud SMS balance."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-799",
"description": "Improper Control of Interaction Frequency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:51:34.140Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #28",
"tags": [
"issue-tracking"
],
"url": "https://github.com/banq/jivejdon/issues/28"
},
{
"tags": [
"product"
],
"url": "https://github.com/banq/jivejdon"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/account/SmsQQAction.java#L23-L79"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/account/newAccount.jsp#L24-L29"
},
{
"name": "VulnCheck Advisory: Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-missing-rate-limiting-via-account-smsvraction-sms-endpoint"
}
],
"title": "Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107830",
"datePublished": "2026-10-08T21:51:34.140Z",
"dateReserved": "2026-10-08T21:43:59.057Z",
"dateUpdated": "2026-10-08T21:51:34.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107829 (GCVE-0-2026-107829)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:51 – Updated: 2026-10-08 21:51
VLAI
EPSS
VEX
Title
Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql
Summary
Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks.
Severity
CWE
- CWE-916 - Use of Password Hash With Insufficient Computational Effort
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/banq/jivejdon/issues/28 | issue-tracking |
| https://github.com/banq/jivejdon | product |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://www.vulncheck.com/advisories/jivejdon-thr… | third-party-advisory |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jivejdon",
"repo": "https://github.com/banq/jivejdon",
"vendor": "banq",
"versions": [
{
"lessThanOrEqual": "5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-916",
"description": "Use of Password Hash With Insufficient Computational Effort",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:51:33.503Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #28",
"tags": [
"issue-tracking"
],
"url": "https://github.com/banq/jivejdon/issues/28"
},
{
"tags": [
"product"
],
"url": "https://github.com/banq/jivejdon"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/util/ToolsUtil.java#L198-L211"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/auth/jaas/JiveJdonLoginMoudle.java#L86"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/infrastructure/repository/dao/sql/AccountDaoSql.java#L181"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/infrastructure/repository/dao/sql/AccountDaoSql.java#L253"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/auth/jaas/DigestUtil.java#L30-L44"
},
{
"name": "VulnCheck Advisory: Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jivejdon-through-5.0-unsalted-md5-password-storage-via-accountdaosql"
}
],
"title": "Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107829",
"datePublished": "2026-10-08T21:51:33.503Z",
"dateReserved": "2026-10-08T21:43:58.592Z",
"dateUpdated": "2026-10-08T21:51:33.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107828 (GCVE-0-2026-107828)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:51 – Updated: 2026-10-08 21:51
VLAI
EPSS
VEX
Title
Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login
Summary
Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from public Weibo user IDs. OAuthAccountServiceImp.transferSina() sets the password to the first four digits of the Weibo ID, letting attackers log in through normal form login to read or post as victims.
Severity
6.5 (Medium)
CWE
- CWE-1391 - Use of Weak Credentials
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/banq/jivejdon/issues/28 | issue-tracking |
| https://github.com/banq/jivejdon | product |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://www.vulncheck.com/advisories/jivejdon-thr… | third-party-advisory |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jivejdon",
"repo": "https://github.com/banq/jivejdon",
"vendor": "banq",
"versions": [
{
"lessThanOrEqual": "5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from public Weibo user IDs. OAuthAccountServiceImp.transferSina() sets the password to the first four digits of the Weibo ID, letting attackers log in through normal form login to read or post as victims."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1391",
"description": "Use of Weak Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:51:32.815Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #28",
"tags": [
"issue-tracking"
],
"url": "https://github.com/banq/jivejdon/issues/28"
},
{
"tags": [
"product"
],
"url": "https://github.com/banq/jivejdon"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/api/impl/account/OAuthAccountServiceImp.java#L192-L213"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/account/oauth/SinaUserCallBackAction.java#L76-L80"
},
{
"name": "VulnCheck Advisory: Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jivejdon-through-5.0-predictable-passwords-via-sina-weibo-oauth-login"
}
],
"title": "Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107828",
"datePublished": "2026-10-08T21:51:32.815Z",
"dateReserved": "2026-10-08T21:43:58.211Z",
"dateUpdated": "2026-10-08T21:51:32.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107801 (GCVE-0-2026-107801)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:51 – Updated: 2026-10-08 21:51
VLAI
EPSS
VEX
Title
Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type
Summary
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share its link to run JavaScript on the application's origin for viewing users.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/banq/jivejdon/issues/28 | issue-tracking |
| https://github.com/banq/jivejdon | product |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://www.vulncheck.com/advisories/jivejdon-thr… | third-party-advisory |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jivejdon",
"repo": "https://github.com/banq/jivejdon",
"vendor": "banq",
"versions": [
{
"lessThanOrEqual": "5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share its link to run JavaScript on the application\u0027s origin for viewing users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:51:31.992Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #28",
"tags": [
"issue-tracking"
],
"url": "https://github.com/banq/jivejdon/issues/28"
},
{
"tags": [
"product"
],
"url": "https://github.com/banq/jivejdon"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/UploadShowAction.java#L135-L142"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/domain/model/message/upload/UploadHelper.java#L84-L91"
},
{
"name": "VulnCheck Advisory: Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jivejdon-through-5.0-stored-xss-via-attachment-upload-content-type"
}
],
"title": "Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107801",
"datePublished": "2026-10-08T21:51:31.992Z",
"dateReserved": "2026-10-08T21:21:00.520Z",
"dateUpdated": "2026-10-08T21:51:31.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107800 (GCVE-0-2026-107800)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:51 – Updated: 2026-10-08 21:51
VLAI
EPSS
VEX
Title
Jivejdon through 5.0 Stored XSS via Private Short Messages
Summary
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which ToolsUtil.convertURL() passes through unchanged, to execute code in the recipient's browser when opened.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/banq/jivejdon/issues/28 | issue-tracking |
| https://github.com/banq/jivejdon | product |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://www.vulncheck.com/advisories/jivejdon-thr… | third-party-advisory |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jivejdon",
"repo": "https://github.com/banq/jivejdon",
"vendor": "banq",
"versions": [
{
"lessThanOrEqual": "5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which ToolsUtil.convertURL() passes through unchanged, to execute code in the recipient\u0027s browser when opened."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:51:31.452Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #28",
"tags": [
"issue-tracking"
],
"url": "https://github.com/banq/jivejdon/issues/28"
},
{
"tags": [
"product"
],
"url": "https://github.com/banq/jivejdon"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/form/ShortMessageForm.java#L89-L91"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/shortmessage/receiveshortmessage.jsp#L63"
},
{
"name": "VulnCheck Advisory: Jivejdon through 5.0 Stored XSS via Private Short Messages",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jivejdon-through-5.0-stored-xss-via-private-short-messages"
}
],
"title": "Jivejdon through 5.0 Stored XSS via Private Short Messages",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107800",
"datePublished": "2026-10-08T21:51:31.452Z",
"dateReserved": "2026-10-08T21:21:00.147Z",
"dateUpdated": "2026-10-08T21:51:31.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107799 (GCVE-0-2026-107799)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:51 – Updated: 2026-10-08 21:51
VLAI
EPSS
VEX
Title
Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering
Summary
Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in the browser of every user viewing the thread.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/banq/jivejdon/issues/28 | issue-tracking |
| https://github.com/banq/jivejdon | product |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://www.vulncheck.com/advisories/jivejdon-thr… | third-party-advisory |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jivejdon",
"repo": "https://github.com/banq/jivejdon",
"vendor": "banq",
"versions": [
{
"lessThanOrEqual": "5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter=\"false\" and non-escaping default filters, executing script in the browser of every user viewing the thread."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:51:30.844Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #28",
"tags": [
"issue-tracking"
],
"url": "https://github.com/banq/jivejdon/issues/28"
},
{
"tags": [
"product"
],
"url": "https://github.com/banq/jivejdon"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/thread/messageListBody.jsp#L136-L138"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/domain/model/message/output/RenderingFilterManagerImp.java#L48-L49"
},
{
"name": "VulnCheck Advisory: Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jivejdon-through-5.0-stored-xss-via-messagelistbody-jsp-forum-message-rendering"
}
],
"title": "Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107799",
"datePublished": "2026-10-08T21:51:30.844Z",
"dateReserved": "2026-10-08T21:20:59.855Z",
"dateUpdated": "2026-10-08T21:51:30.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107798 (GCVE-0-2026-107798)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:51 – Updated: 2026-10-08 21:51
VLAI
EPSS
VEX
Title
Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter
Summary
jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to execute JavaScript when other users click or hover over rendered links.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/banq/jivejdon/issues/28 | issue-tracking |
| https://github.com/banq/jivejdon | product |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://www.vulncheck.com/advisories/jivejdon-thr… | third-party-advisory |
Impacted products
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jivejdon",
"repo": "https://github.com/banq/jivejdon",
"vendor": "banq",
"versions": [
{
"lessThanOrEqual": "ee67a65e65228644a71c8317d7e34deea50f95ef",
"status": "affected",
"version": "595d8d227fcdedf6f3b73540dd9f5d12dab399fe",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to execute JavaScript when other users click or hover over rendered links."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:51:30.273Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #28",
"tags": [
"issue-tracking"
],
"url": "https://github.com/banq/jivejdon/issues/28"
},
{
"tags": [
"product"
],
"url": "https://github.com/banq/jivejdon"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/domain/model/message/output/html/TextStyle.java#L242-L243"
},
{
"name": "VulnCheck Advisory: Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-stored-xss-via-markdown-links-in-textstyle-rendering-filter"
}
],
"title": "Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107798",
"datePublished": "2026-10-08T21:51:30.273Z",
"dateReserved": "2026-10-08T21:20:59.499Z",
"dateUpdated": "2026-10-08T21:51:30.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107797 (GCVE-0-2026-107797)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:51 – Updated: 2026-10-08 21:51
VLAI
EPSS
VEX
Title
Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters
Summary
Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string literals to execute arbitrary JavaScript in the victim's session.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/banq/jivejdon/issues/28 | issue-tracking |
| https://github.com/banq/jivejdon | product |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://www.vulncheck.com/advisories/jivejdon-thr… | third-party-advisory |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jivejdon",
"repo": "https://github.com/banq/jivejdon",
"vendor": "banq",
"versions": [
{
"lessThanOrEqual": "5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string literals to execute arbitrary JavaScript in the victim\u0027s session."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:51:29.704Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #28",
"tags": [
"issue-tracking"
],
"url": "https://github.com/banq/jivejdon/issues/28"
},
{
"tags": [
"product"
],
"url": "https://github.com/banq/jivejdon"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/message/postThread.jsp#L54-L72"
},
{
"name": "VulnCheck Advisory: Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jivejdon-through-5.0-reflected-xss-via-postthread-jsp-to-and-tag-parameters"
}
],
"title": "Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107797",
"datePublished": "2026-10-08T21:51:29.704Z",
"dateReserved": "2026-10-08T21:20:59.004Z",
"dateUpdated": "2026-10-08T21:51:29.704Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107796 (GCVE-0-2026-107796)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:51 – Updated: 2026-10-08 21:51
VLAI
EPSS
VEX
Title
Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters
Summary
Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allows unauthenticated attackers to inject script via unencoded tagID and count parameters. Attackers can craft a link with a script-closing payload in tagID or count, triggered when start exceeds zero, to execute JavaScript in victims' browsers.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/banq/jivejdon/issues/28 | issue-tracking |
| https://github.com/banq/jivejdon | product |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://www.vulncheck.com/advisories/jivejdon-thr… | third-party-advisory |
Impacted products
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jivejdon",
"repo": "https://github.com/banq/jivejdon",
"vendor": "banq",
"versions": [
{
"lessThanOrEqual": "ee67a65e65228644a71c8317d7e34deea50f95ef",
"status": "affected",
"version": "5489372d3c6ddee8c275da414c2c59655d8b7675",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allows unauthenticated attackers to inject script via unencoded tagID and count parameters. Attackers can craft a link with a script-closing payload in tagID or count, triggered when start exceeds zero, to execute JavaScript in victims\u0027 browsers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:51:29.216Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #28",
"tags": [
"issue-tracking"
],
"url": "https://github.com/banq/jivejdon/issues/28"
},
{
"tags": [
"product"
],
"url": "https://github.com/banq/jivejdon"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/query/taggedThreadList.jsp#L25-L41"
},
{
"name": "VulnCheck Advisory: Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-reflected-xss-via-taggedthreadlist-jsp-tagid-and-count-parameters"
}
],
"title": "Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107796",
"datePublished": "2026-10-08T21:51:29.216Z",
"dateReserved": "2026-10-08T21:20:58.723Z",
"dateUpdated": "2026-10-08T21:51:29.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107793 (GCVE-0-2026-107793)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:51 – Updated: 2026-10-08 21:51
VLAI
EPSS
VEX
Title
Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete
Summary
Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user's subscriptionId to remove their thread, forum, tag or account subscriptions.
Severity
4.3 (Medium)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/banq/jivejdon/issues/28 | issue-tracking |
| https://github.com/banq/jivejdon | product |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://www.vulncheck.com/advisories/jivejdon-thr… | third-party-advisory |
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jivejdon",
"repo": "https://github.com/banq/jivejdon",
"vendor": "banq",
"versions": [
{
"lessThanOrEqual": "5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users\u0027 subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user\u0027s subscriptionId to remove their thread, forum, tag or account subscriptions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:51:28.666Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #28",
"tags": [
"issue-tracking"
],
"url": "https://github.com/banq/jivejdon/issues/28"
},
{
"tags": [
"product"
],
"url": "https://github.com/banq/jivejdon"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/api/impl/subscription/SubscriptionServiceImp.java#L131-L146"
},
{
"name": "VulnCheck Advisory: Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jivejdon-through-5.0-idor-via-subsaveaction-subscription-delete"
}
],
"title": "Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107793",
"datePublished": "2026-10-08T21:51:28.666Z",
"dateReserved": "2026-10-08T20:54:09.564Z",
"dateUpdated": "2026-10-08T21:51:28.666Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107792 (GCVE-0-2026-107792)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:51 – Updated: 2026-10-08 21:51
VLAI
EPSS
VEX
Title
Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move
Summary
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any reply-less thread into an arbitrary forum.
Severity
4.3 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/banq/jivejdon/issues/28 | issue-tracking |
| https://github.com/banq/jivejdon | product |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://www.vulncheck.com/advisories/jivejdon-thr… | third-party-advisory |
Impacted products
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jivejdon",
"repo": "https://github.com/banq/jivejdon",
"vendor": "banq",
"versions": [
{
"lessThanOrEqual": "ee67a65e65228644a71c8317d7e34deea50f95ef",
"status": "affected",
"version": "d58a36b03676e70044b8fab5cb66d21eb83a023d",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users\u0027 threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any reply-less thread into an arbitrary forum."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:51:28.044Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #28",
"tags": [
"issue-tracking"
],
"url": "https://github.com/banq/jivejdon/issues/28"
},
{
"tags": [
"product"
],
"url": "https://github.com/banq/jivejdon"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/message/UpdateThreadToForumAction.java#L25-L62"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/WEB-INF/struts-config-message.xml#L136-L140"
},
{
"name": "VulnCheck Advisory: Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-missing-authorization-via-message-threadtoforum-save-thread-move"
}
],
"title": "Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107792",
"datePublished": "2026-10-08T21:51:28.044Z",
"dateReserved": "2026-10-08T20:54:05.620Z",
"dateUpdated": "2026-10-08T21:51:28.044Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71428 (GCVE-0-2025-71428)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:51 – Updated: 2026-10-08 21:51
VLAI
EPSS
VEX
Title
Jivejdon through 5.0 SQL Injection via username in userListAction
Summary
Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents, including other accounts' password hashes.
Severity
4.9 (Medium)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/banq/jivejdon/issues/28 | issue-tracking |
| https://github.com/banq/jivejdon | product |
| https://github.com/banq/jivejdon/issues/24 | issue-tracking |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://github.com/banq/jivejdon/blob/ee67a65e652… | technical-description |
| https://www.vulncheck.com/advisories/jivejdon-thr… | third-party-advisory |
Date Public
2025-07-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "jivejdon",
"repo": "https://github.com/banq/jivejdon",
"vendor": "banq",
"versions": [
{
"lessThanOrEqual": "5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "intSheep"
},
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2025-07-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents, including other accounts\u0027 password hashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:51:27.411Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #28",
"tags": [
"issue-tracking"
],
"url": "https://github.com/banq/jivejdon/issues/28"
},
{
"tags": [
"product"
],
"url": "https://github.com/banq/jivejdon"
},
{
"name": "GitHub Issue #24",
"tags": [
"issue-tracking"
],
"url": "https://github.com/banq/jivejdon/issues/24"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/infrastructure/repository/dao/sql/AccountDaoSql.java#L329-L335"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/admin/UserListAction.java#L13-L24"
},
{
"name": "VulnCheck Advisory: Jivejdon through 5.0 SQL Injection via username in userListAction",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jivejdon-through-5.0-sql-injection-via-username-in-userlistaction"
}
],
"title": "Jivejdon through 5.0 SQL Injection via username in userListAction",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71428",
"datePublished": "2026-10-08T21:51:27.411Z",
"dateReserved": "2026-10-08T20:54:10.092Z",
"dateUpdated": "2026-10-08T21:51:27.411Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11318 (GCVE-0-2026-11318)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:08 – Updated: 2026-10-08 21:08
VLAI
EPSS
VEX
Title
Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer
Summary
Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.
Severity
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Cr0wld3r/CVE-2026-11318 | technical-descriptionexploit |
| https://deskin.io/ | product |
| https://www.vulncheck.com/advisories/deskin-xpc-s… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zuler Technology | DeskIn |
Affected:
0 , ≤ 3.3.4.3
(custom)
|
Date Public
2026-09-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "DeskIn",
"vendor": "Zuler Technology",
"versions": [
{
"lessThanOrEqual": "3.3.4.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Long, Dang Hoang of SACOMBANK"
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:08:29.598Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/Cr0wld3r/CVE-2026-11318"
},
{
"name": "Product Page",
"tags": [
"product"
],
"url": "https://deskin.io/"
},
{
"name": "VulnCheck Advisory: Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/deskin-xpc-service-privilege-escalation-via-unauthenticated-installer"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-11318",
"datePublished": "2026-10-08T21:08:29.598Z",
"dateReserved": "2026-06-04T19:52:59.225Z",
"dateUpdated": "2026-10-08T21:08:29.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107782 (GCVE-0-2026-107782)
Vulnerability from cvelistv5 – Published: 2026-10-08 20:15 – Updated: 2026-10-08 20:15
VLAI
EPSS
VEX
Title
System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port
Summary
System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/winsiderss/systeminformer/comm… | patch |
| https://github.com/winsiderss/systeminformer/blob… | technical-description |
| https://github.com/winsiderss/systeminformer/rele… | release-notes |
| https://github.com/winsiderss/systeminformer | product |
| https://www.vulncheck.com/advisories/system-infor… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| winsiderss | System Informer |
Affected:
0 , < 4.0.26241.138
(custom)
Unaffected: 4.0.26241.138 (custom) |
Date Public
2026-08-28 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/winsiderss/systeminformer",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/winsiderss/systeminformer",
"product": "System Informer",
"repo": "https://github.com/winsiderss/systeminformer",
"vendor": "winsiderss",
"versions": [
{
"lessThan": "4.0.26241.138",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "4.0.26241.138",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhammad Ali"
}
],
"datePublic": "2026-08-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T20:15:56.603Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/winsiderss/systeminformer/commit/ce451a264a424f6f386b1615df651f8364aaeb9f"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/winsiderss/systeminformer/blob/v3.2.25011.2103/SystemInformer/phsvc/svcapiport.c#L196-L230"
},
{
"name": "System Informer v4.0.26241.138 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/winsiderss/systeminformer/releases/tag/v4.0.26241.138"
},
{
"tags": [
"product"
],
"url": "https://github.com/winsiderss/systeminformer"
},
{
"name": "VulnCheck Advisory: System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/system-informer-before-4.0.26241.138-incorrect-authorization-in-phsvc-alpc-port"
}
],
"title": "System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107782",
"datePublished": "2026-10-08T20:15:56.603Z",
"dateReserved": "2026-10-08T20:02:31.398Z",
"dateUpdated": "2026-10-08T20:15:56.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107781 (GCVE-0-2026-107781)
Vulnerability from cvelistv5 – Published: 2026-10-08 20:15 – Updated: 2026-10-08 20:15
VLAI
EPSS
VEX
Title
Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById
Summary
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.
Severity
7.4 (High)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/dromara/skyeye/issues/29 | issue-tracking |
| https://github.com/dromara/skyeye/blob/003549ae56… | technical-description |
| https://github.com/dromara/skyeye | product |
| https://www.vulncheck.com/advisories/dromara-skye… | third-party-advisory |
Impacted products
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/dromara/skyeye",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/dromara/skyeye",
"product": "skyeye",
"repo": "https://github.com/dromara/skyeye",
"vendor": "dromara",
"versions": [
{
"lessThanOrEqual": "003549ae5615bd114ba5bb8ddf6a8e8ead97c321",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user\u0027s stored file, then read results via queryFileToShowById."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T20:15:56.039Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #29",
"tags": [
"issue-tracking"
],
"url": "https://github.com/dromara/skyeye/issues/29"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/skyeye-adm/adm-pro/src/main/java/com/skyeye/eve/diskcloud/service/impl/FileConsoleServiceImpl.java#L533-L556"
},
{
"tags": [
"product"
],
"url": "https://github.com/dromara/skyeye"
},
{
"name": "VulnCheck Advisory: Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dromara-skyeye-unauthenticated-ssrf-and-file-overwrite-via-edituploadofficefilebyid"
}
],
"title": "Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107781",
"datePublished": "2026-10-08T20:15:56.039Z",
"dateReserved": "2026-10-08T20:02:31.075Z",
"dateUpdated": "2026-10-08T20:15:56.039Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107780 (GCVE-0-2026-107780)
Vulnerability from cvelistv5 – Published: 2026-10-08 20:15 – Updated: 2026-10-08 20:15
VLAI
EPSS
VEX
Title
Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter
Summary
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string and execute commands as the Skyeye service account on Windows.
Severity
9.8 (Critical)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/dromara/skyeye/issues/29 | issue-tracking |
| https://github.com/dromara/skyeye/blob/003549ae56… | technical-description |
| https://github.com/dromara/skyeye | product |
| https://www.vulncheck.com/advisories/dromara-skye… | third-party-advisory |
Impacted products
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/dromara/skyeye",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/dromara/skyeye",
"product": "skyeye",
"repo": "https://github.com/dromara/skyeye",
"vendor": "dromara",
"versions": [
{
"lessThanOrEqual": "003549ae5615bd114ba5bb8ddf6a8e8ead97c321",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string and execute commands as the Skyeye service account on Windows."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T20:15:55.304Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #29",
"tags": [
"issue-tracking"
],
"url": "https://github.com/dromara/skyeye/issues/29"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/skyeye-promote/skyeye-common/src/main/java/com/skyeye/common/service/impl/TtsServiceImpl.java#L105-L166"
},
{
"tags": [
"product"
],
"url": "https://github.com/dromara/skyeye"
},
{
"name": "VulnCheck Advisory: Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dromara-skyeye-unauthenticated-os-command-injection-via-texttospeech-format-parameter"
}
],
"title": "Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107780",
"datePublished": "2026-10-08T20:15:55.304Z",
"dateReserved": "2026-10-08T20:02:30.752Z",
"dateUpdated": "2026-10-08T20:15:55.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107779 (GCVE-0-2026-107779)
Vulnerability from cvelistv5 – Published: 2026-10-08 20:15 – Updated: 2026-10-08 20:15
VLAI
EPSS
VEX
Title
Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
Summary
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs.
Severity
9.8 (Critical)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/dromara/skyeye/issues/29 | issue-tracking |
| https://github.com/dromara/skyeye/blob/003549ae56… | technical-description |
| https://github.com/dromara/skyeye | product |
| https://www.vulncheck.com/advisories/dromara-skye… | third-party-advisory |
Impacted products
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/dromara/skyeye",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/dromara/skyeye",
"product": "skyeye",
"repo": "https://github.com/dromara/skyeye",
"vendor": "dromara",
"versions": [
{
"lessThanOrEqual": "003549ae5615bd114ba5bb8ddf6a8e8ead97c321",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ikram-4"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T20:15:54.720Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #29",
"tags": [
"issue-tracking"
],
"url": "https://github.com/dromara/skyeye/issues/29"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/xxl-job-2.3.0/xxl-job-admin/src/main/java/com/xxl/job/admin/controller/JobInfoController.java#L183-L231"
},
{
"tags": [
"product"
],
"url": "https://github.com/dromara/skyeye"
},
{
"name": "VulnCheck Advisory: Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dromara-skyeye-xxl-job-admin-missing-authentication-on-job-endpoints-allows-rce"
}
],
"title": "Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107779",
"datePublished": "2026-10-08T20:15:54.720Z",
"dateReserved": "2026-10-08T20:02:30.396Z",
"dateUpdated": "2026-10-08T20:15:54.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107778 (GCVE-0-2026-107778)
Vulnerability from cvelistv5 – Published: 2026-10-08 20:15 – Updated: 2026-10-08 20:15
VLAI
EPSS
VEX
Title
MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()
Summary
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.
Severity
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/krb5/krb5/pull/1511 | issue-trackingpatch |
| https://github.com/krb5/krb5/commit/48afa9abb89ab… | patch |
| https://github.com/krb5/krb5/commit/62196e2b26915… | patch |
| https://github.com/krb5/krb5/blob/krb5-1.22.2-fin… | technical-description |
| https://github.com/krb5/krb5 | product |
| https://www.vulncheck.com/advisories/mit-krb5-thr… | third-party-advisory |
Impacted products
Date Public
2026-05-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/krb5/krb5",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/krb5/krb5",
"product": "krb5",
"repo": "https://github.com/krb5/krb5",
"vendor": "MIT",
"versions": [
{
"lessThanOrEqual": "1.22.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.22.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani"
}
],
"datePublic": "2026-05-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T20:15:54.159Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #1511",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/krb5/krb5/pull/1511"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08"
},
{
"tags": [
"patch"
],
"url": "https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112"
},
{
"tags": [
"product"
],
"url": "https://github.com/krb5/krb5"
},
{
"name": "VulnCheck Advisory: MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"
}
],
"title": "MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107778",
"datePublished": "2026-10-08T20:15:54.159Z",
"dateReserved": "2026-10-08T20:02:23.913Z",
"dateUpdated": "2026-10-08T20:15:54.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107708 (GCVE-0-2026-107708)
Vulnerability from cvelistv5 – Published: 2026-10-08 20:15 – Updated: 2026-10-08 20:15
VLAI
EPSS
VEX
Title
MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC
Summary
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.
Severity
4.9 (Medium)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/krb5/krb5/pull/1510 | issue-trackingpatch |
| https://github.com/krb5/krb5/commit/f6e2c397ceda6… | patch |
| https://github.com/krb5/krb5/commit/a88a18cafa104… | patch |
| https://github.com/krb5/krb5/blob/krb5-1.22.2-fin… | technical-description |
| https://github.com/krb5/krb5 | product |
| https://www.vulncheck.com/advisories/mit-krb5-thr… | third-party-advisory |
Impacted products
Date Public
2026-05-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/krb5/krb5",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/krb5/krb5",
"product": "krb5",
"repo": "https://github.com/krb5/krb5",
"vendor": "MIT",
"versions": [
{
"lessThanOrEqual": "1.22.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.22.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tristan Madani"
}
],
"datePublic": "2026-05-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC\u0027s get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T20:15:53.534Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #1510",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/krb5/krb5/pull/1510"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7"
},
{
"tags": [
"patch"
],
"url": "https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676"
},
{
"tags": [
"product"
],
"url": "https://github.com/krb5/krb5"
},
{
"name": "VulnCheck Advisory: MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"
}
],
"title": "MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107708",
"datePublished": "2026-10-08T20:15:53.534Z",
"dateReserved": "2026-10-08T16:52:24.550Z",
"dateUpdated": "2026-10-08T20:15:53.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107707 (GCVE-0-2026-107707)
Vulnerability from cvelistv5 – Published: 2026-10-08 19:51 – Updated: 2026-10-08 19:51
VLAI
EPSS
VEX
Title
Intego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Junction
Summary
Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.
Severity
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://blog.quarkslab.com/milking-the-last-drop-… | technical-descriptionexploit |
| https://www.intego.com/ | product |
| https://www.vulncheck.com/advisories/intego-antiv… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Intego | Intego Antivirus |
Affected:
0 , ≤ 3.0.0.1
(custom)
|
Date Public
2026-04-07 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Intego Antivirus",
"vendor": "Intego",
"versions": [
{
"lessThanOrEqual": "3.0.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lucas Laise of Quarkslab"
}
],
"datePublic": "2026-04-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file\u0027s directory with a junction to C:\\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T19:51:14.469Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://blog.quarkslab.com/milking-the-last-drop-of-intego-time-for-windows-to-get-its-lpe.html"
},
{
"tags": [
"product"
],
"url": "https://www.intego.com/"
},
{
"name": "VulnCheck Advisory: Intego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Junction",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/intego-antivirus-through-3.0.0.1-local-privilege-escalation-via-optimization-module-junction"
}
],
"title": "Intego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Junction",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107707",
"datePublished": "2026-10-08T19:51:14.469Z",
"dateReserved": "2026-10-08T16:52:24.550Z",
"dateUpdated": "2026-10-08T19:51:14.469Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107706 (GCVE-0-2026-107706)
Vulnerability from cvelistv5 – Published: 2026-10-08 19:51 – Updated: 2026-10-08 20:14
VLAI
EPSS
VEX
Title
Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php
Summary
Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 20:14 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Dolibarr/dolibarr/commit/3420d… | patch |
| https://github.com/Dolibarr/dolibarr | product |
| https://github.com/Dolibarr/dolibarr/blob/24.0.1/… | technical-description |
| https://www.vulncheck.com/advisories/dolibarr-bef… | third-party-advisory |
Impacted products
Date Public
2026-09-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107706",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T20:14:18.241801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T20:14:30.910Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "dolibarr",
"vendor": "Dolibarr",
"versions": [
{
"lessThan": "24.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "24.0.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dolibarr:dolibarr_erp\\/crm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "24.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "dexx-tech"
}
],
"datePublic": "2026-09-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T19:51:13.651Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/commit/3420d17b199059ac22fca8b59f23cb8962fc8ef8"
},
{
"tags": [
"product"
],
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/core/ajax/updateextrafield.php#L80"
},
{
"name": "VulnCheck Advisory: Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dolibarr-before-24.0.2-incorrect-authorization-via-updateextrafield-php"
}
],
"title": "Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107706",
"datePublished": "2026-10-08T19:51:13.651Z",
"dateReserved": "2026-10-08T16:52:24.550Z",
"dateUpdated": "2026-10-08T20:14:30.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107705 (GCVE-0-2026-107705)
Vulnerability from cvelistv5 – Published: 2026-10-08 19:51 – Updated: 2026-10-08 19:51
VLAI
EPSS
VEX
Title
Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()
Summary
Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.
Severity
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gitlab.freedesktop.org/poppler/poppler/-/… | issue-tracking |
| https://gitlab.freedesktop.org/poppler/poppler/-/… | patch |
| https://gitlab.freedesktop.org/poppler/poppler/-/… | technical-description |
| https://gitlab.freedesktop.org/poppler/poppler | product |
| https://www.vulncheck.com/advisories/poppler-0.42… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| freedesktop | poppler |
Affected:
0.42.0 , ≤ 26.10.0
(semver)
cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:* |
Date Public
2026-10-05 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "poppler",
"vendor": "freedesktop",
"versions": [
{
"lessThanOrEqual": "26.10.0",
"status": "affected",
"version": "0.42.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:*",
"versionEndIncluding": "26.10.0",
"versionStartIncluding": "0.42.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aziz Elbelaychy (Ostorlab)"
}
],
"datePublic": "2026-10-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T19:51:12.884Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814"
},
{
"tags": [
"patch"
],
"url": "https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398"
},
{
"tags": [
"technical-description"
],
"url": "https://gitlab.freedesktop.org/poppler/poppler/-/blob/poppler-26.10.0/poppler/Decrypt.cc#L1767"
},
{
"tags": [
"product"
],
"url": "https://gitlab.freedesktop.org/poppler/poppler"
},
{
"name": "VulnCheck Advisory: Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/poppler-0.42.0-through-26.10.0-stack-buffer-overflow-via-decrypt-revision6hash"
}
],
"title": "Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107705",
"datePublished": "2026-10-08T19:51:12.884Z",
"dateReserved": "2026-10-08T16:52:24.550Z",
"dateUpdated": "2026-10-08T19:51:12.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104076 (GCVE-0-2026-104076)
Vulnerability from cvelistv5 – Published: 2026-10-08 19:26 – Updated: 2026-10-08 19:26
VLAI
EPSS
VEX
Title
TVU Networks Receiver/Transceiver Missing Authentication via REST API
Summary
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers can send unauthenticated GET requests to disclose network configuration, firmware details, and cloud service information, or issue POST requests to endpoints such as /Setting3/API/API/v1/LocalNetwork/DNS to alter DNS settings and enable man-in-the-middle attacks on outbound connections to TVU cloud infrastructure.
Severity
9.1 (Critical)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://code-white.com/public-vulnerability-list/… | third-party-advisory |
| https://www.vulncheck.com/advisories/tvu-networks… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TVU Networks | TVU Receiver / Transceiver |
Affected:
0 , < 7.9
(custom)
|
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TVU Receiver / Transceiver",
"vendor": "TVU Networks",
"versions": [
{
"lessThan": "7.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dr. Henning Kopp of CODE WHITE"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers can send unauthenticated GET requests to disclose network configuration, firmware details, and cloud service information, or issue POST requests to endpoints such as /Setting3/API/API/v1/LocalNetwork/DNS to alter DNS settings and enable man-in-the-middle attacks on outbound connections to TVU cloud infrastructure."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T19:26:34.263Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "CODE WHITE Vulnerability List",
"tags": [
"third-party-advisory"
],
"url": "https://code-white.com/public-vulnerability-list/#authentication-bypass-in-tvu-receiver-transceiver-web-management-interface"
},
{
"name": "VulnCheck Advisory: TVU Networks Receiver/Transceiver Missing Authentication via REST API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/tvu-networks-receiver-transceiver-missing-authentication-via-rest-api"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "TVU Networks Receiver/Transceiver Missing Authentication via REST API",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-104076",
"datePublished": "2026-10-08T19:26:34.263Z",
"dateReserved": "2026-10-01T18:02:50.083Z",
"dateUpdated": "2026-10-08T19:26:34.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104075 (GCVE-0-2026-104075)
Vulnerability from cvelistv5 – Published: 2026-10-08 19:24 – Updated: 2026-10-08 19:24
VLAI
EPSS
VEX
Title
TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login
Summary
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript validation, to receive a valid session cookie regardless of the password value and gain full administrative control of the device's web management interface.
Severity
9.8 (Critical)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://code-white.com/public-vulnerability-list/… | third-party-advisory |
| https://www.vulncheck.com/advisories/tvu-networks… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TVU Networks | TVU Receiver / Transceiver |
Affected:
0 , < 7.9
(custom)
|
Date Public
2026-10-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TVU Receiver / Transceiver",
"vendor": "TVU Networks",
"versions": [
{
"lessThan": "7.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dr. Henning Kopp of CODE WHITE"
}
],
"datePublic": "2026-10-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript validation, to receive a valid session cookie regardless of the password value and gain full administrative control of the device\u0027s web management interface."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T19:24:25.801Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "CODE WHITE Vulnerability List",
"tags": [
"third-party-advisory"
],
"url": "https://code-white.com/public-vulnerability-list/#authentication-bypass-in-tvu-receiver-transceiver-web-management-interface"
},
{
"name": "VulnCheck Advisory: TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/tvu-networks-receiver-transceiver-authentication-bypass-via-tvu-login"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-104075",
"datePublished": "2026-10-08T19:24:25.801Z",
"dateReserved": "2026-10-01T18:02:50.083Z",
"dateUpdated": "2026-10-08T19:24:25.801Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107704 (GCVE-0-2026-107704)
Vulnerability from cvelistv5 – Published: 2026-10-08 18:36 – Updated: 2026-10-08 18:36
VLAI
EPSS
VEX
Title
image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format
Summary
The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.
Severity
9.8 (Critical)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gist.github.com/R3tro16/a99a058d24a066927… | third-party-advisory |
| https://github.com/jtescher/image_optimizer/blob/… | technical-description |
| https://github.com/jtescher/image_optimizer/blob/… | technical-description |
| https://github.com/jtescher/image_optimizer | product |
| https://www.vulncheck.com/advisories/image-optimi… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jtescher | image_optimizer |
Affected:
1.3.0 , ≤ 1.9.0
(semver)
|
Date Public
2026-06-15 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://rubygems.org/gems/image_optimizer",
"defaultStatus": "unaffected",
"packageURL": "pkg:gem/image_optimizer",
"product": "image_optimizer",
"repo": "https://github.com/jtescher/image_optimizer",
"vendor": "jtescher",
"versions": [
{
"lessThanOrEqual": "1.9.0",
"status": "affected",
"version": "1.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "William Pierson (Retro16)"
}
],
"datePublic": "2026-06-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like \u0027;\u0027 that are executed via Ruby backticks with the Ruby process privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T18:36:37.394Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://gist.github.com/R3tro16/a99a058d24a06692721a6a3fade9649d"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer.rb#L37-L47"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jtescher/image_optimizer/blob/v1.9.0/lib/image_optimizer/shell.rb#L30-L32"
},
{
"tags": [
"product"
],
"url": "https://github.com/jtescher/image_optimizer"
},
{
"name": "VulnCheck Advisory: image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/image-optimizer-1.3.0-through-1.9.0-os-command-injection-via-identify-format"
}
],
"title": "image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107704",
"datePublished": "2026-10-08T18:36:37.394Z",
"dateReserved": "2026-10-08T16:52:24.549Z",
"dateUpdated": "2026-10-08T18:36:37.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107703 (GCVE-0-2026-107703)
Vulnerability from cvelistv5 – Published: 2026-10-08 18:36 – Updated: 2026-10-08 19:18
VLAI
EPSS
VEX
Title
@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo
Summary
@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 19:17 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://gist.github.com/R3tro16/5a508fcfddfb0dfe6… | third-party-advisory |
| https://github.com/enmaso/node-convert/blob/143e4… | technical-description |
| https://github.com/enmaso/node-convert | product |
| https://www.vulncheck.com/advisories/enmaso-node-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| enmaso | @enmaso/node-convert |
Affected:
0 , ≤ 1.0.0
(semver)
|
Date Public
2026-06-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107703",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T19:17:40.602109Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T19:18:07.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/R3tro16/5a508fcfddfb0dfe66a0a53437ede74c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/@enmaso/node-convert",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40enmaso/node-convert",
"product": "@enmaso/node-convert",
"repo": "https://github.com/enmaso/node-convert",
"vendor": "enmaso",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "William Pierson (Retro16)"
}
],
"datePublic": "2026-06-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T18:36:36.868Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://gist.github.com/R3tro16/5a508fcfddfb0dfe66a0a53437ede74c"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/enmaso/node-convert/blob/143e4d76244e2daac57eef59d8ed5983e33ee4fb/convert.js#L4-L15"
},
{
"tags": [
"product"
],
"url": "https://github.com/enmaso/node-convert"
},
{
"name": "VulnCheck Advisory: @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/enmaso-node-convert-through-1.0.0-os-command-injection-via-filepath-and-convertto"
}
],
"title": "@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107703",
"datePublished": "2026-10-08T18:36:36.868Z",
"dateReserved": "2026-10-08T16:52:24.549Z",
"dateUpdated": "2026-10-08T19:18:07.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107701 (GCVE-0-2026-107701)
Vulnerability from cvelistv5 – Published: 2026-10-08 18:36 – Updated: 2026-10-08 18:36
VLAI
EPSS
VEX
Title
dot-access through 1.0.0 Prototype Pollution via set() path argument
Summary
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.
Severity
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://gist.github.com/R3tro16/e094e4318a040f189… | third-party-advisory |
| https://github.com/ntharim/dot-access/issues/5 | issue-tracking |
| https://github.com/ntharim/dot-access/blob/v1.0.0… | technical-description |
| https://github.com/ntharim/dot-access | product |
| https://www.vulncheck.com/advisories/dot-access-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ntharim | dot-access |
Affected:
0 , ≤ 1.0.0
(semver)
|
Date Public
2026-03-05 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/dot-access",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/dot-access",
"product": "dot-access",
"repo": "https://github.com/ntharim/dot-access",
"vendor": "ntharim",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "William Pierson (Retro16)"
}
],
"datePublic": "2026-03-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T18:36:36.315Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://gist.github.com/R3tro16/e094e4318a040f189fd5d2d33e8c3ec2"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/ntharim/dot-access/issues/5"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ntharim/dot-access/blob/v1.0.0/index.js#L9-L18"
},
{
"tags": [
"product"
],
"url": "https://github.com/ntharim/dot-access"
},
{
"name": "VulnCheck Advisory: dot-access through 1.0.0 Prototype Pollution via set() path argument",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dot-access-through-1.0.0-prototype-pollution-via-set-path-argument"
}
],
"title": "dot-access through 1.0.0 Prototype Pollution via set() path argument",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107701",
"datePublished": "2026-10-08T18:36:36.315Z",
"dateReserved": "2026-10-08T16:52:24.549Z",
"dateUpdated": "2026-10-08T18:36:36.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107700 (GCVE-0-2026-107700)
Vulnerability from cvelistv5 – Published: 2026-10-08 18:36 – Updated: 2026-10-08 18:36
VLAI
EPSS
VEX
Title
dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument
Summary
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load child_process and run operating system commands in the Node.js process.
Severity
9.8 (Critical)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://gist.github.com/R3tro16/e094e4318a040f189… | third-party-advisory |
| https://github.com/ntharim/dot-access/blob/v1.0.0… | technical-description |
| https://github.com/ntharim/dot-access | product |
| https://www.vulncheck.com/advisories/dot-access-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ntharim | dot-access |
Affected:
0.0.3 , ≤ 1.0.0
(semver)
|
Date Public
2026-06-15 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/dot-access",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/dot-access",
"product": "dot-access",
"repo": "https://github.com/ntharim/dot-access",
"vendor": "ntharim",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0.0.3",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "William Pierson (Retro16)"
}
],
"datePublic": "2026-06-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load child_process and run operating system commands in the Node.js process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T18:36:35.684Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://gist.github.com/R3tro16/e094e4318a040f189fd5d2d33e8c3ec2"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/ntharim/dot-access/blob/v1.0.0/index.js#L1-L7"
},
{
"tags": [
"product"
],
"url": "https://github.com/ntharim/dot-access"
},
{
"name": "VulnCheck Advisory: dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dot-access-0.0.3-through-1.0.0-code-injection-via-get-path-argument"
}
],
"title": "dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107700",
"datePublished": "2026-10-08T18:36:35.684Z",
"dateReserved": "2026-10-08T16:52:24.549Z",
"dateUpdated": "2026-10-08T18:36:35.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107699 (GCVE-0-2026-107699)
Vulnerability from cvelistv5 – Published: 2026-10-08 18:36 – Updated: 2026-10-08 18:36
VLAI
EPSS
VEX
Title
ppt2png through 0.0.6 OS Command Injection via input and output paths
Summary
ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to child_process.exec() in ppt2png.js, running commands with Node.js process privileges.
Severity
9.8 (Critical)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://gist.github.com/R3tro16/2daadc08b282c48d4… | third-party-advisory |
| https://github.com/tzwm/ppt2png/blob/8c68eba7af94… | technical-description |
| https://github.com/tzwm/ppt2png | product |
| https://www.vulncheck.com/advisories/ppt2png-thro… | third-party-advisory |
Date Public
2026-06-15 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/ppt2png",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/ppt2png",
"product": "ppt2png",
"repo": "https://github.com/tzwm/ppt2png",
"vendor": "tzwm",
"versions": [
{
"lessThanOrEqual": "0.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "William Pierson (Retro16)"
}
],
"datePublic": "2026-06-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as \u0027;\u0027 to file names passed to child_process.exec() in ppt2png.js, running commands with Node.js process privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T18:36:35.066Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://gist.github.com/R3tro16/2daadc08b282c48d41203d1125d7632a"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/tzwm/ppt2png/blob/8c68eba7af943de27422b12c6e224d28587af7ae/ppt2png.js#L5-L35"
},
{
"tags": [
"product"
],
"url": "https://github.com/tzwm/ppt2png"
},
{
"name": "VulnCheck Advisory: ppt2png through 0.0.6 OS Command Injection via input and output paths",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ppt2png-through-0.0.6-os-command-injection-via-input-and-output-paths"
}
],
"title": "ppt2png through 0.0.6 OS Command Injection via input and output paths",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-107699",
"datePublished": "2026-10-08T18:36:35.066Z",
"dateReserved": "2026-10-08T16:52:24.549Z",
"dateUpdated": "2026-10-08T18:36:35.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}