Search
Find a vulnerability
Search criteria
4 vulnerabilities by Chaitin
CVE-2026-120428 (GCVE-0-2026-120428)
Vulnerability from nvd – Published: 2026-11-02 14:28 – Updated: 2026-11-02 17:34
VLAI
EPSS
VEX
Title
PandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass
Summary
PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:15 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/chaitin/PandaWiki/issues/1845 | issue-tracking |
| https://vul.yulun.ac.cn/20261101/pandawiki/ | exploit |
| https://github.com/chaitin/PandaWiki/blob/v3.87.5… | technical-description |
| https://github.com/chaitin/PandaWiki/blob/v3.87.5… | technical-description |
| https://github.com/chaitin/PandaWiki/blob/v3.87.5… | technical-description |
| https://www.vulncheck.com/advisories/pandawiki-3.… | third-party-advisory |
Impacted products
Date Public
2026-11-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120428",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:15:22.970624Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:34:57.661Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PandaWiki",
"repo": "https://github.com/chaitin/PandaWiki",
"vendor": "Chaitin",
"versions": [
{
"lessThanOrEqual": "3.87.5",
"status": "affected",
"version": "3.65.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wu Yulun"
}
],
"datePublic": "2026-11-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/\u003ckey\u003e?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:28:53.641Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/chaitin/PandaWiki/issues/1845"
},
{
"tags": [
"exploit"
],
"url": "https://vul.yulun.ac.cn/20261101/pandawiki/"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/chaitin/PandaWiki/blob/v3.87.5/web/admin/server.conf"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/chaitin/PandaWiki/blob/v3.87.5/backend/usecase/file.go"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/chaitin/PandaWiki/blob/v3.87.5/backend/handler/share/common.go"
},
{
"name": "VulnCheck Advisory: PandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pandawiki-3.65.0-through-3.87.5-stored-xss-via-static-file-pdf-query-string-bypass"
}
],
"title": "PandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120428",
"datePublished": "2026-11-02T14:28:53.641Z",
"dateReserved": "2026-11-02T12:42:11.162Z",
"dateUpdated": "2026-11-02T17:34:57.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92749 (GCVE-0-2026-92749)
Vulnerability from nvd – Published: 2026-09-16 20:32 – Updated: 2026-09-17 14:00
VLAI
EPSS
VEX
Title
SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret
Summary
SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator session cookies to gain control of protected sites.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 13:58 UTC
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/chaitin/SafeLine/issues/1298 | issue-tracking |
| https://github.com/chaitin/SafeLine | product |
| https://github.com/chaitin/SafeLine/blob/v9.4.1/m… | technical-description |
| https://github.com/chaitin/SafeLine/blob/v9.4.1/m… | technical-description |
| https://www.vulncheck.com/advisories/safeline-thr… | third-party-advisory |
Date Public
2026-06-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92749",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T13:58:47.888786Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:00:56.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/chaitin/SafeLine/issues/1298"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SafeLine",
"vendor": "chaitin",
"versions": [
{
"lessThanOrEqual": "9.4.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator session cookies to gain control of protected sites."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:22.721Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1298",
"tags": [
"issue-tracking"
],
"url": "https://github.com/chaitin/SafeLine/issues/1298"
},
{
"tags": [
"product"
],
"url": "https://github.com/chaitin/SafeLine"
},
{
"name": "RandStr seeds math/rand with time.Now().UnixNano()",
"tags": [
"technical-description"
],
"url": "https://github.com/chaitin/SafeLine/blob/v9.4.1/management/webserver/utils/random.go#L10-L17"
},
{
"name": "session signing key stored as utils.RandStr(32)",
"tags": [
"technical-description"
],
"url": "https://github.com/chaitin/SafeLine/blob/v9.4.1/management/webserver/model/option.go#L27"
},
{
"name": "VulnCheck Advisory: SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/safeline-through-9.4.1-authentication-bypass-via-weak-session-secret"
}
],
"title": "SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92749",
"datePublished": "2026-09-16T20:32:22.721Z",
"dateReserved": "2026-09-16T18:57:07.414Z",
"dateUpdated": "2026-09-17T14:00:56.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120428 (GCVE-0-2026-120428)
Vulnerability from cvelistv5 – Published: 2026-11-02 14:28 – Updated: 2026-11-02 17:34
VLAI
EPSS
VEX
Title
PandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass
Summary
PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:15 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/chaitin/PandaWiki/issues/1845 | issue-tracking |
| https://vul.yulun.ac.cn/20261101/pandawiki/ | exploit |
| https://github.com/chaitin/PandaWiki/blob/v3.87.5… | technical-description |
| https://github.com/chaitin/PandaWiki/blob/v3.87.5… | technical-description |
| https://github.com/chaitin/PandaWiki/blob/v3.87.5… | technical-description |
| https://www.vulncheck.com/advisories/pandawiki-3.… | third-party-advisory |
Impacted products
Date Public
2026-11-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120428",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:15:22.970624Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:34:57.661Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PandaWiki",
"repo": "https://github.com/chaitin/PandaWiki",
"vendor": "Chaitin",
"versions": [
{
"lessThanOrEqual": "3.87.5",
"status": "affected",
"version": "3.65.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wu Yulun"
}
],
"datePublic": "2026-11-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/\u003ckey\u003e?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:28:53.641Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/chaitin/PandaWiki/issues/1845"
},
{
"tags": [
"exploit"
],
"url": "https://vul.yulun.ac.cn/20261101/pandawiki/"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/chaitin/PandaWiki/blob/v3.87.5/web/admin/server.conf"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/chaitin/PandaWiki/blob/v3.87.5/backend/usecase/file.go"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/chaitin/PandaWiki/blob/v3.87.5/backend/handler/share/common.go"
},
{
"name": "VulnCheck Advisory: PandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pandawiki-3.65.0-through-3.87.5-stored-xss-via-static-file-pdf-query-string-bypass"
}
],
"title": "PandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120428",
"datePublished": "2026-11-02T14:28:53.641Z",
"dateReserved": "2026-11-02T12:42:11.162Z",
"dateUpdated": "2026-11-02T17:34:57.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92749 (GCVE-0-2026-92749)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-17 14:00
VLAI
EPSS
VEX
Title
SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret
Summary
SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator session cookies to gain control of protected sites.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 13:58 UTC
CWE
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/chaitin/SafeLine/issues/1298 | issue-tracking |
| https://github.com/chaitin/SafeLine | product |
| https://github.com/chaitin/SafeLine/blob/v9.4.1/m… | technical-description |
| https://github.com/chaitin/SafeLine/blob/v9.4.1/m… | technical-description |
| https://www.vulncheck.com/advisories/safeline-thr… | third-party-advisory |
Date Public
2026-06-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92749",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T13:58:47.888786Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:00:56.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/chaitin/SafeLine/issues/1298"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SafeLine",
"vendor": "chaitin",
"versions": [
{
"lessThanOrEqual": "9.4.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator session cookies to gain control of protected sites."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-338",
"description": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:22.721Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1298",
"tags": [
"issue-tracking"
],
"url": "https://github.com/chaitin/SafeLine/issues/1298"
},
{
"tags": [
"product"
],
"url": "https://github.com/chaitin/SafeLine"
},
{
"name": "RandStr seeds math/rand with time.Now().UnixNano()",
"tags": [
"technical-description"
],
"url": "https://github.com/chaitin/SafeLine/blob/v9.4.1/management/webserver/utils/random.go#L10-L17"
},
{
"name": "session signing key stored as utils.RandStr(32)",
"tags": [
"technical-description"
],
"url": "https://github.com/chaitin/SafeLine/blob/v9.4.1/management/webserver/model/option.go#L27"
},
{
"name": "VulnCheck Advisory: SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/safeline-through-9.4.1-authentication-bypass-via-weak-session-secret"
}
],
"title": "SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92749",
"datePublished": "2026-09-16T20:32:22.721Z",
"dateReserved": "2026-09-16T18:57:07.414Z",
"dateUpdated": "2026-09-17T14:00:56.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}