hieuPenguinnn

FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php

DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials

PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription

eladmin through 2.7 Broken Access Control via /api/users Update and Delete

Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API

BillionMail through 4.9 Forgeable JWTs via Default Signing Key

CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift

Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints

Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints

pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}