hieuPenguinnn

Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment

BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint

Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint

NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint

DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret

WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint

EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys

Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints

REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint

ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases