hieuPenguinnn

Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints

OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery

Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contents

EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key

Artalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch

SonicJS through 3.0.0 Missing Authorization in Content Write API

Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create

Blossom through 1.17.1 Authorization Bypass via Folder Endpoints

CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList

HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion