hieuPenguinnn

Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata

Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API

DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization

PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update

Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend

HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController

Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id

ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc

Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check

Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path