Wu Yulun

Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account.

An authentication bypass exists in the `ns-admin` component. Unauthenticated remote attackers can forge administrator tokens by utilizing a hardcoded JWT signing key to sign an `X-Access-Token` using the HS256 algorithm. By including the public super administrator role ID, an attacker can obtain full access to user management, scan tasks, and stored results.

NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.

A stored cross-site scripting issue exists where registered users can inject scripts by placing double quotes in language- class tokens within `markdown-it-xss.ts`. An attacker can store a malicious payload in their profile bio, which executes when administrators or other users view the profile. This can lead to the theft of the non-httpOnly `sid` session cookie, enabling session hijacking.

Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and delete the victim account.

NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints.

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executing script in an administrator's browser when an admin search matches the document.

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.

An authentication bypass exists that allows unauthenticated attackers to set a custom SMS login verification code. By providing a specific value to the `Code` field at the '/admin/sms/send' endpoint, an attacker who knows a user's mobile number can define the verification code and subsequently use it at the '/admin/site/mobileLogin' endpoint to take over accounts, including those with administrator privileges.

DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.

PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda wiki token JWT for session takeover.