skeletonsec
vulnerability research · exploit development · reverse engineering
Independent vulnerability research — CVEs, advisories, and writeups with proof.
cve & advisories
- CVE-2026-105833 EspoCRM — IDOR in PersonalAccountService exposes other users' IMAP passwords nvd
- CVE-2026-104438 YesWiki — tags/listpagestag and includepages disclose ACL-protected page names/titles (unauth enum) nvd
- CVE-2026-104439 YesWiki — lost-password endpoint enables email enumeration via differing responses (no rate limit) nvd
- CVE-2026-104440 YesWiki — blind SSRF via /api/entries/bazarlist idtypeannonce (isValidURL() always true) nvd
- CVE-2026-104441 YesWiki — unauth SSRF via {{valeur}} through render.php content param with response read-back nvd
- CVE-2026-104442 YesWiki — unauth SSRF via {{syndication}} action; response read-back and enclosure downloads nvd
- CVE-2026-100711 Froxlor — sessions/API keys/2FA trust not invalidated on password change (persistence) nvd
- CVE-2026-100712 Froxlor — 2FA disabled by GET without CSRF or confirmation (link click) nvd
- CVE-2026-100713 Froxlor — TOCTOU race in SSH-key sync cron enables root authorized_keys write via symlink nvd
- CVE-2026-100714 Froxlor — command injection via letsencryptchallengepath into acme.sh (root cron) nvd
- CVE-2026-100715 Froxlor — arbitrary recursive delete via symlink following in deleteFtpData cron nvd
- CVE-2026-100716 Froxlor — export cron path walk bug allows cross-tenant chown -R and privilege effects nvd
- CVE-2026-86197 Grav — stored XSS via the Twig sandbox assets allowlist; editor→super-admin (fixed 2.0.20) nvd · vulncheck · ghsa
- CVE-2026-85586 phpMyFAQ — CAPTCHA bypass via store=now enables unauth automated question flood nvd · vulncheck
- CVE-2026-85587 phpMyFAQ — incorrect authorization on admin content pages discloses drafts/inactive nvd · vulncheck
- CVE-2026-85588 phpMyFAQ — TOTP shared secrets exposed in user data export ZIPs (2FA bypass) nvd · vulncheck
- CVE-2026-85589 phpMyFAQ — missing authorization on dashboard API endpoints (searches, content-health) nvd · vulncheck
- CVE-2026-85590 phpMyFAQ — two-factor authentication can be disabled without password/TOTP recheck nvd · vulncheck
- CVE-2026-85591 phpMyFAQ — password change without current-password verification (ATO) nvd · vulncheck
- CVE-2026-84481 WWBN AVideo — unauth getConfiguration.json.php leaks TLS key paths, socket config, debug flags nvd · vulncheck
- CVE-2026-82238 File Browser — TUS PATCH concurrency bypasses Upload-Length validation (race) nvd · vulncheck
- CVE-2026-82237 File Browser — share links survive file rename and later serve unrelated content nvd · vulncheck
- CVE-2026-82236 File Browser — public share links not cleaned up on privileged delete (exposes replacement) nvd · vulncheck
- CVE-2026-82235 File Browser — named pipes in archive/public downloads pin goroutines (DoS) nvd · vulncheck
- CVE-2026-81733 WWBN AVideo — CSRF in Live myLiveControls.save.json.php modifies redirect settings nvd · vulncheck
- CVE-2026-81732 WWBN AVideo — report4.json.php endpoints lack auth; expose registration stats nvd · vulncheck
ghsa & vendor advisories
- GHSA-fr26-jjhm-638c pyLoad — tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
- GHSA-xrc5-9pjf-8282 rhwp — embedded font face can inject executable SVG into same-origin print surfaces
- GHSA-xh42-494x-2xgv Craft CMS — verification code remains valid for set-password after verify-email
- BOOKSTACK-26.05.4 BookStack v26.05.4 — security fixes included
- GHSA-fwqx-cc24-3j43 Leantime — low-privilege user can take over owner via unguarded JSON-RPC onboarding methods
- GHSA-wv7c-q6q8-8rpw Kimai — prepared links could change favorites and dashboard layout
- KENTICO-2026-09-24 Kentico — Security Advisory 2026-09-24
- GHSA-jwh5-j4f4-c6xp YesWiki — unauthenticated SSRF with response read-back via the {{syndication}} action
- GHSA-8hgv-xc77-jmcr Grav — page editors can inject JS via Twig sandbox assets.addJs/addCss allowlist (editor → super-admin)
- GHSA-6w97-49h8-58wh phpMyFAQ — incorrect permission checks on admin content pages disclose draft/inactive content
- GHSA-6r2c-694w-24qv phpMyFAQ — unverified password change in user control panel API (no current-password verification)
- GHSA-xhgx-2wj8-g4pj phpMyFAQ — live TOTP secret included in user data export ZIP
- GHSA-gpwm-82cg-4wfw phpMyFAQ — missing authorization on admin dashboard API endpoints (searches, content-health)
latest
- Grav stored XSS via assets sandbox allowlist (editor→super-admin) research CVE-2026-86197
- phpMyFAQ: session-only auth downgrade, password change without verification, and TOTP secret in data export research
- File Browser: stale shares, share cleanup, named-pipe DoS, and TUS race research
- CVE-2026-105833 cve