Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

CVE-2026-52822

### Summary Kimai 2.56.0 contains an authenticated authorization bypass in the timesheet `restart` and `duplicate` work

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

CVE-2026-52821

### Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the preset-project activity

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

CVE-2026-52820

## Summary The Timesheet API `PATCH /api/timesheets/{id}` and `POST /api/timesheets` endpoints accept a user-supplied `

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target

CVE-2026-52819

## Summary `GET /api/timesheets?user=` (and `users[]=`) returns the targeted user's timesheet records to any caller tha

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

CVE-2026-49992

### Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcut

历史摘要 · 未重新核验 · GitHub Advisory

FacturaScripts: Account takeover of any 2FA-enabled user

CVE-2026-47677

# Authentication bypass in FacturaScripts: `/login?action=two-factor-validation` accepts brute-forceable TOTP without pa

历史摘要 · 未重新核验 · GitHub Advisory

NukeViet: Pre-authentication SSRF via X-Forwarded-Host

CVE-2026-55372

## Summary An unauthenticated attacker can coerce the server into issuing HTTP requests to an attacker-chosen host by s

历史摘要 · 未重新核验 · GitHub Advisory

NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function

CVE-2026-54065

## Summary Path Traversal to Arbitrary File Deletion in the Edit Comment admin function. An authenticated administrator

历史摘要 · 未重新核验 · GitHub Advisory

NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module

CVE-2026-54064

## Summary Two filter-bypass techniques in `NukeViet\Core\Request::filterAttr()` and `NukeViet\Core\Request::unhtmlenti

历史摘要 · 未重新核验 · GitHub Advisory

NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-49259

## Summary A stored cross-site scripting (XSS) vulnerability exists in NukeViet CMS versions 4.x through 4.5.08. A low-

历史摘要 · 未重新核验 · GitHub Advisory

NukeViet: Unauthenticated Reflected XSS in Comment Module

CVE-2026-48118

## Summary Reflected XSS in the Comment module via the `status_comment` URL parameter. The parameter accepts attacker-c

历史摘要 · 未重新核验 · GitHub Advisory

prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

CVE-2026-54159

### Impact A PHP Object Injection vulnerability affects the PrestaShop module `ps_facetedsearch`. The module rebuilds

历史摘要 · 未重新核验 · GitHub Advisory

NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)

#### Summary An authenticated user with the HR "Manage Employees" permission (`SA_EMPLOYEE`) can upload a file with an a

历史摘要 · 未重新核验 · GitHub Advisory

Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

CVE-2026-49865

### Summary Kimai 2.56.0 contains a server-side request forgery vulnerability in its invoice PDF preview and generation

历史摘要 · 未重新核验 · GitHub Advisory

Sylius: IDOR on Shop Payment Request API endpoints

CVE-2026-53639

### Impact The `GET /api/v2/shop/payment-requests/{hash}` and `PUT /api/v2/shop/payment-requests/{hash}` endpoints look

历史摘要 · 未重新核验 · GitHub Advisory

Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

CVE-2026-53638

### Impact An authorization bypass vulnerability exists in the shop account API. The `PATCH /api/v2/shop/account/orders/

历史摘要 · 未重新核验 · GitHub Advisory

Sylius: Cart FormComponent allows modification or deletion of an already-completed order

CVE-2026-53637

### Impact A user opens the cart page in the browser. In the background, the order gets completed, e.g. an admin changes

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service

CVE-2026-52778

### Summary An unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize

CVE-2026-52777

## Details ### Sink `tools/bazar/services/CSVManager.php` line 372-399: ``` public function importEntry(array $import

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki has Authenticated SQL Injection via ReactionManager

CVE-2026-52775

## Summary YesWiki through the latest development branch contains a SQL injection vulnerability in `ReactionManager::de

历史摘要 · 未重新核验 · GitHub Advisory