Critical improper access control vulnerability in Mist Community Edition's API Token Handler (create_token function) that allows unauthenticated remote attackers to manipulate token generation. Affected versions up to 4.7.1 are vulnerable; the vulnerability has been publicly disclosed with exploitation techniques available, and upgrading to version 4.7.2 provides the necessary fix. The CVSS 7.3 score reflects medium-to-high severity with potential for confidentiality, integrity, and availability impact.
Critical SQL injection vulnerability in chaitak-gorai Blogbook affecting the GET parameter handler in /admin/includes/edit_post.php, specifically the 'edit_post_id' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data exfiltration, modification, or denial of service. The vulnerability has been publicly disclosed with exploit code available, and the vendor has not responded to early disclosure notifications.
Critical SQL injection vulnerability in Blogbook's /post.php file affecting the GET parameter 'p_id', allowing unauthenticated remote attackers to execute arbitrary SQL queries and compromise database confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploitation proof-of-concept code available, though the vendor has not responded to early disclosure notifications. The affected product uses rolling releases, making version tracking difficult, but the vulnerability is confirmed present up to commit 92f5cf90f8a7e6566b576fe0952e14e1c6736513.
Critical SQL injection vulnerability in the Blogbook application affecting the /user.php file's GET parameter handler, specifically the 'u_id' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data exfiltration, modification, or deletion. The vulnerability has been publicly disclosed with exploitation details available, and the vendor has not responded to early disclosure attempts, leaving users without an official patch.