Gofound
Monthly
Unauthenticated path traversal in GoFound through 1.4.1 allows remote attackers to delete arbitrary directories by supplying ../ sequences in the 'database' parameter of GET requests to /api/db/create and /api/db/drop, which reaches os.RemoveAll with an attacker-controlled path. The assigned CVSS 4.0 vector (7.2, High) rates it AV:N/AC:L/PR:N, so a network-reachable instance is directly attackable without credentials; because the endpoints accept GET, the same action can also be triggered from a victim's browser, which is what the UI:P metric captures. There is no KEV entry indicating active exploitation, and the available exploit reference is a public PoC write-up that has not been verified as working exploit code; no EPSS score was supplied, and the vuln.today decision label is 'this_week'.
Stored cross-site scripting in GoFound through 1.4.1 lets unauthenticated attackers plant HTML/script by submitting document text to the /api/index endpoint, with no credentials required (CVSS:4.0 PR:N). The payload stays inert in the index until an administrator runs a dashboard search that matches the poisoned document, at which point searcher/engine.go returns the stored content unescaped and dashboard.vue renders it via v-html, executing in the admin's browser session. Exploitation is therefore interaction-gated and scoped to the administrator's browser rather than the server; a public PoC reference exists but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation. The issue is rated 5.1 and prioritised as "this_month" rather than an emergency.
Unauthenticated path traversal in GoFound through 1.4.1 allows remote attackers to delete arbitrary directories by supplying ../ sequences in the 'database' parameter of GET requests to /api/db/create and /api/db/drop, which reaches os.RemoveAll with an attacker-controlled path. The assigned CVSS 4.0 vector (7.2, High) rates it AV:N/AC:L/PR:N, so a network-reachable instance is directly attackable without credentials; because the endpoints accept GET, the same action can also be triggered from a victim's browser, which is what the UI:P metric captures. There is no KEV entry indicating active exploitation, and the available exploit reference is a public PoC write-up that has not been verified as working exploit code; no EPSS score was supplied, and the vuln.today decision label is 'this_week'.
Stored cross-site scripting in GoFound through 1.4.1 lets unauthenticated attackers plant HTML/script by submitting document text to the /api/index endpoint, with no credentials required (CVSS:4.0 PR:N). The payload stays inert in the index until an administrator runs a dashboard search that matches the poisoned document, at which point searcher/engine.go returns the stored content unescaped and dashboard.vue renders it via v-html, executing in the admin's browser session. Exploitation is therefore interaction-gated and scoped to the administrator's browser rather than the server; a public PoC reference exists but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation. The issue is rated 5.1 and prioritised as "this_month" rather than an emergency.