Read the docs

mlogclub

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

mlogclub records in CISA KEV

No mlogclub vulnerabilities are listed in CISA KEV.

Records

4 records

TI-2026-75425 CVE-2026-111639 · GHSA-h5hh-rp4r-9p9x

bbs-go Account Takeover via Google One Tap Login

Priority HIGH 72

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth clie…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00473 Published 2026-10-16 No fix listed CWE-287
TI-2026-84345 CVE-2026-121452 · GHSA-4ffj-9jv6-m8p5

Improper TLS certificate validation in bbs-go SMTP email service

Priority LOW 36

bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00235 Published 2026-11-03 No fix listed CWE-295
TI-2026-65682 CVE-2026-103396 · GHSA-wr27-gh7c-5q9v

bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

Priority LOW 24

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00286 Published 2026-09-30 No fix listed CWE-863
TI-2026-71989 CVE-2026-110103 · GHSA-rm26-pxjp-76q3

Stored cross-site scripting in bbs-go via spoofed upload Content-Type

Priority LOW 23

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00226 Published 2026-10-13 No fix listed CWE-79
Open these records in search →