Read the docs

Stonewuu

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

Stonewuu records in CISA KEV

No Stonewuu vulnerabilities are listed in CISA KEV.

Records

4 records

TI-2026-85051 CVE-2026-121940 · GHSA-66jm-x353-x3mc

Stonewuu ai-fusion-video IDOR lets users access other users' projects

Priority HIGH 73

Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00452 Published 2026-11-04 Fixed in 1.3.0 CWE-639
TI-2026-73426 CVE-2026-110209 · GHSA-4mgp-pq8c-xqfr

Missing authorization in ai-fusion-video exposes stored credentials

Priority MEDIUM 64

Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController en…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00476 Published 2026-10-13 No fix listed CWE-862
TI-2026-73429 CVE-2026-110212 · GHSA-56g6-3cr7-7xx2

Path traversal in ai-fusion-video lets users write files outside media

Priority MEDIUM 57

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00423 Published 2026-10-13 No fix listed CWE-22
TI-2026-73430 CVE-2026-110213 · GHSA-2w44-g53g-ccjh

ai-fusion-video Insecure Direct Object Reference in Task Item Endpoints

Priority LOW 24

Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00342 Published 2026-10-13 No fix listed CWE-639
Open these records in search →