Vulnerabilities

TI-2026-83839 CVE-2026-120447 · GHSA-c3f7-678j-f69g

HotGo Authentication Bypass via Client-Set SMS Verification Code

HIGH 75

HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00531 Published 2026-11-02 No fix listed CWE-287

TI-2026-04588 CVE-2026-5253 · GHSA-vh7h-cc8j-x655

bufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting

MEDIUM 56

A weakness has been identified in bufanyun HotGo 1.0/2.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00248 Published 2026-04-01 No fix listed CWE-79

TI-2026-03178 CVE-2026-3683 · GHSA-r4rq-7w7j-cmr6

bufanyun HotGo Endpoint upload.go ImageTransferStorage server-side request forgery

MEDIUM 57

A vulnerability was detected in bufanyun HotGo up to 2.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00234 Published 2026-03-07 No fix listed CWE-918

Vulnerabilities

Filters

HotGo Authentication Bypass via Client-Set SMS Verification Code

bufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting

bufanyun HotGo Endpoint upload.go ImageTransferStorage server-side request forgery