Vulnerabilities

TI-2026-75435 CVE-2026-111649 · GHSA-x97c-6hxr-5qp6

Insecure reference in Rocboss paopao-ce exposes private attachments

MEDIUM 64

Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00386 Published 2026-10-16 No fix listed CWE-639

TI-2019-08484 CVE-2019-11362 · GHSA-5855-c4ch-q7j5

app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL injection via the…

MEDIUM 45

app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL injection via the Post:doReward score paramter, as demonstrated by the /do/reward/3 URI.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01554 Published 2019-04-20 No fix listed CWE-89

Vulnerabilities

Filters

Insecure reference in Rocboss paopao-ce exposes private attachments

app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL injection via the…