Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Stonewuu Clear all filters
TI-2026-85051 CVE-2026-121940 · GHSA-66jm-x353-x3mc

Stonewuu ai-fusion-video IDOR lets users access other users' projects

Priority HIGH 73

Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00452 Published 2026-11-04 Fixed in 1.3.0 CWE-639
TI-2026-73430 CVE-2026-110213 · GHSA-2w44-g53g-ccjh

ai-fusion-video Insecure Direct Object Reference in Task Item Endpoints

Priority LOW 24

Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00342 Published 2026-10-13 No fix listed CWE-639
TI-2026-73429 CVE-2026-110212 · GHSA-56g6-3cr7-7xx2

Path traversal in ai-fusion-video lets users write files outside media

Priority MEDIUM 57

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00423 Published 2026-10-13 No fix listed CWE-22
TI-2026-73426 CVE-2026-110209 · GHSA-4mgp-pq8c-xqfr

Missing authorization in ai-fusion-video exposes stored credentials

Priority MEDIUM 64

Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController en…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00476 Published 2026-10-13 No fix listed CWE-862