insightcve.com resources

insightcve.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-11-10.

IDOR 3 API Sec 2 AI 1 AuthZ 1 CSRF 1 Mobile 1 SSRF 1 XXE 1

Date Added	Resource	Excerpt
2026-11-10 2026	CVE-2026-63441: NAT64 prefix bypass enables SSRF in 2FAuth SSRF	2FAuth versions 6.1.0 through 7.9.0 have a vulnerability (CVE-2026-63441) where NAT64 prefixes are incorrectly handled during URL validation. This flaw allows attackers to exploit the `otpauth` URI's image parameter to perform Server-Side Request Forgery (SSRF) attacks. By crafting malicious URLs, attackers can force the 2FAuth server to make GET requests to internal IPv4 addresses, potentially exposing sensitive information or allowing unauthorized access to internal network resources.
2026-11-07 2026	CVE-2026-54377: VitaFit Cloud API IDOR exposes profiles and reports API Sec IDOR Mobile	Writeup of CVE-2026-54377, an IDOR vulnerability in the VitaFit cloud API, allowing authenticated attackers to access other users' email, profile, body-composition reports, and measurement histories. Affected versions pre-date 2026-10-30. Predictable identifiers combined with an account enumeration weakness enable large-scale data extraction. The flaw, CWE-639, has a CVSS 4.0 score of 6.9 (Medium). Exploitation involves substituting known user or profile IDs into endpoints like `/front/profile/{profile_id}/report/`.
2026-11-06 2026	CVE-2026-13289: XXE in IBM MQ exposes sensitive data XXE	IBM MQ versions 9.2 LTS through 10.0 LTS/CD are susceptible to an XML External Entity (XXE) injection vulnerability (CWE-611). This flaw allows remote attackers to potentially access sensitive data by exploiting how the software processes XML.
2026-11-06 2026	CVE-2026-119048: JeeSite AI CMS chat IDOR exposes conversations AI API Sec IDOR	An Insecure Direct Object Reference (IDOR) vulnerability, CVE-2026-119048, has been discovered in JeeSite's AI CMS chat module, affecting versions 5.11.0 through 5.19.1. This flaw allows authenticated users to access and view conversations belonging to other users by manipulating chat IDs. The vulnerability could lead to unauthorized disclosure of sensitive chat content.
2026-11-02 2026	WeGIA record ownership bypass and CSRF (CVE-2026-61671)AuthZ CSRF IDOR	A vulnerability in WeGIA, version prior to 3.8.7, allows any authenticated user to access, alter, or remove other users' sensitive records, including personal identification, medical, and financial information. This bypass, identified as CVE-2026-61671, also includes a CSRF (Cross-Site Request Forgery) component, enabling unauthorized actions without user interaction.