CVE-2026-119653
Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by
CVSS
4.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 30, 2026 · Last modified: Oct 30, 2026 · CWE-862
Not enough EPSS history yet.
Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist.
- github.comhttps://github.com/admpub/nging
- github.comhttps://github.com/admpub/nging/blob/v5.3.5/application/handler/user/init.go#L28-L42
- github.comhttps://github.com/admpub/nging/blob/v5.3.5/application/handler/user/profile.go#L136-L157
- github.comhttps://github.com/admpub/nging/commit/6434d026f668bdb5d59db658036fd6febbd29c0c
- github.comhttps://github.com/admpub/nging/issues/831
- hackmd.iohttps://hackmd.io/@hieuPenguinnn/nging-user-autocomplete-path-filesystem-disclosure
- www.vulncheck.comhttps://www.vulncheck.com/advisories/nging-through-5.3.5-directory-listing-disclosure-via-user-autocomplete-path
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-620554.3 MED—
———Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.6hCVE-2026-6182610.0 CRI—
———Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke `POST /api/plex/oauth/logout` to clear credentials and disable the integration, or `POST /api/plex/apikey` to persist an attacker-selected key, without a PIN, account or state precondition. `POST /api/plex/oauth/pin` and `GET /api/plex/oauth/pin/<pin_id>/check` additionally allow an attacker who completes a PIN with an attacker-controlled Plex account to bind that account's token to the instance. `PlexPinCheck` skips state validation when `state_param` is absent and merely logs a mismatch without stopping execution. `POST /api/plex/select-server`, `POST /api/plex/oauth/servers`, `POST /api/plex/webhook/create`, `POST /api/plex/webhook/delete` and `POST /api/plex/encrypt-apikey` expose further `write_config()` operations. Attacker-controlled server URLs feed later outbound requests carrying the configured API key in `X-Plex-Token`, enabling server-side request forgery and credential exposure in addition to persistent configuration tampering and integration denial of service. Version 1.5.7-beta.14 closes the anonymous API-mutation path by adding authentication; complete OAuth state validation is not established and remains a separate residual for curator review.6hCVE-2026-61806——
———Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access, rather than being limited to the certificate owner and authorized staff. This can expose certificate details belonging to other users. Access to published certificates by their identifier is intentional for third-party verification and is not affected. The issue does not allow modifying data or gaining elevated privileges. This issue is fixed in version 2.54.2.6hCVE-2026-61805——
———Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts and blocking legitimate submissions. These integrity and availability issues are scoped to quiz results; they do not expose other users' data or grant elevated roles. This issue is fixed in version 2.54.0.6hCVE-2026-1193675.4 MED—
———Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.6hCVE-2026-621415.4 MED—
———Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent CRM: from n/a through 3.2.6.6h