Auto Bangumi
Approved changes feed: RSS · Atom
cpe:2.3:a:estrellaxd:auto_bangumi:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Estrellaxd (e8c68476-cf9c-5327-9a8d-7b11e7989b3a) |
|---|---|
| Product | Auto Bangumi (17cf916a-ae65-5a55-95cf-4d1a3b313e11) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-59101 |
vulnerable | 2026-07-29 01:03:17.362422 |
AutoBangumi < 3.2.8 - SSRF via /api/v1/setup/test-downloader
MEDIUM (5.8)
AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal network services by supplying arbitrary host values to an unprotected setup endpoint. Attackers can send requests to the POST /api/v1/setup/test-downloader endpoint during the initial setup window, causing the server to issue HTTP GET requests to internal or reserved addresses and leak information through echoed connection-error messages.
Published: 2026-07-02T19:43:41.668Z
Updated: 2026-11-08T14:07:22.044Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-58466 |
vulnerable | 2026-07-29 01:03:16.837935 |
AutoBangumi < 3.2.8 - Hard-coded Default Credentials via add_default_user()
CRITICAL (9.8)
AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full control of the application, including RSS feed configuration, downloader configuration, and all authenticated API endpoints.
Published: 2026-07-02T19:56:47.347Z
Updated: 2026-11-08T14:07:06.449Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.