| शीर्षक | PublicCMS V5.202506.d Anonymous Private File Download |
|---|
| विवरण | PublicCMS uses a predictable default privatefile_key to protect private file download URLs. Because the key can be derived from known values and the cluster identifier is exposed through an anonymous API, attackers can forge valid signatures offline and download private files without authentication once a file path is known. This results in a real unauthorized data disclosure vulnerability.
|
|---|
| स्रोत | ⚠️ https://vulnplus-note.wetolink.com/share/PCVUlOncmwTC |
|---|
| उपयोगकर्ता | vulnplusbot (UID 96250) |
|---|
| सबमिशन | 22/04/2026 10:52 AM (2 महीनों पहले) |
|---|
| संयम | 16/05/2026 12:36 PM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 364327 [Sanluan PublicCMS 5.202506.d SafeConfigComponent.java getSignKey privatefile_key कमजोर एन्क्रिप्शन] |
|---|
| अंक | 20 |
|---|