Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-119652

HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hulaspark
Products
Hula-server
CVE-2026-119651

HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hulaspark
Products
Hula-server
CVE-2026-119650

HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hulaspark
Products
Hula-server