Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-120443

GoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results

GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executing script in an administrator's browser when an admin search matches the document.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sea-team
Products
Gofound
CVE-2026-120444

GoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop

GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, directly or via a victim's browser, triggering os.RemoveAll on directories outside the data directory.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Sea-team
Products
Gofound