Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-121940

Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers

Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to read, overwrite, cascade-delete data, and add themselves as project members.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Stonewuu
Products
Ai-fusion-video
CVE-2026-110209

ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials

Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config endpoints to obtain AI provider API keys, proxy passwords and mail_password, enabling billing abuse and sending mail as the platform.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Stonewuu
Products
Ai-fusion-video
CVE-2026-110212

ai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that LocalStorageStrategy.storeBytes never normalizes, creating directories and writing attacker-controlled files with chosen extensions anywhere the service account can write.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Stonewuu
Products
Ai-fusion-video
CVE-2026-110213

ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints

Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to obtain other users' generated images, videos, and output metadata.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Stonewuu
Products
Ai-fusion-video