CVE-2026-84430

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-84430", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-01T18:41:46.981Z", "datePublished": "2026-09-02T00:45:13.550Z", "dateUpdated": "2026-09-02T13:01:37.429Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-02T00:45:13.550Z"}, "title": "gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-915", "lang": "en", "description": "Dynamically-Determined Object Attributes"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-913", "lang": "en", "description": "Dynamically-Managed Code Resources"}]}], "affected": [{"vendor": "n/a", "product": "gouguoa", "versions": [{"version": "5.0", "status": "affected"}, {"version": "5.1", "status": "affected"}, {"version": "5.2", "status": "affected"}, {"version": "5.3", "status": "affected"}, {"version": "5.4", "status": "affected"}, {"version": "5.5", "status": "affected"}, {"version": "5.6", "status": "affected"}, {"version": "5.7", "status": "affected"}, {"version": "5.8", "status": "affected"}, {"version": "5.9", "status": "affected"}, {"version": "5.10.0", "status": "affected"}, {"version": "6.0.0", "status": "affected"}, {"version": "6.0.1", "status": "affected"}, {"version": "6.0.3", "status": "unaffected"}], "cpes": ["cpe:2.3:a:gouguoa:gouguoa:*:*:*:*:*:*:*:*"], "modules": ["edit_personal Endpoint"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit_personal Endpoint. Such manipulation of the argument position_id leads to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 6.0.3 is able to resolve this issue. Upgrading the affected component is advised."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-09-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-01T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-01T20:46:59.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Angoddess (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/397797", "name": "VDB-397797 | gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/397797/cti", "name": "VDB-397797 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-84430", "name": "CVE-2026-84430 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/884061", "name": "Submit #884061 | gouguoa 5.x Improper Privilege Management", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Angoddess/CVE/blob/main/README.md", "tags": ["exploit"]}, {"url": "https://gitee.com/gouguopen/office/releases/tag/v6.0.3", "tags": ["patch"]}], "x_generator": ["VulDB PVTS v202609"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-02T13:01:11.993306Z", "id": "CVE-2026-84430", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-02T13:01:37.429Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-84430", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-02T13:01:11.993306Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-02T13:01:23.793Z"}}], "cna": {"title": "gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes", "credits": [{"lang": "en", "type": "reporter", "value": "Angoddess (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:gouguoa:gouguoa:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["edit_personal Endpoint"], "product": "gouguoa", "versions": [{"status": "affected", "version": "5.0"}, {"status": "affected", "version": "5.1"}, {"status": "affected", "version": "5.2"}, {"status": "affected", "version": "5.3"}, {"status": "affected", "version": "5.4"}, {"status": "affected", "version": "5.5"}, {"status": "affected", "version": "5.6"}, {"status": "affected", "version": "5.7"}, {"status": "affected", "version": "5.8"}, {"status": "affected", "version": "5.9"}, {"status": "affected", "version": "5.10.0"}, {"status": "affected", "version": "6.0.0"}, {"status": "affected", "version": "6.0.1"}, {"status": "unaffected", "version": "6.0.3"}]}], "timeline": [{"lang": "en", "time": "2026-09-01T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-01T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-01T20:46:59.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/397797", "name": "VDB-397797 | gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/397797/cti", "name": "VDB-397797 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-84430", "name": "CVE-2026-84430 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/884061", "name": "Submit #884061 | gouguoa 5.x Improper Privilege Management", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Angoddess/CVE/blob/main/README.md", "tags": ["exploit"]}, {"url": "https://gitee.com/gouguopen/office/releases/tag/v6.0.3", "tags": ["patch"]}], "x_generator": ["VulDB PVTS v202609"], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit_personal Endpoint. Such manipulation of the argument position_id leads to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 6.0.3 is able to resolve this issue. Upgrading the affected component is advised."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-915", "description": "Dynamically-Determined Object Attributes"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-913", "description": "Dynamically-Managed Code Resources"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-02T00:45:13.550Z"}}}, "cveMetadata": {"cveId": "CVE-2026-84430", "state": "PUBLISHED", "dateUpdated": "2026-09-02T13:01:37.429Z", "dateReserved": "2026-09-01T18:41:46.981Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-09-02T00:45:13.550Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:gouguoa:gouguoa:*:*:*:*:*:*:*:*"], "modules": ["edit_personal Endpoint"], "product": "gouguoa", "vendor": "n/a", "versions": [{"status": "affected", "version": "5.0"}, {"status": "affected", "version": "5.1"}, {"status": "affected", "version": "5.2"}, {"status": "affected", "version": "5.3"}, {"status": "affected", "version": "5.4"}, {"status": "affected", "version": "5.5"}, {"status": "affected", "version": "5.6"}, {"status": "affected", "version": "5.7"}, {"status": "affected", "version": "5.8"}, {"status": "affected", "version": "5.9"}, {"status": "affected", "version": "5.10.0"}, {"status": "affected", "version": "6.0.0"}, {"status": "affected", "version": "6.0.1"}, {"status": "unaffected", "version": "6.0.3"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit_personal Endpoint. Such manipulation of the argument position_id leads to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 6.0.3 is able to resolve this issue. Upgrading the affected component is advised."}], "id": "CVE-2026-84430", "lastModified": "2026-09-02T13:55:27.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-84430", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-02T13:01:11.993306Z", "version": "2.0.3"}}]}, "published": "2026-09-02T01:17:24.060", "references": [{"source": "cna@vuldb.com", "url": "https://gitee.com/gouguopen/office/releases/tag/v6.0.3"}, {"source": "cna@vuldb.com", "url": "https://github.com/Angoddess/CVE/blob/main/README.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-84430"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/884061"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/397797"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/397797/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-913"}, {"lang": "en", "value": "CWE-915"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.10.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.0.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.0.3"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "original": {"product": "gouguoa", "source": "cna", "vendor": "n/a"}, "product": "gouguoa", "vendor": "gouguoa"}], "created": "2026-09-02T04:00:09.240335+00:00", "updated": "2026-09-03T16:27:29.233548+00:00", "vendors": ["gouguoa", "gouguoa$PRODUCT$gouguoa"]}