0005Qibo / PHP168
Qibo / PHP168 guest-scope command execution
guest-accessible label handling allows command execution; reported, with reproduction details withheld
0003Joomla
Joomla com_contact access-control bypass
guest-denied contacts can still leak personal data through direct format=vcf output
0002MetInfo
MetInfo 8.1 unauthenticated file read
guest SVG upload can trigger XXE and exfiltrate local file content
0001MacCMS
MacCMS unauthenticated account takeover
guest-readable user detail data exposes enough material to forge a frontend login cookie