Vulnerabilities in mauriceboe

11 results

CVE-2026-54505LOWTREK: Stored cross-user HTML injection via trip title in the Journey suggestion bannerEPSS 0.6%CVE-2026-54508MEDIUMTREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolutionEPSS 0.4%CVE-2026-54509MEDIUMTREK IDOR: any authenticated user can read another user's journey share token (full journey leak)EPSS 0.4%CVE-2026-77293HIGHTREK: Cross-user note-file deletion (IDOR / Broken Access Control)EPSS 0.4%CVE-2026-62945MEDIUMTREK: Cross-trip reservation title disclosure via file linksEPSS 0.3%CVE-2026-77294HIGHTREK: Server-Side Request Forgery via User-Configurable LLM Base URLEPSS 0.3%CVE-2026-77320MEDIUMTREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)EPSS 0.3%CVE-2026-40184LOWUnauthenticated Access to Uploaded Files in TREKEPSS 0.2%CVE-2026-40185HIGHMissing Authorization on Immich Trip Photo Routes in TREKEPSS 0.2%CVE-2026-45410MEDIUMTime-based user enumeration in TREK authentication endpointEPSS 0.2%CVE-2026-77321MEDIUMTREK MCP trip summary bypasses delegated OAuth read scopesEPSS 0.2%