Skip to content
OpenAdvisories

Package · Go

github.com/mayswind/ezbookkeeping

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.3
    CVE-2026-86041

    ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

    ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An…

    mayswind ezbookkeeping github.com/mayswind/ezbookkeeping Go
  • Medium 6.3
    CVE-2024-57603

    Missing rate limit in MaysWind ezBookkeeping

    An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting.

    github.com/mayswind/ezbookkeeping Go
  • Critical 9.8
    CVE-2024-57604

    MaysWind ezBookkeeping has Improper Privilege Management

    An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.

    github.com/mayswind/ezbookkeeping Go