Skip to content
OpenAdvisories

Vendor

diboot

1 known vulnerabilities.

Products

diboot-core 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-70557

    diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts

    diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck(), returns tr…

    diboot diboot-core