Skip to content
OpenAdvisories

Vendor

HuLaSpark

3 known vulnerabilities.

Products

HuLa-Server 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-119652

    HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure

    HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend…

    HuLaSpark HuLa-Server
  • Medium 5.4
    CVE-2026-119650

    HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController

    HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with …

    HuLaSpark HuLa-Server
  • Medium 5.4
    CVE-2026-119651

    HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion

    HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del w…

    HuLaSpark HuLa-Server