GoFound vulnerabilities
CVEs whose affected-version data names the GoFound package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-120444High· 8.1PoCGoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop
GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create a…
▾ Midnightsea-team · GoFoundEPSS 0.41%via CVEORG
CVE-2026-120443Medium· 6.1GoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results
GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go retu…
▾ Sunlitsea-team · GoFoundEPSS 0.27%via CVEORG