mlogclub has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 5.4 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-111639High· 8.1bbs-go through 4.4.6 Account Takeover via Google One Tap Login57CVE-2026-110103Medium· 5.4bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload30CVE-2026-103396Medium· 4.3bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboa…24
mlogclub vulnerabilities
CVEs affecting mlogclub, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-111639High· 8.1PoCbbs-go through 4.4.6 Account Takeover via Google One Tap Login
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers ope…
CVE-2026-110103Medium· 5.4bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload
bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documen…
CVE-2026-103396Medium· 4.3bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboa…
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboa…