CVE-2026-84430

The record

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit_personal Endpoint. Such manipulation of the argument position_id leads to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 6.0.3 is able to resolve this issue. Upgrading the affected component is advised.

Affected packages

Related vulnerabilities

• CVE-2026-92953 vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer… CWE-913
• CVE-2026-92955 vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers… CWE-913
• CVE-2026-92946 vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is… CWE-913
• CVE-2026-92935 vm2 is a sandbox for running untrusted Node.js code. CWE-913
• CVE-2026-65181 Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with… CWE-913
• CVE-2026-41870 Missing Authorization, Improper Control of Generation of Code ('Code Injection')… CWE-913
• CVE-2026-59283 Applications that evaluate Spring Expression Language (SpEL) expressions using… CWE-913
• CVE-2026-71470 A flaw was found in the search-v2-operator. CWE-913