CVE-2026-3958

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability has been found in Woahai321 ListSync up to 0.6.6. This issue affects the function requests.post of the file list-sync-main/api_server.py of the component JSON Handler. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-395808.1Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.CVE-2026-395818.5Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.CVE-2026-395828.1Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.CVE-2026-395839.8Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.CVE-2026-395846.5Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.CVE-2026-395855.3Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This iss CVE-2026-395865.3Insertion of Sensitive Information Into Sent Data vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Retrieve Embedded Se CVE-2026-395878.1Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.CVE-2026-395885.3Missing Authorization vulnerability in nmerii NM Gift Registry and Wishlist Lite nm-gift-registry-and-wishlist-lite allows Exploiting Incorr CVE-2026-395899.9Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions.CVE-2026-39595.3A vulnerability was found in 0xKoda WireMCP up to 7f45f8b2b4adeb76be8c6227eefb38533fdd6b1e. Impacted is the function server.tool of the file CVE-2026-395908.1Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.