github.com/QuantumNous/new-api vulnerabilities (Go)
14 vulnerabilities.
-
github.com/QuantumNous/new-apiGo New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass 6.0 Medium -
github.com/QuantumNous/new-apiGo New API: Integer overflow in quota billing yields negative charges (self-crediting) 9.1 Critical -
github.com/QuantumNous/new-apiGo New API: Admin can reset passkeys for same-level or higher-privileged users 5.1 Medium -
github.com/QuantumNous/new-apiGo New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging 7.5 High -
github.com/QuantumNous/new-apiGo New API: User List API Leaks Root User Access Token Leading to Privilege Escalation 9.1 Critical -
github.com/QuantumNous/new-apiGo New API CSRF in email and WeChat account binding endpoints 5.3 Medium -
github.com/QuantumNous/new-apiGo New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs 7.7 High -
github.com/QuantumNous/new-apiGo New API: SSRF Filter Bypass via 0.0.0.0 7.1 High -
github.com/QuantumNous/new-apiGo New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud 7.1 High -
github.com/QuantumNous/new-apiGo New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure 4.9 Medium -
github.com/QuantumNous/new-apiGo New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check 6.5 Medium -
github.com/QuantumNous/new-apiGo New API has Potential XSS in its MarkdownRenderer component 7.6 High -
github.com/QuantumNous/new-apiGo New API has an SQL LIKE Wildcard Injection DoS via Token Search 7.1 High -
github.com/QuantumNous/new-apiGo QuantumNous New API Has SSRF Bypass 8.5 High