PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-16007] AppFlowy Authenticated SQL Injection

projectblack.io | vulnerability | CVE-2026-16007 | #sql-injection | #web-security | #vulnerability | #disclosure | #appflowy | #cve-2026-16007
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Project Black details CVE-2026-16007, an authenticated SQL injection in AppFlowy: the quick-note search parameter reaches the SQL query unsanitized—plus a telling vendor response.

Why it matters

This vulnerability coverage helps defenders validate exposure and prioritize remediation.
CVE
CVE-2026-16007
Vendor
AppFlowy
Product
AppFlowy
Published
Collected

Related coverage

vulnerability · blog.quarkslab.com
Snapshotting our way to CVE-2026-9539
This blog post presents a LibAFL-Qemu based way to explore state machines and why we failed to find CVE-2026-9539.
vulnerability · blog.quarkslab.com
MbedTLS Security Audit
At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
vulnerability · yeswehack.com
How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs
Learn how to find IDOR, stored XSS and information disclosure vulnerabilities with practical tips and techniques from YesWeHack’s top-ranked bug hunters.
vulnerability · hackerone.com
Hacktivity Disclosure for Private Programs
HackerOne launched disclosure for private programs, letting reports be shared with fellow participants rather than the whole world. Over 6,000 reports are already disclosed on Hacktivity.
vulnerability · hackerone.com
Top 5 Most Viewed Reports For Q2 2016
HackerOne's five most-viewed reports of Q2 2016: Uber XSS via Angular template injection ($3K), a Pornhub CMS exposure ($5K), an open SVN repo ($10K), an Imgur file read ($5K) and an Uber OneLogin bypass ($10K).
Back