Labels Milestones New Issue

2 Open 8 Closed

Label

Show archived labels Use alt + click/enter to exclude labels

All labels No label

Milestone

All milestones No milestones

Project

All projects No project

Open Projects

CarrotBBS

Author

All users

Assignee

Assigned to nobody Assigned to anybody

HaoYong LostSalt WuYvbo lan

Sort

Newest Oldest Most recently updated Least recently updated Most commented Least commented Nearest due date Farthest due date

2 Open 8 Closed

Open

Label

Clear labels

Milestone

No milestone

Projects

Clear projects

Open Projects

CarrotBBS

Assignee

Clear assignees

No assignee

HaoYong

LostSalt

WuYvbo

lan

[LOW] SQL LIKE 查询未转义通配符：用户输入可导致全表扫描/数据泄露

#14 by lan was closed 2026-04-30 12:23:20 +08:00

[MEDIUM] Email TLS 证书校验可被禁用：InsecureSkipVerify 配置风险

#13 by lan was closed 2026-04-30 12:23:20 +08:00

[MEDIUM] HTTP Server 缺少超时配置：Slowloris DoS 攻击风险

#11 by lan was closed 2026-04-30 12:23:20 +08:00

[HIGH] SSRF 漏洞：用户可控 URL 未验证即发起 HTTP 请求

#10 by lan was closed 2026-04-30 12:23:20 +08:00

[LOW] JWT 载荷含敏感信息 + 缺少安全响应头

#9 by lan was closed 2026-04-30 12:23:20 +08:00

[MEDIUM] 缺失全局速率限制：登录、注册、密码重置接口可被爆破

#8 by lan was closed 2026-04-30 12:23:20 +08:00

[HIGH] SetupSuperAdmin 接口暴露：无速率限制，可被爆破

#6 by lan was closed 2026-04-30 12:23:20 +08:00

[CRITICAL] 大规模 IDOR 漏洞：Delete/Update 操作缺失所有权检查

#5 by lan was closed 2026-04-30 12:23:20 +08:00