Description
A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit_personal Endpoint. Such manipulation of the argument position_id leads to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 6.0.3 is able to resolve this issue. Upgrading the affected component is advised.
Published: 2026-09-02
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the edit_personal endpoint of gouguoa allows an attacker to manipulate the position_id parameter so that object attributes are dynamically determined during an update operation. The resulting arbitrary assignment of attributes can lead to improper data modification or even code execution if the application trusts the object state, thereby compromising the integrity and confidentiality of the application.

Affected Systems

The vulnerability affects gouguoa versions up to 5.10.0 and 6.0.1, specifically the app/home/controller/Index.php component of the edit_personal endpoint. Version 6.0.3 contains a fix and removes the flaw.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, but the exploit is publicly disclosed and can be triggered remotely. Attacks would target the external edit_personal endpoint by supplying crafted position_id values, potentially leading to unauthorized attribute manipulation or execution of arbitrary code if the application trusts the modified object.

Generated by OpenCVE AI on September 2, 2026 at 03:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade gouguoa to version 6.0.3 or later to eliminate the vulnerability
  • Restrict or disable external access to the edit_personal endpoint if it is not required for operational purposes
  • Implement strict validation on the position_id input to ensure it is an integer and within an expected range before processing

Generated by OpenCVE AI on September 2, 2026 at 03:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 01:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component edit_personal Endpoint. Such manipulation of the argument position_id leads to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 6.0.3 is able to resolve this issue. Upgrading the affected component is advised.
Title gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes
First Time appeared Gouguoa
Gouguoa gouguoa
Weaknesses CWE-913
CWE-915
CPEs cpe:2.3:a:gouguoa:gouguoa:*:*:*:*:*:*:*:*
Vendors & Products Gouguoa
Gouguoa gouguoa
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gouguoa Gouguoa
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-02T13:01:37.429Z

Reserved: 2026-09-01T18:41:46.981Z

Link: CVE-2026-84430

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-02T01:17:24.060

Modified: 2026-09-02T13:18:14.657

Link: CVE-2026-84430

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T04:00:09Z

Weaknesses
  • CWE-913

    Improper Control of Dynamically-Managed Code Resources

  • CWE-915

    Improperly Controlled Modification of Dynamically-Determined Object Attributes