CallBackery

Search everything

Mentions · 7d0
Mentions · 30d2
All mentions2
First seenOct 30, 2026
Last mentioned12d ago

Timeline

2 articles · newest first

CallBackery before 0.62.0 has password and session flaws

The note describes unsalted HMAC-SHA1 passwords, cookie forgery via rand(), and session cookies accepted at any age.

oss-securityOct 30, 15:49 UTC · 12d agoVulnerabilityCVE-2026-13576 CVE-2026-118986 CVE-2026-118987+1

CallBackery before 0.60.1 exposes POD via /doc path traversal

Unauthenticated clients can read the POD of any file through the Perl app’s /doc route; 0.60.1 is the fix.

oss-securityOct 30, 12:52 UTC · 12d agoVulnerabilityCVE-2026-118988

Related CVEs

by mentions

CVE-2026-1189867.5
Session cookie forgery in CallBackery before 0.62.0
published 12d agoCallBackery
CVE-2026-1189887.5
Unauthenticated path traversal in CallBackery /doc before 0.60.1
published 12d agoCallBackery for Perl
CVE-2026-135767.5
Unsalted HMAC-SHA1 password storage in CallBackery before 0.62.0
published 12d agoCallBackery
CVE-2026-1189905.5
Insecure config dump in CallBackery before 0.62.0
published 12d agoCallBackery
CVE-2026-1189875.3
Unbounded session cookie lifetime in CallBackery before 0.62.0
published 12d agoCallBackery for Perl

Entities are extracted by the model from each article. First seen Oct 30, 2026, last mentioned 12d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.