Alisher Qarshibayev

**Name of the Vulnerable Software and Affected Versions** FacturaScripts versions prior to 2026.7 **Description** An authenticated attacker can exploit a PHP object injection issue within the `processFormData()` function of `WidgetSelect`. This occurs because the application performs `unserialize()` on raw POST data for multiple-select fields without applying an `allowed classes` filter. By submitting a serialized `XLSXWriter` object as a field value, an attacker can trigger the ` destruct()` method to delete arbitrary files, such as `config.php` or backup data. This can lead to a denial of service or a potential application reinstall hijack. **Recommendations** Update FacturaScripts to version 2026.7 or later.

**Name of the Vulnerable Software and Affected Versions** Phproject versions prior to 1.8.7 **Description** An issue exists in the REST API where object-level authorization is missing. Authenticated users with a valid API key can bypass the `security.restrict access` confidentiality control because the `allowAccess()` authorization routine is not invoked. This allows attackers to read restricted issue contents and comments, including owner and author email addresses, and post unauthorized comments to issues they should not have access to via the following endpoints: 'single get', 'single comments', and 'single comments post'. **Recommendations** Update Phproject to version 1.8.7 or later.

**Name of the Vulnerable Software and Affected Versions** PictShare versions prior to 3.7.1 **Description** An information disclosure issue exists where unauthenticated attackers can obtain the secret `delete code` and uploader metadata. This occurs when calling the 'API::info()' endpoint, which returns the complete raw metadata object without a field whitelist. By using a publicly visible file hash, an attacker can retrieve the `delete code` and subsequently use the delete API to permanently remove arbitrary files. Additionally, this exposes the uploader IP, User Agent, remote port, and SHA-1 hash, compromising content integrity, availability, and uploader privacy. **Recommendations** Update PictShare to version 3.7.1 or later. Restrict access to the 'API::info()' endpoint to minimize the risk of metadata exposure.

**Name of the Vulnerable Software and Affected Versions** PictShare versions prior to 3.7.1 **Description** The software contains a weak randomness issue where the `getRandomString()` function utilizes the non-cryptographic `rand()` Pseudo-Random Number Generator (PRNG) to create the `delete code` authorization token within the `src/inc/core.php` file. This allows attackers to predict or infer the PRNG state to guess valid `delete code` values, enabling the unauthorized deletion of hosted files without requiring access to the info endpoint. **Recommendations** Update to version 3.7.1 or later. As a temporary mitigation, restrict access to the `getRandomString()` function or the file deletion functionality until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Laranode versions prior to 1.2.1 **Description** Authenticated users can exploit a path traversal flaw to write arbitrary files outside their designated home directory. By providing directory traversal sequences in the `path` parameter of the 'POST /filemanager/upload-file' endpoint, an attacker can place PHP files into the web roots of other tenants, potentially leading to remote code execution as those tenants. This issue occurs because the software uses attacker-controlled path values to determine upload destinations without sufficient traversal protections. **Recommendations** Update to version 1.2.1. Restrict access to the 'POST /filemanager/upload-file' endpoint or avoid using the `path` parameter until the update is applied.