Evan

**Name of the Vulnerable Software and Affected Versions** SmarterMail versions prior to build 9777 **Description** A remote code execution issue exists where an attacker with a SysAdmin-scoped access token can bypass Volume Mount script-directory containment. This is achieved by provisioning a new mail domain with an arbitrary FileStore root path within the trusted Scripts directory using the 'domain-put' endpoint. The attacker can identify the Scripts path via the 'AddOrUpdateMount' endpoint and clear the upload extension blacklist through the 'global-mail' endpoint. Subsequently, a malicious script can be uploaded via the mail file-storage upload API. When saving a CommandMount, the `RunScript()` function is triggered before validation, allowing a reverse shell to execute with SYSTEM-level privileges under the SmarterMail service account. **Recommendations** Update SmarterMail to build 9777 or later.

**Name of the Vulnerable Software and Affected Versions** SmarterMail versions prior to build 9777 **Description** A stored mutation cross-site scripting issue exists where remote attackers can inject executable scripts. This occurs by placing payloads inside a `<style>` element nested within MathML foreign content (`<math><mtext><mglyph>`), which the custom HTML sanitizer incorrectly treats as inert CDATA text while browsers reparse it as live markup. An attacker can send a crafted calendar (iCal) message containing an `<img src=x onerror=...>` payload. This script executes automatically in the recipient's webmail session at the `/interface/message-iframe` endpoint when the message is opened, allowing for script execution and data exfiltration due to a permissive Content-Security-Policy. **Recommendations** Update SmarterMail to build 9777 or later.

**Name of the Vulnerable Software and Affected Versions** SmarterMail versions prior to build 9777 **Description** An issue exists where JSON Web Tokens (JWT) for access and refresh purposes embed a role claim at the time of issuance. This claim is not revalidated against the account's current role when redeemed via the 'POST /api/v1/auth/refresh-token' endpoint. Consequently, a user who has been demoted from an administrative role, or an attacker who captures a refresh token issued before such a demotion, can replay the stale token to obtain a new access token that retains elevated privileges, such as `DomainAdmin` or `SysAdmin`, until the token expires naturally. **Recommendations** Update to build 9777 or later.

**Name of the Vulnerable Software and Affected Versions** openEQUELLA versions prior to 2026.1.0 **Description** An authenticated non-guest user can execute arbitrary code via Java deserialization at the '/invoker/*' HTTP invoker endpoint. The issue occurs because the class-name denylist enforced by `PluginAwareObjectInputStream` can be bypassed by nesting a serialized payload within a `java.security.SignedObject`. This causes the inner stream to be processed by a separate `ObjectInputStream` that lacks the denylist, eventually reaching a JNDI sink. JNDI (Java Naming and Directory Interface) is a Java API that allows applications to discover and look up data and objects. **Recommendations** Update to version 2026.1.0.

**Name of the Vulnerable Software and Affected Versions** openEQUELLA versions prior to 2026.1.0 **Description** Remote code execution is possible during FreeMarker template compilation because of an unsandboxed `TemplateClassResolver` configuration. Authenticated attackers can inject malicious template expressions via collection summaries, dashboard portlets, or MIME templates. This allows the instantiation of dangerous classes, such as `freemarker.template.utility.Execute`, to invoke `Runtime.exec()` for arbitrary command execution. **Recommendations** Update to version 2026.1.0.

**Name of the Vulnerable Software and Affected Versions** Ad Inserter – Ad Manager & AdSense Ads versions prior to 2.8.17 **Description** An authorization bypass exists due to a missing capability check on the `ai-debug-code` URL-parameter. This allows unauthenticated attackers to view header and footer code blocks configured by the administrator that were intended to be disabled from public display. **Recommendations** Update the plugin to version 2.8.17 or later. As a temporary workaround, restrict access to the `ai-debug-code` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Horde IMP versions prior to 7.2.0 **Description** The AppleDouble MIME viewer fails to escape attachment names written into an HTML status block. In the file `lib/Mime/Viewer/Appledouble.php`, the ` IMPrender()` function uses `IMP Contents::getPartName()` to retrieve the MIME part name provided in the message and passes it via `sprintf` into an `IMP Mime Status` object. Because `IMP Mime Status:: toString()` concatenates text entries directly into table markup, the value is rendered verbatim. An attacker can send a crafted `multipart/appledouble` message containing markup in the name parameter to execute scripts in the context of any user who views the email, with the payload persisting in the mailbox. This does not require an account on the target system. If executed in an administrator session, this can be chained with an arbitrary file read to achieve application code execution. **Recommendations** Update to version 7.2.0.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Horde IMP الأقدم من 7.0.1 **الوصف** توجد مشكلة في اجتياز المسار في ملف `lib/Compose.php`. يمكن للمهاجمين المصادق عليهم قراءة ملفات عشوائية من نظام ملفات الخادم عن طريق تضمين تسلسلات اجتياز بعد بادئة مسار CKEditor في عناوين URL لـ `img src`. يحدث هذا لأن التحقق من صحة البادئة باستخدام `stripos()` يمكن تجاوزه بإلحاق أجزاء اجتياز، مما يؤدي إلى قيام الدالة `file get contents()` بقراءة الملفات الحساسة. ثم يتم تسريب محتويات هذه الملفات كأجزاء MIME في رسائل البريد الإلكتروني الصادرة. بالإضافة إلى ذلك، يمكن الاستغلال دون مصادقة من خلال تزوير الطلبات عبر المواقع (CSRF)، وهي تقنية تُستخدم لخداع متصفح الضحية لتنفيذ إجراء غير مرغوب فيه على موقع ويب آخر حيث تكون الضحية مصادقًا عليه حاليًا. **التوصيات** تحديث Horde IMP إلى الإصدار 7.0.1 أو أحدث.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** البرنامج الثابت لجهاز التوجيه Tenda G300-F، الإصدارات الأقدم من 16.01.14.2 **الوصف** يحتوي البرنامج الثابت لجهاز التوجيه Tenda G300-F على ثغرة أمنية تتعلق بحقن أوامر نظام التشغيل في وظيفة تشخيص شبكة WAN، وتحديدًا داخل الدالة `formSetWanDiag`. يقوم البرنامج بإنشاء أمر شل باستخدام `curl` ويدمج مدخلات يتحكم فيها المهاجم دون إجراء التنقية اللازمة. وهذا يسمح لمهاجم عن بُعد لديه وصول إلى واجهة الإدارة بحقن صيغة شل وتنفيذ أوامر تعسفية على الجهاز بامتيازات عملية الإدارة. وترتبط الوظيفة المعرضة للثغرة بميزة تشخيص شبكة WAN. **التوصيات** قم بالتحديث إلى إصدار برنامج ثابت أحدث من 16.01.14.2.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Automatic Question Paper Generator System version 1.0 **Description** A critical issue has been found in the GET Parameter Handler component of the file admin/courses/view course.php. The manipulation of the `id` argument leads to sql injection. This issue can be exploited remotely. **Recommendations** For SourceCodester Automatic Question Paper Generator System version 1.0, consider restricting access to the `view course.php` file until a patch is available. As a temporary workaround, avoid using the `id` argument in the affected GET Parameter Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.