Evil0Rd

**اسم البرنامج المصاب والإصدارات المتأثرة** InstantSoft icms2 الإصدارات السابقة لـ 2.18.2 **Description** توجد ثغرة cross site scripting عن بعد ضمن مكون Private Message Handler. تحدث المشكلة في الدالة `index()` الموجودة في الملف `templates/default/controllers/messages/index.tpl.php`. يمكن للمهاجم استغلال ذلك عن طريق التلاعب بالوسيط `nickname` لتنفيذ برمجيات خبيثة في متصفح المستخدم. **Recommendations** تطبيق التصحيح 3a1ec8fcb073a46d06a2ab83bc2bf68225834281 للإصدارات السابقة لـ 2.18.2.

**اسم البرنامج المصاب والإصدارات المتأثرة** InstantSoft icms2 الإصدارات السابقة لـ 2.18.3 **الوصف** توجد ثغرة تخطي المسار (path traversal) في مكون Image Handler، وتحديداً في الدالة `files delete file()` الموجودة في الملف `system/fields/image.php`. يمكن للمهاجم عن بُعد استغلال ذلك عن طريق التلاعب بالوسيط `size` مما يسمح له بالوصول إلى ملفات خارج الدليل المحدد أو حذفها. **التوصيات** تطبيق التصحيح 03d70937f1ff97031523222808726994b8b79379 للإصدارات السابقة لـ 2.18.3. كإجراء تخفيف مؤقت، قم بتقييد الوصول إلى الدالة `files delete file()` في الملف `system/fields/image.php`.

**اسم البرنامج المصاب والإصدارات المتأثرة** InstantSoft icms2 الإصدارات السابقة لـ 2.18.2 **Description** توجد مشكلة في وحدة الفوترة (Billing Module) ضمن الدالة `validatePaypalOrder()` الموجودة في الملف system/controllers/billing/actions/paypal.php. يمكن للمهاجم عن بُعد التلاعب بالوسائط `bid`/`sig` مما يؤدي إلى عدم كفاية التحقق من صحة البيانات. **Recommendations** كإجراء مؤقت، قم بتقييد الوصول إلى الدالة `validatePaypalOrder()` حتى يتوفر إصلاح. في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة.

**Name of the Vulnerable Software and Affected Versions** ezBookkeeping versions 1.2.0 through 2.0.0 **Description** A privilege escalation issue exists where attackers possessing an API token can obtain a full session token. This occurs because the `TokenRefreshHandler` function fails to verify the token type, allowing short-lived or IP-restricted API tokens to be exchanged for 30-day normal session tokens. This process bypasses API token expiry and allowlists via the '/api/v1/tokens/refresh.json' endpoint. **Recommendations** Update ezBookkeeping to version 2.0.1.

**Name of the Vulnerable Software and Affected Versions** LaraDashboard versions prior to 1.4.8 **Description** An incorrect authorization issue allows authenticated users possessing only the `settings.view` permission to access stored secrets via the settings API. By querying the endpoints 'GET /api/settings' or 'GET /api/settings/{option name}', an attacker can retrieve plaintext passwords, tokens, mail credentials, and AI provider API keys. **Recommendations** Update to version 1.4.8 or later.

**Name of the Vulnerable Software and Affected Versions** LaraDashboard versions prior to 1.4.8 **Description** A path traversal issue allows unauthenticated attackers to read JSON files by manipulating the `{lang}` route segment. On Windows hosts, attackers can use URL-encoded backslash sequences such as `..%5C` to escape the `resources/lang` directory and access `composer.json` or other application JSON files. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder. **Recommendations** Update to version 1.4.8 or later.

**Name of the Vulnerable Software and Affected Versions** LaraDashboard versions 1.4.0 through 1.4.7 **Description** A race condition exists in the `RegisterController::register` function. This allows unauthenticated attackers to bypass the daily registration limit per IP address by sending multiple concurrent registration requests. Because these requests can all pass the `RegistrationGuardService::hasExceededIpLimit` check before the `recordRegistration` function executes, attackers can create accounts in bulk, effectively defeating anti-automation controls. **Recommendations** Update LaraDashboard to version 1.4.8.

**Name of the Vulnerable Software and Affected Versions** LaraDashboard versions prior to 1.4.8 **Description** Improper privilege management allows authenticated Admin users to escalate their privileges to Superadmin by editing or renaming roles. An attacker possessing the `role.edit` permission can rename their own role to Superadmin or grant themselves `user.login as` permissions. This allows for account takeover and access to core upgrade and module installation functions, which can lead to remote code execution. **Recommendations** Update to version 1.4.8 or later. Restrict the use of the `role.edit` permission to trusted administrators only.

**Name of the Vulnerable Software and Affected Versions** LaraDashboard versions 1.4.2 through 1.4.7 **Description** Unauthenticated users can trigger DNS lookups and paid AbstractAPI verification calls by submitting arbitrary addresses to the forgot-password and reset-password requests. This can lead to the exhaustion of the verification quota, causing validation to fail open for all public forms and allowing for domain resolution probing. **Recommendations** Update LaraDashboard to version 1.4.8.

**Name of the Vulnerable Software and Affected Versions** LaraDashboard versions prior to 1.4.8 **Description** An open redirect issue exists where remote attackers can redirect users to external phishing sites. This occurs when an unvalidated `redirect url` parameter is supplied to the `builder` and `builderEdit` endpoints of the `EmailTemplateController`. Logged-in users with email template permissions may be affected if they interact with crafted builder links and save a template. **Recommendations** Update to version 1.4.8 or later. As a temporary mitigation, restrict access to the `builder` and `builderEdit` endpoints of the `EmailTemplateController` or avoid using the `redirect url` parameter.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.8.5 **Description** Stored cross-site scripting occurs because the software fails to escape heading style attributes when rendering HTML for the outline and bookmark dock. Attackers can inject malicious style values by providing crafted notebooks or calling administrative endpoints. These values execute within the Electron renderer, potentially granting full system access. **Recommendations** Update SiYuan to version 3.8.5 or later.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.8.5 **Description** Insufficient publish access control in the 'getDynamicIcon' endpoint allows users with read-only tokens to access document metadata. By calling this endpoint with the `type` parameter set to 8 and providing crafted content, an attacker can perform template injection to retrieve block titles, names, aliases, and hierarchical paths of restricted documents. **Recommendations** Update SiYuan to version 3.8.5 or later. As a temporary mitigation, restrict access to the 'getDynamicIcon' endpoint.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.8.5 **Description** The software renders notebook names as raw HTML in the Daily Note picker dialog without proper escaping. This leads to stored cross-site scripting (XSS) within the Electron renderer. An attacker can create a notebook with a name containing HTML payloads that execute JavaScript with Node.js access when the picker is opened, potentially allowing the execution of operating system commands. **Recommendations** Update SiYuan to version 3.8.5 or later.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.8.4 **Description** The software renders document titles as HTML in the backlink dock tree without escaping markup characters. This allows attackers to set malicious titles via the rename API or crafted notebooks to execute scripts in the Electron renderer. Because the renderer has access to `child process`, this can lead to remote command execution. **Recommendations** Update to version 3.8.4 or later.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.8.4 **Description** Improper escaping of bookmark labels imported from notebook files occurs during rendering in the dock tree. This allows attackers to create malicious .sy notebook files containing unescaped HTML within bookmark attributes. When processed, these attributes can execute scripts in the Electron renderer, which has access to `child process`, enabling remote command execution. **Recommendations** Update SiYuan to version 3.8.4 or later.

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execute admin-gated handler actions without authentication to access sensitive functionality.

**Name of the Vulnerable Software and Affected Versions** MaxSite CMS versions prior to 109.7 **Description** The software contains a hardcoded session encryption key within the `application/config/config.php` file that remains unchanged after installation. This allows unauthenticated attackers to forge administrator session cookies by computing an HMAC-SHA1 (a keyed-hash message authentication code) using the known key. By creating a malicious `ci session` cookie, attackers can bypass authentication checks performed by the `is login()` and `mso check allow()` functions to gain administrator privileges. **Recommendations** Update MaxSite CMS to a version newer than 109.6. As a temporary mitigation, change the hardcoded session encryption key in the `application/config/config.php` file.

MaxSite CMS through 109.6 passes the ci session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist.

**Name of the Vulnerable Software and Affected Versions** MaxSite CMS versions 0.94 through 109.6 **Description** A stored cross-site scripting issue exists in the `admin page` upload handler. This flaw allows any authenticated user to upload HTML files containing malicious scripts to the `uploads/ pages/` directory. When a visitor accesses these files, the scripts execute within their browser. **Recommendations** Update MaxSite CMS to a version later than 109.6. Restrict the ability of users to upload files via the `admin page` handler as a temporary mitigation.

**Name of the Vulnerable Software and Affected Versions** Lara Dashboard versions prior to 1.3.2 **Description** An authenticated user can perform a server-side request forgery (SSRF) via the 'POST /api/admin/builder/markdown/fetch' endpoint. This occurs because the application fails to validate hosts or restrict redirects, allowing attackers to fetch arbitrary URLs and read the response body. This can be used to access internal HTTP services and cloud metadata, such as IAM credentials. **Recommendations** Update Lara Dashboard to version 1.3.2 or later. As a temporary mitigation, restrict access to the 'POST /api/admin/builder/markdown/fetch' endpoint.