Leediay153

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin area/flagged item.php via the unencoded type GET parameter. Attackers can send crafted flagged item.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel origin.

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.

VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has node perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.

**اسم البرنامج المصاب والإصدارات المتأثرة** Kaneo الإصدارات السابقة إلى 2.1.6 **Description** يمكن للمستخدمين المصرح لهم الوصول إلى مساحات عمل أخرى من خلال تقديم معرفات المشروع أو المهمة أو التسمية أو مساحة العمل إلى مسارات API التي تفتقر إلى فحوصات العضوية. يتيح ذلك للمهاجمين الذين يحصلون على المعرفات، على سبيل المثال من روابط المشاريع المشتركة، قراءة المشاريع والمهام، وتعديل أو حذف المهام والتسميات والتعليقات، والبحث في محتويات مساحة العمل. **Recommendations** تحديث Kaneo إلى الإصدار 2.1.6 أو إصدار أحدث.

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin area/index.php that allows attackers to inject HTML via the val parameter in mode=add todo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection, executing script in the admin panel origin.

VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin area/language settings.php via the unencoded edit language GET parameter. Attackers can send administrators with basic settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organization can pair their own organization identifier with victim resource IDs to delete survey responses, modify segments and quotas, or alter pending invitations.

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user belongs to check, to disclose metadata of groups they do not belong to.

**اسم البرنامج المصاب والإصدارات المتأثرة** Kan الإصدارات 0.5.5 through 0.6.0 **Description** يوجد ثغرة تزوير طلبات من جانب الخادم (SSRF) غير مصادق عليها في نقطة النهاية '/api/download/attatchment'. عندما يكون المتغير `S3 ENDPOINT` غير محدد، يمكن للمهاجمين تمرير معاملات استعلام URL تعسفية إلى دالة `fetch()` لقراءة الخدمات الداخلية، ومنافذ localhost، وبيانات وصف مثيلات السحابة. SSRF هي ثغرة تسمح للمهاجم بدفع التطبيق من جانب الخادم لإرسال طلبات إلى موقع غير مقصود. **Recommendations** تحديث Kan إلى إصدار أحدث من 0.6.0. كإجراء تخفيف مؤقت، تأكد من تكوين المتغير `S3 ENDPOINT` بشكل صحيح.

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescaped price value is re-rendered after failing validation, executing JavaScript in the administrative session.

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes feature price name and impact value POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into submitting a crafted request via a malicious link or auto-submitting form, executing JavaScript in their administrative session.

QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, and generate store-credit vouchers from other hotels' refund records, exposing customer identities and amounts.

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish date because PostResource skips authorization and ViewPost ignores is published.

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues' leave and overtime requests and read leave history.

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing JavaScript in that user's administrative session.

Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees or hr/exportLeaves/{id} and hr/exportOvertime/{id} to download employee names, emails, contracts, managers, and any employee's leave and overtime records.

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse get headers() and fopen() for server-side request forgery against internal hosts.