Adam Młynarczyk

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload through this parameter, which is decoded and passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exploitation to achieve remote code execution as the web server process.

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact, which attackers exploit by delivering a crafted email whose FROM header executes script in the victim's browser when the user opens the message and accesses the Add Local Contacts function.

**Name of the Vulnerable Software and Affected Versions** Hi.Events versions prior to 1.11.0 **Description** Missing server-side visibility enforcement allows unauthenticated attackers to purchase hidden tickets. By referencing hidden product and price IDs in order creation requests, attackers can bypass authorization checks. This is possible by enumerating sequential hidden ticket IDs based on visible ones to acquire VIP, invite-only, or discounted tickets that were intentionally withheld from public sale. **Recommendations** Update Hi.Events to version 1.11.0 or later.

**Name of the Vulnerable Software and Affected Versions** Hi.Events versions prior to 1.11.0 **Description** Authenticated attackers with event creation or edit permissions can perform cross-site scripting by embedding a malicious event title containing the `</script>` sequence. This occurs because the sequence is not escaped by `JSON.stringify()` when embedded in inline script tags. This allows the attacker to break out of the script context within the `application/ld+json` structured data block or server-side rehydrated state, executing arbitrary HTML and JavaScript in the browser of any user viewing the public event page, including unauthenticated visitors and administrators. **Recommendations** Update to version 1.11.0 or later.