Alex Williams

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.3.0 **Description** A reflected cross-site scripting issue exists in the patient portal template import handler. The `templateHtml` GET parameter is reflected in the page response without proper sanitization. This allows an attacker to craft a URL that executes arbitrary JavaScript in the browser of authenticated users with Forms Administration permissions, which can lead to session hijacking. **Recommendations** Update to version 8.3.0 or later. Avoid using the `templateHtml` parameter in the patient portal template import handler until the update is applied.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.3.0 **Description** A path traversal issue exists in the EDI archive restore function. The `archrestore sel` POST parameter is processed by the archive restore handler without proper sanitization for path traversal sequences. This allows an authenticated user with EOB Data Entry permissions to probe arbitrary filesystem paths on the server. The system leaks information about the existence of target files through differing response messages. **Recommendations** Update to version 8.3.0 or later. Restrict the use of the `archrestore sel` parameter in the EDI archive restore function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.3.0 **Description** A cross-site request forgery issue exists in the DICOM viewer. The `web path` GET parameter in the DICOM viewer page is embedded as a URL without proper sanitization or validation against expected path formats. This allows an attacker to craft a URL that forces an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, which can lead to forced logout and other state-changing actions. **Recommendations** Update to version 8.3.0 or later. Avoid using the `web path` parameter in the DICOM viewer page until the update is applied.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.3.0 **Description** A stored cross-site scripting issue exists in the patient portal template import handler. Authenticated attackers with Forms Administration permissions can upload template files containing arbitrary HTML or JavaScript. These malicious scripts are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor. **Recommendations** Update to version 8.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** Koha versions prior to 26.05.02 Koha versions prior to 25.11.07 Koha versions prior to 25.05.13 **Description** A stored cross-site scripting issue exists in the purchase suggestion handler. Authenticated staff users can inject malicious scripts by submitting unsanitized input during the suggestion save operation. Specifically, crafted HTML or script content can be placed in the `title`, `author`, `isbn`, `publishercode`, `place`, `collectiontitle`, `itemtype`, and `note` variables. These inputs are stored without sanitization and subsequently executed in the browser of any staff user who views the suggestion list template. **Recommendations** Update to version 26.05.02 or later. Update to version 25.11.07 or later. Update to version 25.05.13 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.2.0 **Description** A path traversal issue exists in the 'standard tables manage.php' interface. The `db` GET parameter is passed without validation to the `temp dir cleanup()` function, which appends the value to the PHP temporary directory path and recursively deletes the resulting directory. By using a traversal sequence in the `db` parameter and combining it with an open redirect in 'dicom frame.php', an unauthenticated attacker can send a crafted URL that causes arbitrary recursive directory deletion when accessed by an authenticated Superuser session. **Recommendations** Update to version 8.2.0 or later. As a temporary mitigation, restrict access to the 'standard tables manage.php' interface or avoid using the `db` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Samsung Open Source rlottie (affected versions not specified) **Description** An issue exists where improper validation of the specified quantity in the input and the allocation of resources without limits or throttling allows for excessive allocation, leading to resource exhaustion. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samsung Open Source rlottie (affected versions not specified) **Description** Improper validation of the specified quantity in input allows for input data manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Samsung Open Source rlottie (affected versions not specified) **Description** Improper input validation allows the processing of oversized serialized data payloads. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OPNsense versions prior to 26.1.9 **Description** Authenticated attackers with firewall rule management privileges can perform a stored cross-site scripting attack. By embedding malicious HTML or JavaScript payloads into the firewall rule description field via the filter API endpoint, the unsanitized value is stored and subsequently rendered by the default cell formatter in `opnsense bootgrid.js`. This occurs because raw cell content is assigned to `innerHTML`, which executes the injected scripts in the browser of any authenticated user viewing the Firewall Rules page, potentially leading to session hijacking or credential theft. **Recommendations** Update OPNsense to version 26.1.9 or later.

**Name of the Vulnerable Software and Affected Versions** OPNsense versions prior to 26.1.9 **Description** Authenticated attackers can perform a stored cross-site scripting attack by injecting arbitrary HTML or JavaScript into the certificate description field. This occurs via the trust certificate API, where the unsanitized description value is stored and subsequently rendered in the Dashboard Certificates widget through `Certificates.js`. The script executes in the browser of any authenticated user viewing the Dashboard because the raw value is interpolated into HTML attribute and text content sinks without proper encoding, potentially leading to session hijacking or credential theft. **Recommendations** Update OPNsense to version 26.1.9 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the default import settings configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the `configured folders` parameter at the '/Archiver/ImportSettingsWizard.ashx' endpoint. The payload is processed by the `SaveAllConfigSettings()` function without proper output encoding and is subsequently executed in the browsers of users who view the Archive Assistant default import settings. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the File Archive Assistant configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the `excluded extensions` parameter at the '/Archiver/FileArchiveAssistantWizard.aspx' endpoint. The payload is processed by the `FileArchiveAssistantWizard.btnSave Click()` function without proper output encoding and is subsequently executed in the browsers of users who access the File Archive Assistant settings page. **Recommendations** Update GFI Archiver to version 15.13 or later. As a temporary mitigation, restrict access to the '/Archiver/FileArchiveAssistantWizard.aspx' endpoint or avoid modifying the `excluded extensions` parameter.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the MailInsights scheduled report configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the report name parameter at the '/Archiver/MailInsights.aspx' endpoint. The payload is processed by the `ReportScheduling.btnSaveReport Click()` function without proper output encoding and is executed in the browser of the user who created the report when they view the MailInsights page. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the IMAP Server configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the `server URL` parameter at the '/Archiver/ImapServerWizard.aspx' endpoint. The payload is processed by the `ImapServerWizard.SaveAllConfigSettings()` function without proper output encoding, causing the script to execute in the browsers of users who access the IMAP Server configuration page. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the File History Retention Policy configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the policy name parameter at the '/Archiver/FAARetentionPolicyWizard.aspx' endpoint. The payload is processed by the `SaveAllConfigSettings()` function without proper output encoding and is subsequently executed in the browsers of users who access the File History Retention Policies page. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the Call Home proxy server configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the proxy server address parameter at the '/Archiver/CallHomeSettingsWizard.aspx' endpoint. The payload is processed by the `SaveAllConfigSettings()` function without proper output encoding and is subsequently executed in the browsers of users who access the General Settings Additional Settings page. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the General Settings SMTP configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the SMTP server address parameter at the '/Archiver/GeneralSettingsWizard.aspx' endpoint. The payload is processed by the `SaveAllConfigSettings()` function without proper output encoding, causing the script to execute in the browsers of users who access the General Settings page. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the Retention Policy configuration. Authenticated attackers can inject arbitrary HTML or web scripts through the policy name parameter at the '/Archiver/RetentionPolicyWizard.aspx' endpoint. The payload is processed by the `SaveAllConfigSettings()` function without proper output encoding and is subsequently executed in the browsers of users who access the Retention and Spam Policies page. **Recommendations** Update GFI Archiver to version 15.13 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Archiver versions prior to 15.13 **Description** A stored cross-site scripting issue exists in the Classification Rules configuration. Authenticated attackers can inject arbitrary web script or HTML through the `/Archiver/CategorizationPolicyWizard.aspx` endpoint using the `rule name` and `email criteria` parameters. The payload is stored by the `SaveAllConfigSettings()` function without proper output encoding and is executed in the browsers of users who view the Classification Rules page. **Recommendations** Update GFI Archiver to version 15.13 or later.