Alex Williams

**Name of the Vulnerable Software and Affected Versions** Satel Netco Design versions prior to 2.1.7 **Description** A relative path traversal issue exists in the data import functionality. This allows an authenticated user with Viewer privileges to access file paths outside the intended directory and use observable application responses to verify the existence of files on the host system. **Recommendations** Update Satel Netco Design to version 2.1.7 or later.

Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operator privileges could store untrusted content that is rendered without adequate neutralization. Successful exploitation could allow script execution in another user's browser when the affected content is viewed.

**Name of the Vulnerable Software and Affected Versions** Satel Netco Design versions prior to 2.1.7 **Description** An inefficient regular expression complexity issue exists where an authenticated user with Viewer privileges can submit crafted search input. This leads to excessive processing, which may degrade the availability of the application. **Recommendations** Update Satel Netco Design to version 2.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** Satel Netco Design versions prior to 2.1.7 **Description** A relative path traversal issue exists in the data export functionality. This allows an authenticated user with Viewer privileges to write attacker-influenced content to file system locations accessible to the application service. This could lead to unauthorized file creation or modification and, in some cases, arbitrary code execution. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** Update Satel Netco Design to version 2.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** DIAEnergie versions prior to 1.11.00.022 **Description** An authorization bypass exists due to the use of a user-controlled key. **Recommendations** Update to version 1.11.00.022 or later.

**Name of the Vulnerable Software and Affected Versions** DIAEnergie versions prior to 1.11.00.022 **Description** Improper Access Control allows unauthorized access or modification of resources within the system. **Recommendations** Update to version 1.11.00.022 or later.

**Name of the Vulnerable Software and Affected Versions** DIAEnergie versions prior to 1.11.00.022 **Description** Improper Authentication in the software allows an attacker to perform an Authentication Bypass, which occurs when an application fails to properly verify the identity of a user or process. **Recommendations** Update to version 1.11.00.022 or later.

**Name of the Vulnerable Software and Affected Versions** DIAEnergie versions prior to 1.11.00.022 **Description** Path Traversal in DIAEnergie. Path Traversal is a vulnerability that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables that reference files with filenames on a web server. **Recommendations** Update DIAEnergie to version 1.11.00.022 or later.

**Name of the Vulnerable Software and Affected Versions** DIAEnergie versions prior to 1.11.00.022 **Description** SQL Injection in DIAEnergie. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database. **Recommendations** Update to version 1.11.00.022 or later.

**Name of the Vulnerable Software and Affected Versions** DIAEnergie versions prior to 1.11.00.022 **Description** SQL Injection in DIAEnergie. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database. **Recommendations** Update to version 1.11.00.022 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Exinda AI versions prior to 7.6.5 GFI ClearView versions prior to 7.6.5 **Description** A path traversal issue exists in the system maintenance configuration download handler. The `wcf handle download()` function fails to sanitize parameters prefixed with `v del ` before appending them to the base configuration directory path. This allows an authenticated attacker with Admin privileges to read arbitrary files from the system with root permissions. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** Update GFI Exinda AI to version 7.6.5 or later. Update GFI ClearView to version 7.6.5 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Exinda AI versions prior to 7.6.5 GFI ClearView versions prior to 7.6.5 **Description** An argument injection issue exists in the Tools Iperf Client functionality. The `web tools cmd()` function constructs an iperf command using the `server` and `options` parameters without proper sanitization, allowing the injection of arbitrary iperf flags. An authenticated attacker with unprivileged access can use the `-F` flag to read arbitrary files from the system and transmit the contents to an external server. **Recommendations** Update GFI Exinda AI to version 7.6.5 or later. Update GFI ClearView to version 7.6.5 or later.

**Name of the Vulnerable Software and Affected Versions** GFI Exinda AI versions prior to 7.6.5 GFI ClearView versions prior to 7.6.5 **Description** A path traversal issue exists in the diagnostic file deletion handler. The `unlink or email file()` function processes parameters prefixed with `v file row ` and appends their values to a base directory path without sanitizing for directory traversal sequences. This allows an authenticated attacker with Admin privileges to delete arbitrary files from the system with root permissions. **Recommendations** Update GFI Exinda AI to version 7.6.5 or later. Update GFI ClearView to version 7.6.5 or later.

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall rules edit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered without encoding in the firewall log table in /status logs filter.php. The payload executes in the browser of any user with the Status: Logs: Firewall privilege who views the affected log entries.

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval are concatenated and written to the global pfSense XML configuration without sanitization, then echoed unsanitized into a JavaScript string context on page render. Because the setting is stored in the global configuration, the payload executes in the browser of every user who visits the Status: Monitoring page.

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall schedule edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.3.0 **Description** A cross-site request forgery issue exists in the DICOM viewer. The `web path` GET parameter in the DICOM viewer page is embedded as a URL without proper sanitization or validation against expected path formats. This allows an attacker to craft a URL that forces an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, which can lead to forced logout and other state-changing actions. **Recommendations** Update to version 8.3.0 or later. Avoid using the `web path` parameter in the DICOM viewer page until the update is applied.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.3.0 **Description** A path traversal issue exists in the EDI archive restore function. The `archrestore sel` POST parameter is processed by the archive restore handler without proper sanitization for path traversal sequences. This allows an authenticated user with EOB Data Entry permissions to probe arbitrary filesystem paths on the server. The system leaks information about the existence of target files through differing response messages. **Recommendations** Update to version 8.3.0 or later. Restrict the use of the `archrestore sel` parameter in the EDI archive restore function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.3.0 **Description** A reflected cross-site scripting issue exists in the patient portal template import handler. The `templateHtml` GET parameter is reflected in the page response without proper sanitization. This allows an attacker to craft a URL that executes arbitrary JavaScript in the browser of authenticated users with Forms Administration permissions, which can lead to session hijacking. **Recommendations** Update to version 8.3.0 or later. Avoid using the `templateHtml` parameter in the patient portal template import handler until the update is applied.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.3.0 **Description** A stored cross-site scripting issue exists in the patient portal template import handler. Authenticated attackers with Forms Administration permissions can upload template files containing arbitrary HTML or JavaScript. These malicious scripts are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor. **Recommendations** Update to version 8.3.0 or later.