Allan Njuguna

A path traversal issue exists in the `path.join` function within the `/src/main/core/createParsedTrack.ts` file. This flaw allows a local attacker to manipulate file paths to access unauthorized locations on the system.

A remote SQL injection is possible due to improper handling of the `conn settings` argument within the `setSync()` function of the '/ajax/add project.php' endpoint. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database.

A code injection flaw exists within the Python Validation Handler component, specifically affecting an unknown function in the `/code` file. This issue allows for remote exploitation, enabling an attacker to inject and execute arbitrary code.

A flaw exists in pmTicket Project-Management-Software related to the deserialization of data. The issue is located in the `loadLanguage` function within the `classes/class.database.php` file, part of the Cookie Handler component. Manipulation of the `user id` argument can trigger this deserialization. The attack can be performed remotely. The exploit is publicly available. The software uses continuous delivery with rolling releases, and the vendor did not respond to early disclosure attempts.

A critical issue exists in pmTicket Project-Management-Software. The `getUserLanguage` function within the `classes/class.database.php` file is susceptible to SQL injection due to manipulation of the `user id` argument. This allows for remote exploitation. The vendor was contacted regarding this disclosure but did not respond.

A critical issue affects an unknown functionality of the file /goform/goform get cmd process of the component SMS Check. The manipulation of the `order by` argument leads to SQL injection. This issue can be exploited remotely. The vendor was contacted about this disclosure but did not respond.

A critical issue has been identified, affecting the Ping Tool component, specifically the /goform/goform get cmd process file. The `url` argument is vulnerable to os command injection, which can be exploited remotely. The issue has been publicly disclosed.