Andrea Intilangelo

Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.

**Name of the Vulnerable Software and Affected Versions** Konga versions prior to 2.1.0 **Description** A privilege escalation issue allows low-privileged local attackers to execute arbitrary code. This is achieved by placing attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path that is not present in default installations. On Windows systems, the missing directory is located in a path writable by any authenticated local user, allowing them to create the directory and insert malicious files. These files then execute with the privileges of the user or service account that starts Konga. **Recommendations** Update to version 2.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** FirmaCheck for Windows versions prior to 1.3.16 **Description** A DLL hijacking issue exists where local attackers can execute arbitrary code. This occurs by placing a crafted `openssl.cnf` file in the unvalidated `C:Program Files (x86)Common FilesSSL` directory path. By writing a malicious OpenSSL configuration file that references an attacker-controlled DLL, code execution can be achieved at the startup process privilege level when `FirmaCheck.exe` runs automatically during system startup. **Recommendations** Update FirmaCheck for Windows to version 1.3.16 or later.

**Name of the Vulnerable Software and Affected Versions** ArubaSign versions prior to 4.6.6 **Description** Incorrect default permissions are assigned during the installation of the software. The main executable and other program files located in "C:Program Files" have excessive permissions for the 'Everyone' group. This allows an unprivileged user to replace the main executable or its components with a malicious file to execute arbitrary code. If the malicious code runs with elevated privileges, such as Administrator or SYSTEM, it can lead to privilege escalation and full system control. **Recommendations** Update to version 4.6.6 or later.

**Name of the Vulnerable Software and Affected Versions** Rapid7 Metasploit Pro (affected versions not specified) **Description** Rapid7 Metasploit Pro on Windows is subject to a local privilege escalation. During startup, the `metasploitPostgreSQL` service and the subsequent `postgres.exe` service attempt to load an OpenSSL configuration file from a non-existent directory that standard users can write to. An attacker can place a crafted `openssl.cnf` file in that location to trick the high-privilege service into executing arbitrary commands, allowing an unprivileged user to gain SYSTEM level control of the host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Devs Palace ERP Online versions prior to 4.0.0 **Description** A cross-site scripting issue exists in the `/accounts/mr-save` file. This flaw allows a remote attacker to execute malicious scripts through the manipulation of unknown code within that file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Devs Palace ERP Online versions prior to 4.0.0 **Description** A remote cross-site scripting issue exists in the file '/accounts/chart-save'. This allows an attacker to execute malicious scripts in the victim's browser. **Recommendations** As a temporary workaround, restrict access to the '/accounts/chart-save' file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Devs Palace ERP Online versions prior to 4.0.0 **Description** A cross-site scripting issue exists in the '/inventory/add new customer' file. This flaw allows a remote attacker to initiate an attack via manipulation of the affected file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Devs Palace ERP Online versions prior to 4.0.0 **Description** A cross-site scripting issue exists in the `/inventory/supplier-save` file. This flaw allows remote exploitation through the manipulation of an unknown function within that file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Devs Palace ERP Online versions prior to 4.0.0 **Description** A cross-site scripting issue exists in the '/inventory/sales save' file. This flaw allows a remote attacker to execute malicious scripts via the manipulation of unknown functionality within that file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Devs Palace ERP Online versions prior to 4.0.0 **Description** A cross-site scripting issue exists in the '/inventory/purchase save' file. This flaw allows a remote attacker to execute malicious scripts by manipulating an unknown functionality within that file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Devs Palace ERP Online versions prior to 4.0.0 **Description** A flaw in the file '/inventory/item-save' allows for remote cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Devs Palace ERP Online versions prior to 4.0.0 **Description** A cross-site scripting issue exists in the file '/inventory/customer-save'. This flaw allows a remote attacker to execute malicious scripts through the manipulation of an unspecified function within that file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Devs Palace ERP Online versions prior to 4.0.0 **Description** A weakness in an unknown function within the '/inventory/purchase return save' file allows for remote cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/inventory/purchase return save' file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WebSystems WebTOTUM 2026 **Description** A flaw in the Calendar component allows for remote cross site scripting, which occurs when a malicious script is injected into a trusted website and executed in the victim's browser. **Recommendations** Upgrade the Calendar component to the fixed version.

**Name of the Vulnerable Software and Affected Versions** ERP Online versions prior to 4.0.0 **Description** A cross site scripting flaw exists in the Inventory Edit Item Page component. Remote attackers can exploit this by manipulating the `Item Name` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TotalAV version 5.15.69 **Description** TotalAV version 5.15.69 contains an unquoted service path issue in multiple system services running with LocalSystem privileges. An attacker can place malicious executables in specific unquoted path segments, potentially gaining SYSTEM-level access by exploiting the service path configuration. **Recommendations** Ensure service paths are properly quoted to prevent the placement of malicious executables.

**Name of the Vulnerable Software and Affected Versions** Energy CRM version 2025 **Description** A stored Cross-Site Scripting (XSS) issue exists due to insufficient validation of user-supplied data. A remote user can exploit this by sending a POST request to the `/crm/create job submit.php` endpoint, specifically utilizing the `JobCreatedBy` parameter. Successful exploitation could allow an attacker to steal the cookie session details of an authenticated user. **Recommendations** Ensure proper validation of user input for the `JobCreatedBy` parameter in the `/crm/create job submit.php` endpoint.

**Name of the Vulnerable Software and Affected Versions** Energy CRM version 2025 **Description** A stored Cross-Site Scripting (XSS) issue exists due to insufficient validation of user-supplied data. A remote user can potentially send a malicious query to an authenticated user, potentially leading to the theft of cookie session details. The issue is triggered by submitting a POST request to the ''/crm/create invoice submit.php'' endpoint, specifically utilizing the `customerName 0` parameter. **Recommendations** Apply input validation and sanitization to the `customerName 0` parameter in the ''/crm/create invoice submit.php'' endpoint.

**Name of the Vulnerable Software and Affected Versions** Viday (affected versions not specified) **Description** The software exhibits a flaw that could allow an attacker to obtain sensitive customer information. This is achieved by intercepting HTTP requests and locating JWTs within the request payload. The JWTs contain sensitive user information, potentially exposing it to unauthorized access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.