Célistine Oosting

The issue allows an authenticated administrator to craft an alert that can execute a Server-Side Request Forgery (SSRF) attack, but only with POST requests.

The issue allows an attacker to launch a Reflected XSS attack using a crafted URL. This type of attack occurs when an application takes user input and reflects it back to the user without proper validation or encoding, allowing an attacker to inject malicious code.

The issue allows an authenticated administrator to remotely execute arbitrary shell commands via the API. This could potentially lead to unauthorized access and control of the system.

The issue allows local users to execute scripts under root privileges. This means that users with local access can potentially run commands or scripts with elevated privileges, posing a significant security risk.

The issue allows an authenticated attacker to create alerts that trigger a stored XSS attack. This means an attacker with authentication credentials can create malicious alerts that, when triggered, execute malicious scripts stored on the victim's browser, potentially leading to unauthorized actions or data theft.

An issue allows an administrator to execute commands as root via the alerts management dialog.