Evil0Rd

A stored cross-site scripting issue exists where authenticated users with `post.create` or `post.edit` permissions can inject scripts through unsanitized LaraBuilder `design json` block content. This occurs when attackers save text-editor, HTML, text, or heading blocks containing script or event-handler markup, which then executes within the sessions of administrators or Superadmins when they view the builder, preview, or page.

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing commands with the privileges of the deployment runner.

An improper authorization issue allows authenticated users who possess only the read-only `email template.view` permission to send arbitrary emails. By minting an MCP token, an attacker can utilize the MCP send-email tool to specify any recipient, subject, and raw HTML body, enabling the delivery of phishing or spam messages through the site's mailer.

An incorrect authorization issue exists in the `manageCoreUpgrades()` function within `SettingPolicy`. This allows administrators who possess the `settings.edit` permission, but are not Superadmins, to perform core-upgrade operations reserved for Superadmins. By interacting with the '/admin/settings/core-upgrades' endpoint, an attacker can execute backup, download, restore, and upgrade actions, potentially leading to the acquisition of database dumps containing password hashes or unauthorized site restoration and upgrades.

Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner and fail to remove them after execution. A local attacker with access to the CI environment can retrieve these credentials to obtain unauthorized access to the repository, which could lead to the modification of source code or release artifacts.

A flaw allows an attacker with repository write access to achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. The issue occurs when shell commands are injected into environment export scripts, causing manifest synchronization scripts to dynamically evaluate unvalidated script output. This can lead to the compromise of CI/CD pipelines, theft of sensitive authentication tokens and deployment credentials, and unauthorized access to production systems.

An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the injection of malicious filter commands. This can lead to the exposure of sensitive information, such as API credentials, deployment keys, and internal notes returned from repository queries, within the workflow logs.

A remote cross site scripting issue exists within the Private Message Handler component. The problem occurs in the `index()` function located in the `templates/default/controllers/messages/index.tpl.php` file. An attacker can exploit this by manipulating the `nickname` argument to execute malicious scripts in the user's browser.

A path traversal issue exists in the Image Handler component within the `files delete file()` function of the `system/fields/image.php` file. A remote attacker can exploit this by manipulating the `size` argument, allowing them to access or delete files outside the intended directory.

An issue exists in the Billing Module within the `validatePaypalOrder()` function located in the system/controllers/billing/actions/paypal.php file. A remote attacker can manipulate the `bid`/`sig` arguments, leading to insufficient verification of data authenticity.

A privilege escalation issue exists where attackers possessing an API token can obtain a full session token. This occurs because the `TokenRefreshHandler` function fails to verify the token type, allowing short-lived or IP-restricted API tokens to be exchanged for 30-day normal session tokens. This process bypasses API token expiry and allowlists via the '/api/v1/tokens/refresh.json' endpoint.

A path traversal issue allows unauthenticated attackers to read JSON files by manipulating the `{lang}` route segment. On Windows hosts, attackers can use URL-encoded backslash sequences such as `..%5C` to escape the `resources/lang` directory and access `composer.json` or other application JSON files. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder.

Improper privilege management allows authenticated Admin users to escalate their privileges to Superadmin by editing or renaming roles. An attacker possessing the `role.edit` permission can rename their own role to Superadmin or grant themselves `user.login as` permissions. This allows for account takeover and access to core upgrade and module installation functions, which can lead to remote code execution.

Unauthenticated users can trigger DNS lookups and paid AbstractAPI verification calls by submitting arbitrary addresses to the forgot-password and reset-password requests. This can lead to the exhaustion of the verification quota, causing validation to fail open for all public forms and allowing for domain resolution probing.

An open redirect issue exists where remote attackers can redirect users to external phishing sites. This occurs when an unvalidated `redirect url` parameter is supplied to the `builder` and `builderEdit` endpoints of the `EmailTemplateController`. Logged-in users with email template permissions may be affected if they interact with crafted builder links and save a template.

An incorrect authorization issue allows authenticated users possessing only the `settings.view` permission to access stored secrets via the settings API. By querying the endpoints 'GET /api/settings' or 'GET /api/settings/{option name}', an attacker can retrieve plaintext passwords, tokens, mail credentials, and AI provider API keys.

A race condition exists in the `RegisterController::register` function. This allows unauthenticated attackers to bypass the daily registration limit per IP address by sending multiple concurrent registration requests. Because these requests can all pass the `RegistrationGuardService::hasExceededIpLimit` check before the `recordRegistration` function executes, attackers can create accounts in bulk, effectively defeating anti-automation controls.

The software renders notebook names as raw HTML in the Daily Note picker dialog without proper escaping. This leads to stored cross-site scripting (XSS) within the Electron renderer. An attacker can create a notebook with a name containing HTML payloads that execute JavaScript with Node.js access when the picker is opened, potentially allowing the execution of operating system commands.

Insufficient publish access control in the 'getDynamicIcon' endpoint allows users with read-only tokens to access document metadata. By calling this endpoint with the `type` parameter set to 8 and providing crafted content, an attacker can perform template injection to retrieve block titles, names, aliases, and hierarchical paths of restricted documents.

Stored cross-site scripting occurs because the software fails to escape heading style attributes when rendering HTML for the outline and bookmark dock. Attackers can inject malicious style values by providing crafted notebooks or calling administrative endpoints. These values execute within the Electron renderer, potentially granting full system access.