Hadhub

**Name of the Vulnerable Software and Affected Versions** Mercator versions prior to 2025.05.19 **Description** The Query Engine allows authenticated users to execute queries via a JSON DSL (Domain Specific Language), which is a specialized language used to define data queries. The controller method `QueryController::execute()` lacks an authorization gate, enabling any authenticated account, including those with read-only Auditor roles, to query models outside their intended scope, such as the `User` model. Furthermore, the `password` column is not excluded from filter predicates, allowing it to be used in `LIKE` conditions. The endpoints '/admin/queries/execute', '/schema()', and '/schemaModel()' are affected. This issue is read-only and does not impact data integrity or availability. **Recommendations** Update to version 2025.05.19. As a temporary workaround, restrict access to the '/admin/queries/execute', '/schema()', and '/schemaModel()' endpoints.

**Name of the Vulnerable Software and Affected Versions** Mercator versions prior to 2025.05.19 **Description** A Server-Side Request Forgery (SSRF) exists in the CVE configuration panel at the '/admin/config/parameters' endpoint. The `testProvider()` method in `ConfigurationController` passes user-supplied input to `curl init()` without validating the scheme, hostname, or destination IP address. An authenticated user with the `configure` permission can force the server to issue arbitrary outbound network requests. The suffix '/api/dbInfo' appended to the URL can be bypassed by injecting a `#` fragment character, granting full control over the target URL. There is no scheme whitelist, host whitelist, or private/loopback IP block. The `telnet://` scheme allows internal port scanning, and the `gopher://` scheme enables interaction with unauthenticated internal services like Redis or Memcached, which may lead to Remote Code Execution (the ability to execute arbitrary commands on the host machine) under specific deployment conditions. **Recommendations** Update to version 2025.05.19.

**Name of the Vulnerable Software and Affected Versions** Mercator versions prior to 2026.02.22 **Description** Mercator is a web application for mapping information systems. A stored Cross-Site Scripting (XSS) issue exists because of the use of unescaped Blade directives (`{!! !!}`) in display templates. An authenticated user with the User role can inject JavaScript payloads into fields like "contact point" when creating or editing entities. This injected code executes in the browsers of users viewing the affected page, potentially including administrators. The vulnerable component uses unescaped Blade directives, which allow for the execution of arbitrary code within the application's context. **Recommendations** Update to version 2026.02.22 or later.