Joshua Martinelle

The ClientIPFromXFF middleware in the Golang Chi web framework fails to verify if the direct TCP peer in `http.Request.RemoteAddr` belongs to the configured trusted CIDR. While the middleware skips X-Forwarded-For entries within a trusted CIDR, the lack of peer verification allows a client with direct access to the server to append a spoofed proxy address. This enables the client to manipulate the IP address returned by the `GetClientIP()` function.

A configuration flaw in the official Docker images allows an unauthenticated remote attacker to impersonate any user, including administrators, by spoofing the `X-WEBAUTH-USER` header. This occurs because the `app.ini` template hard-codes the `REVERSE PROXY TRUSTED PROXIES` variable to a wildcard (`*`), causing the application to trust identity headers from any source IP address instead of only trusted loopback addresses. This issue is exploitable when reverse-proxy authentication is enabled. It is estimated that approximately 22,900 unique Gitea hosts are accessible from the internet, with 83% potentially affected. Real-world reconnaissance and exploitation attempts were detected within 13 days of public disclosure. The flaw allows access to repositories, CI/CD secrets, SSH keys, and administrative functions via the web interface, although the token-based API endpoints (e.g., `/api/v1/...`) are not affected.

The issue is an authenticated SQL injection vulnerability in the `orderby` parameter in the "/pm/v2/activites" API endpoint. This vulnerability affects the 'Project Manager' WordPress Plugin.

The issue is related to a Stored Cross-Site vulnerability due to a lack of input sanitization.

Name of the Vulnerable Software and Affected Versions: Flowise version 1.8.2 Description: An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise, leading to a complete crash of the instance running a vulnerable version due to improper handling of user-supplied input to the "/api/v1/get-upload-file" API endpoint. Recommendations: For Flowise version 1.8.2, as a temporary workaround, consider restricting access to the "/api/v1/get-upload-file" API endpoint until a patch is available. Additionally, avoid using this endpoint with untrusted user input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A stored cross site scripting issue exists due to improperly decoded user input. This allows for the storage and subsequent execution of malicious scripts, potentially leading to unauthorized actions on behalf of the user.

The issue allows a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the "/api/v1/users" endpoint.

The issue is related to a Cross-Site Scripting (XSS) vulnerability. This vulnerability is caused by the lack of sanitization of the `notice id` GET parameter.

The issue is related to a Stored Cross-Site Scripting vulnerability in the order tracking URL.

The issue is related to a Server-Side Request Forgery (SSRF) that can be exploited via the "/v1/avatars/favicon" endpoint. This is due to an incomplete fix of a previously identified issue.

The issue is an unauthenticated SQL injection vulnerability. It affects the `id` parameter in the `get view` function.

The issue is related to an unauthenticated SQL injection vulnerability. This vulnerability is present in the `from` and `to` parameters in the "/my-calendar/v1/events" rest route. It allows a remote attacker to execute arbitrary SQL queries to the database.

A post-authentication stored cross-site scripting issue exists, allowing HTML, including script tags, to be injected into field names. This injection triggers when users visit the Categories or Entries pages after the field is added to a category or section.

The issue is a reflected cross-site scripting vulnerability in the `tax name` parameter of the mdf get tax options in widget action. This can only be triggered by an authenticated user.

The issue is related to an unauthenticated insecure deserialization problem. The `tve labels` parameter of the `tve api form submit` action is passed to the PHP `unserialize()` function without proper sanitization or verification. This could lead to PHP object injection, which, when combined with specific class implementations or gadget chains, and a POP chain, could be used to perform various malicious actions.

The issue is an authenticated SQL injection vulnerability. It affects the `value` parameter in the `get popup data` action.

The issue is an authenticated SQL injection vulnerability. It affects the `search name` parameter in the `eme recurrences list` action.

The issue is related to an unauthenticated insecure deserialization problem. An attacker could exploit this to call files using a PHAR wrapper, which deserializes data and calls arbitrary PHP Objects. This can be used for malicious actions if a POP chain is also present.

The issue is related to an authenticated SQL injection vulnerability in the `lwp forgot password` action. Specifically, the vulnerability is associated with the lack of protection measures for the SQL query structure, which can be exploited by a remote attacker to execute arbitrary code. The `ID` parameter of the `lwp forgot password` action is vulnerable.

The issue is related to a reflected cross-site scripting vulnerability. It affects the `category` parameter of the `qem ajax calendar` action. This vulnerability can be exploited by a remote attacker to conduct a cross-site scripting (XSS) attack, potentially due to insufficient protection of the webpage structure.