Kuninogu

Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user.

Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed.

A stored cross-site scripting issue exists involving custom content descriptions. This flaw allows an arbitrary script to be executed within the web browser of a user who views the affected content.

When converting baserCMS4-style addons to baserCMS5-style ones, the `BcAddonMigrator` function includes the "config.php" file from the addon, leading to the execution of the PHP code contained within that file. This allows an administrative user to read or delete arbitrary files on the system.

WebSocket destination paths are not properly validated against the configured rewrite prefix. The `WebSocketProxy.findUpstream()` function resolves destinations using the WHATWG URL constructor, which collapses dot segments. This allows a crafted upgrade request containing path traversal sequences to bypass the rewrite prefix and access upstream endpoints that should not be exposed. This issue is exploitable via non-normalizing WebSocket clients, such as raw HTTP clients or downstream proxies that forward the request target without modification, as standard browsers and the `ws` package normalize paths before transmission.