Michael Tsai

The issue allows attackers to access sensitive information in the "/facade" directory.

The issue allows attackers to execute arbitrary code via uploading a crafted .cfm file to the /fileupload/upload.cfm endpoint.

An argument injection issue allows remote attackers to read and write to arbitrary files via a crafted URL when the `verify url` option is disabled, potentially leading to code execution. This occurs because the generate and process features mishandle the use of the ImageMagick convert utility.

Name of the Vulnerable Software and Affected Versions: symbiote/silverstripe-queuedjobs module versions 3 through 4 Description: A Cross Site Scripting issue allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL. This is achieved by exploiting the `CreateQueuedJobTask` dev task. Recommendations: For versions 3 through 4, consider disabling the `CreateQueuedJobTask` dev task until a patch is available to prevent exploitation. Restrict access to the dev task to minimize the risk of arbitrary payload injection.