Numberoreo1

n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 bundles a GraphicsMagick version with known vulnerabilities in its official Docker image, which the Edit Image node uses to process images. Attackers who can supply crafted untrusted images to an Edit Image workflow, such as one fed by a Webhook node, can execute code on the n8n instance.

n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected JavaScript properties to execute arbitrary code on the n8n host.

A low-privileged user can create manual reminders containing arbitrary HTML or JavaScript and assign them to other users, including administrators. When the victim's browser polls for pending notifications, the payload is rendered unsanitized as innerHTML within the ExtJS notification panel. This results in Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the server and executed in the victim's browser, which can lead to a full Account Takeover (ATO) of the victim's session.

An authenticated user can execute arbitrary operating system commands as the web server user (www-data) via a single HTTP request. The issue exists in the Contact/labels JMAP endpoint, which accepts a template string through the `tpl` parameter and passes it to the `TemplateParser::parse()` function. When the template includes an [assign] block with a `{{...}}` variable reference, the engine executes `eval()` on the expanded expression. Although a `validateExpression()` guard is used, PHP 7+ allows strings enclosed in parentheses to be invoked as functions, bypassing the guard and enabling remote code execution.

A reflected cross-site scripting issue exists in the backend packages API. The problem occurs because a function parameter is concatenated into an error message that is rendered without HTML escaping. This allows an attacker to trick an authenticated backend user into clicking a crafted link containing a valid CSRF token to execute JavaScript, which can then perform same-origin actions or read DOM data.

Authenticated attackers can perform a reflected cross-site scripting attack by injecting scripts through the `type` parameter of the 'metainfo default fields create' API. This occurs because the `rex view::message()` function renders the HTML payload unescaped, allowing the execution of scripts within a victim's backend session when they follow a crafted link containing a valid CSRF token.

Group-Office is a customer relationship management and groupware tool. A reflected cross-site scripting (XSS) issue exists in the GroupOffice installer at the `install/license.php` endpoint. The `license` POST parameter is rendered without proper escaping within a `<textarea>` element, enabling a `</textarea><script>...</script>` breakout.

Group-Office is a customer relationship management and groupware tool. A reflected cross-site scripting (XSS) issue exists in the external/index flow. The `f` parameter, which contains Base64 encoded JSON data, is decoded and injected into an inline JavaScript block without proper sanitization. This allows for the injection of `<script>` tags and the execution of arbitrary JavaScript code in a user's browser. The vulnerable parameter is `f`.

The software has a SQL Injection issue that can be exploited through the `advancedQueryData` parameter, specifically the `comparator` field, on an authenticated endpoint. The `index.php?r=email/template/emailSelection` endpoint processes the `advancedQueryData` parameter and incorporates the SQL comparator directly into SQL condition building without proper validation. This allows for blind boolean-based exfiltration of the `core auth password` table.

Group-Office is a customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 contain a flaw that allows for authenticated Remote Code Execution through the processing of TNEF attachments. The issue arises because the software extracts files from `winmail.dat` which are controlled by an attacker. The `zip` command is then invoked with a shell wildcard (`*`), allowing attackers to manipulate filenames to execute arbitrary commands.

Group-Office is a customer relationship management and groupware tool susceptible to remote code execution (RCE). The `/email/message/tnefAttachmentFromTempFile` endpoint directly incorporates the user-controlled `tmp file` parameter into an `exec()` function call. An authenticated attacker can inject shell metacharacters into the `tmp file` parameter, enabling the execution of arbitrary system commands on the server.

Group-Office is a customer relationship management and groupware tool. The `MaintenanceController` includes a `zipLanguage` action that uses a `lang` parameter directly in a system zip command via the `exec()` function. This can be exploited by uploading a specially crafted zip file, leading to remote code execution. The `lang` parameter is not properly filtered, allowing for command injection.