Offensiveee

The Livewire component `ServerResources` exposes public methods `startUnmanaged()`, `stopUnmanaged()`, and `restartUnmanaged()` that accept a container ID parameter directly from the browser without sanitization or escaping. This parameter is interpolated into shell commands executed via SSH on managed servers, allowing authenticated team members to execute arbitrary OS commands on remote servers.

An information disclosure issue exists in the open source photo gallery application where the 'pwg.history.search' API method is registered without the `admin only` option. This allows unauthenticated users to access the complete browsing history of all gallery visitors.

Lychee is a free, open-source photo-management tool. A flaw exists in the IP validation check within the patch for an SSRF issue related to `Photo::fromUrl`. This incomplete check fails to block loopback and link-local addresses. Before version 7.5.1, an authenticated user could access internal services using direct IP addresses, bypassing all four protection configurations, even with secure default settings.

FreeScout is a help desk and shared inbox application built with the Laravel PHP framework. A broken access control issue exists in the `ThreadPolicy::edit()` method. This allows any authenticated user, regardless of their role or mailbox access, to read and modify all customer-created thread messages across all mailboxes. This flaw enables silent modification of customer messages and bypasses the entire mailbox permission model, potentially leading to GDPR compliance violations. The `ThreadPolicy::edit()` function is vulnerable to unauthorized access. The vulnerable parameter is not specified.

The /objects/encryptPass.json.php endpoint in WWBN AVideo exposes the application's password hashing algorithm to any unauthenticated user. An attacker can submit arbitrary passwords and receive their hashed equivalents, enabling offline password cracking against leaked database hashes. The `encryptPassword()` function uses a weak hash chain (md5+whirlpool+sha1, no salt by default), making password cracking extremely fast with access to database hashes. The vulnerable file is `objects/encryptPass.json.php`, and the vulnerable function is `encryptPassword()`. The `encryptPassword()` function is located in `objects/functions.php` around line 2101. The vulnerable parameter is `pass` in the API endpoint `/objects/encryptPass.json.php`.

AVideo, an open source video platform, has an issue where the `/objects/phpsessionid.json.php` endpoint exposes the current PHP session ID to any unauthenticated request. The `allowOrigin()` function reflects any `Origin` header back in `Access-Control-Allow-Origin` with `Access-Control-Allow-Credentials: true`, which enables cross-origin session theft and full account takeover. An attacker can host a malicious page that, when visited by a logged-in AVideo user, steals their PHP session ID due to the permissive CORS policy. This allows the attacker to impersonate the user with full privileges. The vulnerable file is `objects/phpsessionid.json.php`, and the vulnerable function is `allowOrigin()`. The `allowOrigin()` function is located in `objects/functions.php` (line ~2648). The vulnerability allows an attacker to make a credentialed cross-origin request and read the session ID.

Portainer includes a security setting to disable bind mounts for non-administrators, intended to prevent regular users from binding host paths into containers via the Portainer-mediated Docker API. However, the enforcement mechanism only inspected the `HostConfig.Binds` array and ignored the equivalent `HostConfig.Mounts` array. Since both fields are interchangeable on the Docker daemon, an authenticated user with container-creation rights can bypass this restriction by submitting a `bind`-typed entry under `HostConfig.Mounts` at the 'POST /containers/create' endpoint. This allows the user to mount any host path into their container, potentially gaining read or write access to the host filesystem as the Docker daemon user (typically `root`). This can lead to the exposure of sensitive files, compromise of other containers on the same host, or full Docker API access if the Docker socket is mounted.