Oscar Naveda

**Name of the Vulnerable Software and Affected Versions** Directus versions prior to 12.1.0 **Description** An authenticated SQL injection exists in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can exploit this by creating a collection with a geometry field where the `fields[].type` value begins with geometry but includes malicious SQL syntax following the geometry subtype. **Recommendations** Update to version 12.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** Zammad version 7.1.0 **Description** An authenticated improper authorization issue exists in the ticket article attachment cloning endpoint. Improper authorization occurs when a system fails to properly verify if a user has the necessary permissions to perform a specific action, potentially allowing an authenticated user to clone attachments they should not have access to. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PayloadCMS version 3.84.1 **Description** An improper authorization issue exists due to insufficient access control on the account unlock operation, which allows an authenticated user to bypass account lockout. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Akaunting version 3.1.21 **Description** An authenticated stored cross-site scripting issue exists in the reusable delete confirmation flow. A user with permissions to create or modify records, such as Items, can inject HTML or JavaScript into the record name. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Akaunting version 3.1.21 **Description** An authenticated stored Cross-Site Scripting (XSS) issue exists in the report management workflow. A user with permissions to create or update reports can inject arbitrary HTML or JavaScript into the `description` field of a report. Cross-Site Scripting is a flaw that allows an attacker to execute malicious scripts in the browser of another user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Akaunting version 3.1.21 **Description** An authenticated stored cross-site scripting (XSS) issue exists in the document timeline displayed on invoice and bill detail pages. This occurs when an authenticated user stores malicious HTML or JavaScript within their profile name. **Recommendations** Update Akaunting to a version newer than 3.1.21.

**Name of the Vulnerable Software and Affected Versions** Plane CE version 1.3.1 **Description** A low-privileged project member can submit arbitrary HTML and JavaScript via the `description html` field. This occurs when creating an intake work item through the 'API v1 intake' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Camaleon CMS version 2.9.2 **Description** Improper authorization in the administrator draft autosave endpoint allows a low-privileged authenticated user to overwrite a draft associated with another user's post. This is achieved by sending an arbitrary `post id` to the 'POST /admin/post type/<POST TYPE ID>/drafts' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ERPNext version 16.16.0 **Description** An authenticated user can persist arbitrary HTML or JavaScript within the `email id` or `mobile no` fields of a Customer record. This leads to unescaped rendering in the Point of Sale (POS) interface for any operator who selects the affected customer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ERPNext version 16.16.0 **Description** An authenticated user with permissions to edit Item records can inject arbitrary HTML or JavaScript into the `item name`, `description`, or `image` fields of an Item. This leads to unescaped rendering in the Point of Sale (POS) cart interface for any operator who adds the affected item to a transaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mailcow-dockerized version 2026-03b **Description** A stored cross-site scripting issue exists in the administrator Queue Manager. The Queue Manager retrieves mail queue entries from the endpoint '/api/v1/get/mailq/all' and copies server-controlled Postfix queue fields into DataTables rows. Several of these fields are rendered as HTML without adequate output encoding, allowing for the execution of malicious scripts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pimcore version 12.3.3 **Description** An authenticated administrative user with permissions to import or save DataObject class definitions can inject malicious composite index metadata. This action allows the execution of unintended SQL commands in the backend, leading to a SQL injection, which is a technique where an attacker inserts malicious SQL code into a query to manipulate a database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pimcore version 12.3.3 **Description** An authenticated attacker with permissions to edit document content can store crafted HTML or JavaScript within a Document embed editable. This leads to script execution when the published page is rendered, a process known as Stored Cross-Site Scripting (XSS), where malicious scripts are permanently stored on the target server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.