Pavelkohout396

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.

Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can read plaintext encrypted custom field values by opening asset forms, bypassing the assets.view.encrypted custom fields permission check.

Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (AppLivewireImporter, mounted at the imports.index route). The component only checked the broad 'import' ability at mount time, while its files() and activeFile() computed properties queried the imports table with no owner or company scope. As a result, any authenticated non-superuser holding the import permission could view every Import record on the instance (original filename, file path, filesize, import type and creation timestamp) and could invoke the selectFile($id) Livewire action with any auto-incrementing Import ID to load another user's record, exposing its stored preview data (header row column headers and first row, the first data row of the CSV). Because import CSVs commonly contain personal data, asset serial numbers and license keys, this discloses sensitive information; in Full Multiple Companies Support (FMCS) deployments the disclosure also crosses company/tenant boundaries. Impact is limited to preview data rather than the full CSV file, and superusers were unaffected. Fixed in version 8.7.0, which scopes non-superuser reads to imports owned by the caller.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.8 **Description** A stored cross-site scripting issue exists where the `convertOldInternalLinks()` function in `FaqHelper` calls `html entity decode()` on sanitized FAQ content. This process reverses the entity-encoding protection, allowing authenticated users with FAQ editing privileges to inject JavaScript payloads. These payloads execute in the browsers of all users who view the affected FAQ pages. **Recommendations** Update to version 4.1.8 or later. As a temporary mitigation, restrict FAQ editing privileges to only highly trusted users.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.8 **Description** An authorization bypass exists in the question creation process. The `isAddingQuestionsAllowed()` function grants access to all users when the `main.enableAskQuestions` setting is active, failing to respect the `records.allowQuestionsForGuests` configuration. This allows unauthenticated users to submit questions through the 'question/create' API endpoint, bypassing guest restrictions to inject spam into the administrative moderation queue. **Recommendations** Update to version 4.1.8 or later. As a temporary mitigation, disable the `main.enableAskQuestions` setting to prevent unauthorized question submissions.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions 3.1.0 through 4.1.6 **Description** An authentication bypass exists in the `AuthLdap::create()` function. When LDAP authentication is enabled, a successful LDAP bind triggers the `User::setStatus('active')` function unconditionally. This action overwrites the `account status` column of an existing local account, changing it from 'blocked' to 'active'. Consequently, users with administratively blocked local accounts can restore access and log in via LDAP. This state transition is not recorded in logs, preventing administrators from detecting the override. **Recommendations** Update phpMyFAQ to version 4.1.7.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.7 **Description** A two-factor authentication (2FA) bypass exists because remember-me tokens are issued before the 2FA verification process is completed. An attacker possessing valid credentials can obtain a remember-me cookie to skip the 2FA challenge and replay that cookie to gain full authenticated access to the system without providing the second-factor verification. **Recommendations** Update to version 4.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** Mautic versions 7.0.0 through 7.1.1 **Description** An authorization bypass exists in the API v2 endpoints (utilizing API Platform). Roles configured with owner-scope restrictions, such as `viewown` or `editown`, are not properly enforced. This allows authenticated API users with low privileges to bypass ownership-logic controls to access or modify resources belonging to other users, including reports, contacts, and companies, thereby bypassing structural tenant and privilege boundaries. **Recommendations** Update to version 7.1.2. Temporarily revoke API credentials or narrow access permissions for users whose roles rely on owner-scope permission containment.

**Name of the Vulnerable Software and Affected Versions** Mautic versions prior to 7.1.2 **Description** A stored Cross-Site Scripting (XSS) issue exists in the project selector component. The application fails to sanitize project names returned via AJAX before injecting them into the Document Object Model (DOM) as option fields. An authenticated user with project creation permissions can store a malicious script payload in a project name. When an administrative user opens an entity editor containing the project selector, the script executes in their browser session, potentially leading to session hijacking, unauthorized state coordination, or unauthorized access to organizational data. **Recommendations** Update to version 7.1.2. Restrict project creation and modification permissions to trusted administrative users.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.2 **Description** OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) issue exists in the patient portal payment flow. This allows a patient portal user to inject arbitrary JavaScript code that will be executed in the browser of a staff member reviewing the payment submission. The malicious payload is stored in `portal/lib/paylib.php` and rendered without proper sanitization in `portal/portal payment.php`. **Recommendations** Update OpenEMR to version 8.0.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.2 **Description** OpenEMR is an electronic health records and medical practice management application. A DOM-based stored cross-site scripting issue exists in the jQuery SearchHighlight plugin (`library/js/SearchHighlight.js`). An authenticated user with encounter form write access can inject arbitrary JavaScript that executes in another clinician's browser session when using the search/find feature on the Custom Report page. The plugin reverses server-side HTML entity encoding by reading decoded text from DOM text nodes, concatenating it into a raw HTML string, and passing it to jQuery's `$()` constructor for HTML parsing. **Recommendations** Update to OpenEMR version 8.0.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.2 **Description** OpenEMR is a free and open source electronic health records and medical practice management application. The application is susceptible to a stored cross-site scripting (XSS) issue. This occurs due to unescaped `portal login username` within the portal credential print view. A patient portal user can inject an XSS payload as their login username, which then executes in a clinic staff member's browser when the "Create Portal Login" page is accessed for that patient. This allows for a transition from the patient session context to the staff/admin session context. **Recommendations** Versions prior to 8.0.0.2 should be updated to version 8.0.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.2 **Description** OpenEMR is an electronic health records and medical practice management application. A flaw exists where an authenticated, non-administrator user can view reminder messages belonging to other users. This is achieved by manipulating the `sentTo[]` or `sentBy[]` parameters in a GET request to the dated reminders log. The issue allows access to patient names and the content of free-text messages. **Recommendations** Update to OpenEMR version 8.0.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.2 **Description** OpenEMR is an electronic health records and medical practice management application. A flaw exists where an authorization bypass in the optional FaxSMS module (`oe-module-faxsms`) allows authenticated users to invoke controller methods, including `getNotificationLog()`, without proper access control checks. The `AppDispatch` constructor bypasses ACL enforcement, potentially exposing patient appointment data (PHI). **Recommendations** Update to OpenEMR version 8.0.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.1 **Description** OpenEMR is an electronic health records and medical practice management application. The Claim File Tracker feature exposes an AJAX endpoint that returns billing claim metadata, including claim IDs, payer information, and transmission logs. This endpoint does not enforce the same Access Control List (ACL) as the main billing/claims workflow, allowing authenticated users without appropriate billing permissions to access sensitive data. The vulnerable API endpoint is an AJAX endpoint used by the Claim File Tracker feature. The issue arises because the endpoint does not properly validate user permissions before returning billing claim metadata. The vulnerable parameter is not explicitly mentioned. **Recommendations** Update OpenEMR to version 8.0.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.1 **Description** OpenEMR is an electronic health records and medical practice management application. Prior to version 8.0.0.1, sensitivity checks for group encounters were not functioning correctly. The code was only checking the `form encounter` table for sensitivity information, while group encounters actually store this information in the `form groups encounter` table. This resulted in sensitivity restrictions not being applied to group encounters, potentially allowing unauthorized users to view sensitive information, such as mental health records. **Recommendations** Upgrade to OpenEMR version 8.0.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.1 **Description** OpenEMR is an electronic health records and medical practice management application. A stored cross-site scripting (XSS) issue exists in the prescription CSS/HTML print view via patient demographics. This involves server-side rendering of patient names using a raw PHP echo and client-side DOM-based rendering via jQuery .html() in a separate component (`portal/sign/assets/signer api.js`). The root cause is unsanitized patient names in `patient data`. The issue has different sinks, affected components, and trigger actions, requiring independent fixes. **Recommendations** Versions prior to 8.0.0.1 should be updated to version 8.0.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.1 **Description** OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) issue exists in the Graphical Pain Map ("clickmap") form. This allows any authenticated clinician to inject arbitrary JavaScript that executes in the browser of every subsequent user who views the affected encounter form. Because session cookies are not marked HttpOnly, this enables full session hijacking of other users, including administrators. The `clickmap` form is the point of injection for the malicious script. The vulnerability affects the session cookies, allowing for unauthorized access. **Recommendations** Update OpenEMR to version 8.0.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0.1 **Description** OpenEMR is an electronic health records and medical practice management application. An incorrect boolean condition within the `ControllerRouter::route()` function results in the administrator/super user access control check being applied only to specific controllers (review, log). This leaves other controllers – alerts, ajax, edit, add, detail, browse – accessible to any authenticated user. This allows any logged-in user to suppress clinical decision support alerts, delete or modify clinical plans, and edit rule configurations, operations that should require administrator privileges. **Recommendations** Versions prior to 8.0.0.1 should be updated to version 8.0.0.1 or later.