Penetest

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** The software fails to strip EXIF metadata, which includes GPS geolocation data, from uploaded images. This leads to information disclosure, as attackers can download these images and extract precise latitude and longitude coordinates to reveal the physical location of the user at the time the image was captured. **Recommendations** Update to version 12.128.2 or later.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** A flaw exists in the Enforce Password Policy feature. When a Super Admin enables this policy and updates their password to a compliant one, the backend fails to update the password-compliance state. This causes the system to incorrectly identify the account as non-compliant, leading to continuous password-reset prompts that permanently lock the Super Admin out of organization access, resulting in a denial of service despite valid authentication. **Recommendations** Update to version 12.128.2.