Prjblk

**Name of the Vulnerable Software and Affected Versions** HestiaCP (affected versions not specified) **Description** The panel cronjob feature contains a broken access control flaw. This allows users with low privileges to modify the panel cronjob to execute HestiaCP management scripts using passwordless sudo, which can lead to the takeover of administrator accounts within the application and the underlying webserver. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Liquidfiles versions prior to 4.2.12 **Description** A broken access control issue allows an Admin in a secondary domain to escalate privileges to Sysadmin. This is achieved by modifying a group within their managed secondary (non-default) group. **Recommendations** Update to version 4.2.12.

**Name of the Vulnerable Software and Affected Versions** Gibbon versions prior to v30.0.01 **Description** A local file inclusion issue allows remote code execution by modifying the report archive directory and forcing the system to interpret a user-provided `.zip` file as PHP. This requires Teacher or higher privileges and could lead to the compromise of the underlying web server. **Recommendations** Update to version v30.0.01 or later.

**Name of the Vulnerable Software and Affected Versions** Gibbon versions prior to v30.0.01 **Description** A path traversal issue allows users with Teacher or higher privileges to cause a denial of service (DOS). This occurs when attempting to extract web application PHP files; if the .zip extraction fails, the file is deleted, leading to a loss of availability for the web application. **Recommendations** Update to version v30.0.01 or later.

**Name of the Vulnerable Software and Affected Versions** LibreNMS versions prior to 26.3.0 **Description** An authenticated Cross-site Scripting issue exists on the 'showconfig' page. An attacker with administrative privileges can execute scripts that target other users who access the same page. **Recommendations** Update to version 26.3.0 or later.