Rayyb0T

**Name of the Vulnerable Software and Affected Versions** kirby-modules versions prior to 5.5.8 **Description** An information disclosure issue allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key. This occurs when a GET request is sent to the 'modules/activate' dialog endpoint. The activate dialog handler in `lib/areas.php` uses the `ModulesLicense::readKey()` function to return the key without verifying if the user has administrator privileges. Because the dialog is only restricted by the `access.system` permission, which is enabled by default for all non-admin roles, unauthorized users can obtain the key and use it to activate the plugin on other installations. **Recommendations** Update kirby-modules to version 5.5.8 or later. Restrict the `access.system` permission for non-administrator roles to prevent unauthorized access to system dialogs.

**Name of the Vulnerable Software and Affected Versions** Dockwatch versions prior to 0.6.568 **Description** An unauthenticated OS command injection exists due to a chain of two issues. First, a missing `exit()` function after an authentication redirect in `loader.php` allows attackers to seed a required session flag. Second, unsanitized input is passed to the `shell exec()` function in `ajax/compose.php`. Remote attackers can exploit this by sending arbitrary commands via the `composePath` POST parameter in the `composePull` action. In standard deployments where the Docker socket is mounted, this can lead to full host compromise through container escape. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `ajax/compose.php` endpoint or avoid mounting the Docker socket to the container to minimize the risk of host compromise.

**Name of the Vulnerable Software and Affected Versions** phpUploader versions prior to 2.0.2 **Description** An unauthenticated information disclosure exists where remote attackers can access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block. This exposes sensitive data including uploader IP addresses, Argon2ID key hashes (a secure password hashing algorithm), internal filenames, and SHA-256 fingerprints. **Recommendations** Update phpUploader to version 2.0.2 or later.