Skeletonsec

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.8 **Description** User data export ZIP files contain live Time-based One-Time Password (TOTP) shared secrets in plaintext. An attacker who obtains these exported archives can extract the TOTP seed to generate valid one-time codes, allowing them to bypass two-factor authentication. **Recommendations** Update to version 4.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.2.0-alpha.2 **Description** An issue exists where the admin dashboard API endpoints 'searches' and 'content-health' enforce authentication but fail to perform necessary permission checks. This allows any authenticated user, regardless of their privilege level, to access these endpoints and read site-wide search statistics and content-health counters. **Recommendations** Update to version 4.2.0-alpha.2 or later. Restrict access to the 'searches' and 'content-health' API endpoints as a temporary mitigation.

**Name of the Vulnerable Software and Affected Versions** AVideo versions prior to 30.0 **Description** An information disclosure issue exists in the MobileManager plugin. An unauthenticated visitor can send a GET request to the 'plugin/MobileManager/getConfiguration.json.php' endpoint to retrieve sensitive configuration data. The exposed information includes TLS private key file paths, socket configuration details, platform version, and debug flags, which could facilitate further targeted attacks. **Recommendations** Update AVideo to a version later than 30.0. Restrict access to the 'plugin/MobileManager/getConfiguration.json.php' endpoint to prevent unauthenticated access.

**Name of the Vulnerable Software and Affected Versions** File Browser versions 2.63.6 through 2.63.23 **Description** An issue exists where public share links are not properly removed when a privileged user deletes a file shared by another user. This allows unauthenticated attackers to use the remaining share link to access new, unrelated content that is subsequently uploaded to the same file path. **Recommendations** Update File Browser to a version newer than 2.63.23.

**Name of the Vulnerable Software and Affected Versions** filebrowser versions prior to 2.63.24 **Description** An issue exists where share records are not removed when a shared file is renamed, as only file deletion triggers the cleanup process. Because the share record is keyed by the file path, it remains dormant and returns a 404 error while the path is empty. If a new, unrelated file is subsequently placed at that original path through re-upload, a hook, or by another user with create permissions, the stale public share link will serve the new file using the original link's password and expiry settings, leading to unauthorized exposure. **Recommendations** Update to version 2.63.24 or later.

**Name of the Vulnerable Software and Affected Versions** filebrowser versions prior to 2.63.24 **Description** Insufficient validation of named pipes in the directory archive and public download handlers allows attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server goroutines and exhaust connection resources, leading to a denial of service. A goroutine is a lightweight thread managed by the Go runtime. **Recommendations** Update to version 2.63.24 or later.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo versions prior to 30.1 **Description** Authentication is not enforced on the 'report4.json.php' and 'report4.1.json.php' endpoints. This allows unauthenticated users to send GET requests to these endpoints to retrieve daily and cumulative user registration statistics without requiring a session or authorization. **Recommendations** Update to a version later than 30.0. Restrict access to the 'report4.json.php' and 'report4.1.json.php' endpoints as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** AVideo versions prior to 30.1 **Description** A cross-site request forgery (CSRF) issue exists in the 'plugin/Live/myLiveControls.save.json.php' endpoint. The system verifies if a user is logged in but fails to enforce a CSRF token or origin check when processing the `customUrl`, `customMessage`, and `autoRedirect` parameters via a GET request. This allows an attacker to trick a logged-in streamer into visiting a malicious page, enabling the silent modification of live-channel viewer-redirect settings stored in `users.externalOptions`. Consequently, viewers may be redirected to phishing sites or presented with spoofed messages. **Recommendations** Update AVideo to a version later than 30.0. As a temporary mitigation, restrict access to the 'plugin/Live/myLiveControls.save.json.php' endpoint or avoid using the `customUrl`, `customMessage`, and `autoRedirect` parameters until the update is applied.

**Name of the Vulnerable Software and Affected Versions** filebrowser versions 2.24.0 and later **Description** A race condition exists in the TUS upload handler. This allows authenticated users to bypass length validation by sending multiple simultaneous PATCH requests at the same offset, enabling them to write data beyond the declared `Upload-Length`. This can result in files exceeding their specified size and the triggering of completion hooks for these oversized uploads. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 2.0.20 **Description** A cross-site scripting issue exists in the Twig sandbox policy. The policy allowlists the `addJs()` and `addCss()` methods on `GravCommonAssets` without implementing proper output escaping. This allows page editors to inject arbitrary scripts by registering malicious assets or injecting attributes, which are then rendered unescaped into the document head tags and executed for all visitors, including administrators. **Recommendations** Update to version 2.0.20 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.8 **Description** Incorrect permission checks on admin content pages allow editors with lower privileges to read draft and inactive content. Users with only add permissions can access the 'news edit' and 'FAQ translate' endpoints to view unpublished content that is hidden from the public. **Recommendations** Update to version 4.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.8 **Description** An authentication bypass exists in the two-factor authentication (TOTP) disable functionality. The `removeTwofactorConfig()` function, accessible via the 'POST /api/user/remove-twofactor' endpoint, disables TOTP by verifying only the user session and a valid CSRF token, without requiring a password or a current TOTP code. Similarly, the 'PUT /api/user/data/update' endpoint allows disabling TOTP through the `twofactor enabled` variable under the same session and CSRF requirements. An attacker with a hijacked session can remove two-factor protection from any account, including administrators, allowing subsequent access with only a password. **Recommendations** Update phpMyFAQ to version 4.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.8 **Description** An authentication bypass exists in the user control panel API endpoint. Authenticated attackers with session access can change any user's password, including administrators, without verifying the current password. This is achieved by submitting a PUT request to the user data update endpoint using only a CSRF token, leading to irreversible account takeover and victim lockout. **Recommendations** Update to version 4.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.8 **Description** An issue exists where the application fails to validate CAPTCHA during question submission requests when the `store` parameter is set to 'now'. This allows unauthenticated attackers to bypass CAPTCHA protection and submit an unlimited number of questions, which can lead to database pollution and the triggering of outgoing mail notifications. **Recommendations** Update to version 4.1.8 or later.