Skeletonsec

**Name of the Vulnerable Software and Affected Versions** EspoCRM versions prior to 10.0.5 **Description** An insecure direct object reference (IDOR) occurs in the `PersonalAccountService` service. This issue allows users with Email Account scope access to retrieve IMAP passwords belonging to other users. An attacker who possesses a victim's Email Account record ID can request that specific record to steal stored IMAP credentials and gain unauthorized access to the victim's mailbox. **Recommendations** Update to version 10.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** YesWiki versions prior to 4.6.7 **Description** An authorization flaw exists in the tags tool within the `listpagestag` and `includepages` actions. These actions enumerate pages without applying read-ACL (Access Control List) filtering, which is a mechanism used to restrict access to specific pages based on user permissions. Unauthenticated or unprivileged attackers can embed these actions using a specific tag or page name to disclose the names and body-derived titles of pages that are restricted by ACLs. **Recommendations** Update YesWiki to version 4.6.7 or later.

**Name of the Vulnerable Software and Affected Versions** YesWiki versions prior to 4.6.7 **Description** An issue in `LostPasswordAction.php` allows unauthenticated attackers to confirm registered email addresses by analyzing differing server responses. This occurs on the MotDePassePerdu recovery page, which lacks rate limiting, enabling attackers to identify valid accounts for targeted phishing or password-spraying attacks. **Recommendations** Update YesWiki to version 4.6.7 or later.

**Name of the Vulnerable Software and Affected Versions** YesWiki versions prior to 4.6.7 **Description** An unauthenticated attacker can perform a blind server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location. This is possible via the '/api/entries/bazarlist' endpoint using the `idtypeannonce` parameter. The issue exists because the `isValidURL()` function always returns true, allowing the `loadURLContent()` function to use curl to fetch internal URLs. This can be used to probe internal networks and access internal services or metadata endpoints. **Recommendations** Update YesWiki to version 4.6.7 or later. As a temporary workaround, restrict access to the '/api/entries/bazarlist' endpoint.

**Name of the Vulnerable Software and Affected Versions** YesWiki versions prior to 4.6.7 **Description** An unauthenticated server-side request forgery (SSRF) allows remote attackers to force the server to fetch arbitrary hosts and ports. This is achieved by submitting the `url` parameter of the {{valeur}} action through the `content` parameter of the 'handlers/page/render.php' endpoint. This flaw enables the probing of internal HTTP services and the retrieval of response content that matches fiche markup. **Recommendations** Update YesWiki to version 4.6.7 or later.

**Name of the Vulnerable Software and Affected Versions** YesWiki versions prior to 4.6.7 **Description** An unauthenticated server-side request forgery (SSRF) allows remote attackers to force the server to fetch arbitrary URLs. This is achieved by providing a syndication action via the `content` parameter of the render handler. Attackers can target internal hosts and ports, retrieve fetched feed content within the rendered page, and trigger the download of feed enclosures into the files directory. **Recommendations** Update YesWiki to version 4.6.7 or later.

**Name of the Vulnerable Software and Affected Versions** Froxlor versions prior to 2.3.12 **Description** An authenticated customer with the export feature enabled can achieve host root and cross-tenant compromise. The issue occurs because the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination. Specifically, the `makeCorrectDir()` function in `FroxlorFileDir` contains an off-by-one error during its path-component walk, skipping the first segment below the customer home directory. Additionally, the guard in `ExportCron.php` only checks the final component using `is link()`. An attacker can schedule an export to a subdirectory and replace an intermediate path component with a symlink before the root-owned cron executes. This causes the `chown -R` command to recursively change the ownership of the linked directory tree, such as /etc, to the customer's UID. **Recommendations** Update to version 2.3.12.

**Name of the Vulnerable Software and Affected Versions** froxlor versions prior to 2.3.12 **Description** The software fails to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. This allows attackers who possess hijacked sessions, valid API keys, or 2FA trust tokens to maintain full account access even after a password rotation, effectively bypassing incident response measures. **Recommendations** Update to version 2.3.12 or later.

**Name of the Vulnerable Software and Affected Versions** froxlor versions prior to 2.3.12 **Description** An issue exists where two-factor authentication (2FA) is disabled immediately upon a GET request to the 2FA management page, such as the endpoint '/customer index.php?page=2fa&action=delete'. This process occurs without requiring confirmation, re-authentication, or a CSRF (Cross-Site Request Forgery) token—a type of attack that forces an authenticated user to execute unwanted actions. Because the global CSRF middleware only protects POST, PUT, PATCH, and DELETE requests, and the session cookie uses SameSite=Lax, a cross-site top-level navigation can silently clear the `type 2fa` and `data 2fa` variables. Both customer and admin 2FA handlers are affected, allowing an attacker to reduce an account to password-only authentication if a logged-in user follows a crafted link. **Recommendations** Update froxlor to version 2.3.12.

**Name of the Vulnerable Software and Affected Versions** Froxlor versions prior to 2.3.12 **Description** A time-of-check time-of-use (TOCTOU) race condition exists in the SSH key synchronization cron within the `SshKeys::generateFiles()` function located in `lib/Froxlor/Cron/System/SshKeys.php`. TOCTOU is a software bug where a program checks the state of a resource before using it, but the state changes between the check and the use. The validation performed by `FileDir::makeCorrectDir()` and `makeCorrectFile()` occurs only at check time, while the filesystem path is re-resolved as root during the write process. On installations where the `system.allow customer shell` variable is set to 1, granting customers local shell access, an attacker can replace their `~/.ssh` directory with a symlink after the check but before the write. This allows the root-run cron to append the customer's public key to `/root/.ssh/authorized keys` and change the ownership of `/root/.ssh` to the customer, leading to full root compromise of the panel host. **Recommendations** Update to version 2.3.12. As a temporary mitigation, set the `system.allow customer shell` variable to 0 to restrict local shell access for customers.

**Name of the Vulnerable Software and Affected Versions** Froxlor versions prior to 2.3.12 **Description** Insufficient restriction and escaping of the `system.letsencryptchallengepath` setting allows for command injection. The value of this setting is concatenated unescaped into the acme.sh command line within the `lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php` file and executed by the root cron using the `FileDir::safe exec()` function. Since `safe exec()` only blacklists specific shell metacharacters, spaces and quotes remain, allowing the value to be split into additional acme.sh arguments. An administrator or an actor with permissions to modify settings, such as through the settings-import API, can inject options like `--renew-hook`, `--pre-hook`, or `--post-hook` to achieve arbitrary command execution as root during the next Let's Encrypt cron run, or use `--config-home` and `--cert-home` for arbitrary file writes. **Recommendations** Update to version 2.3.12 or later.

**Name of the Vulnerable Software and Affected Versions** Froxlor versions prior to 2.3.12 **Description** An issue exists in the FTP data deletion cron task where the system is susceptible to arbitrary file deletion via symlink following. When an FTP account is deleted, cron task 8 (deleteFtpData) calls the `makeCorrectDir()` function without the `$fixed homedir` argument. This causes the system to skip the symlink component walk and execute `rm -rf` as root on the resulting path using only string-level guards. Because `makeCorrectDir()` appends a trailing slash, GNU rm dereferences symlinks used as intermediate or final path components. An authenticated customer with write access to the FTP home directory can create a symlink before the cron job executes, allowing the root process to recursively delete arbitrary directory trees. This can lead to cross-tenant data destruction and host denial of service. **Recommendations** Update Froxlor to version 2.3.12.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.1.8 **Description** User data export ZIP files contain live Time-based One-Time Password (TOTP) shared secrets in plaintext. An attacker who obtains these exported archives can extract the TOTP seed to generate valid one-time codes, allowing them to bypass two-factor authentication. **Recommendations** Update to version 4.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions prior to 4.2.0-alpha.2 **Description** An issue exists where the admin dashboard API endpoints 'searches' and 'content-health' enforce authentication but fail to perform necessary permission checks. This allows any authenticated user, regardless of their privilege level, to access these endpoints and read site-wide search statistics and content-health counters. **Recommendations** Update to version 4.2.0-alpha.2 or later. Restrict access to the 'searches' and 'content-health' API endpoints as a temporary mitigation.

**Name of the Vulnerable Software and Affected Versions** AVideo versions prior to 30.0 **Description** An information disclosure issue exists in the MobileManager plugin. An unauthenticated visitor can send a GET request to the 'plugin/MobileManager/getConfiguration.json.php' endpoint to retrieve sensitive configuration data. The exposed information includes TLS private key file paths, socket configuration details, platform version, and debug flags, which could facilitate further targeted attacks. **Recommendations** Update AVideo to a version later than 30.0. Restrict access to the 'plugin/MobileManager/getConfiguration.json.php' endpoint to prevent unauthenticated access.

**Name of the Vulnerable Software and Affected Versions** filebrowser versions 2.24.0 and later **Description** A race condition exists in the TUS upload handler. This allows authenticated users to bypass length validation by sending multiple simultaneous PATCH requests at the same offset, enabling them to write data beyond the declared `Upload-Length`. This can result in files exceeding their specified size and the triggering of completion hooks for these oversized uploads. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo versions prior to 30.1 **Description** Authentication is not enforced on the 'report4.json.php' and 'report4.1.json.php' endpoints. This allows unauthenticated users to send GET requests to these endpoints to retrieve daily and cumulative user registration statistics without requiring a session or authorization. **Recommendations** Update to a version later than 30.0. Restrict access to the 'report4.json.php' and 'report4.1.json.php' endpoints as a temporary mitigation measure.

**Name of the Vulnerable Software and Affected Versions** AVideo versions prior to 30.1 **Description** A cross-site request forgery (CSRF) issue exists in the 'plugin/Live/myLiveControls.save.json.php' endpoint. The system verifies if a user is logged in but fails to enforce a CSRF token or origin check when processing the `customUrl`, `customMessage`, and `autoRedirect` parameters via a GET request. This allows an attacker to trick a logged-in streamer into visiting a malicious page, enabling the silent modification of live-channel viewer-redirect settings stored in `users.externalOptions`. Consequently, viewers may be redirected to phishing sites or presented with spoofed messages. **Recommendations** Update AVideo to a version later than 30.0. As a temporary mitigation, restrict access to the 'plugin/Live/myLiveControls.save.json.php' endpoint or avoid using the `customUrl`, `customMessage`, and `autoRedirect` parameters until the update is applied.

**Name of the Vulnerable Software and Affected Versions** filebrowser versions prior to 2.63.24 **Description** Insufficient validation of named pipes in the directory archive and public download handlers allows attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server goroutines and exhaust connection resources, leading to a denial of service. A goroutine is a lightweight thread managed by the Go runtime. **Recommendations** Update to version 2.63.24 or later.

**Name of the Vulnerable Software and Affected Versions** File Browser versions 2.63.6 through 2.63.23 **Description** An issue exists where public share links are not properly removed when a privileged user deletes a file shared by another user. This allows unauthenticated attackers to use the remaining share link to access new, unrelated content that is subsequently uploaded to the same file path. **Recommendations** Update File Browser to a version newer than 2.63.23.