Wsparks-Vc

**Name of the Vulnerable Software and Affected Versions** Filament versions 4.0.0 through 4.11.4 Filament versions 5.0.0 through 5.6.4 **Description** The login page contains a timing discrepancy that enables unauthenticated attackers to perform email enumeration. This allows an attacker to determine if a specific email address is registered to an account. **Recommendations** Update to version 4.11.5. Update to version 5.6.5.

**Name of the Vulnerable Software and Affected Versions** Filament versions prior to 3.3.52 Filament versions prior to 4.11.5 Filament versions prior to 5.6.5 **Description** Filament applies Livewire's `WithFileUploads` trait to components where schemas may contain file upload fields. Certain schemas, such as the panel login form, do not require this functionality. This allows an unauthenticated attacker to upload arbitrary files to the application's temporary storage, which can be exploited to exhaust disk space or increase storage costs. **Recommendations** Update to version 3.3.52. Update to version 4.11.5. Update to version 5.6.5.

**Name of the Vulnerable Software and Affected Versions** Filament versions prior to 4.11.5 Filament versions prior to 5.6.5 **Description** The `ImageColumn` and `ImageEntry` components render raw database values without escaping HTML. If the data passed to these components is not validated, an attacker can inject malicious HTML or JavaScript, leading to stored Cross-Site Scripting (XSS), which is a security flaw where a script is permanently stored on the target server and executed in the browser of users viewing the affected table or schema. **Recommendations** Update to version 4.11.5. Update to version 5.6.5.