CVE Vulnerability Catalog

Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables, allowing arbitrary SQL execution.

In WeGIA prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table.

In WeGIA prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(), and the installer writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement.

In FileRise prior to 3.15.0, public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An unauthenticated holder of a valid share token can use shared-folder listing, direct download, or ZIP creation to access files outside the folder that was actually shared.

In InvoiceShelf version 2.3.3 and earlier, bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. An authenticated user can submit another company's identifier and delete cross-company records.

Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can enter the ORDER BY clause, enabling boolean-based blind extraction of database information.

In InvoiceShelf prior to version 2.4.0, PDFConfigurationRequest.php validates the owner-controlled gotenberg_host setting only as a syntactically valid URL. GotenbergPDFDriver::loadView later sends a multipart HTTP request containing rendered invoice, estimate, or payment HTML as document.html to that host without rejecting private, loopback, link-local, or reserved addresses.

In InvoiceShelf prior to version 2.4.0, invoice, estimate, and recurring-invoice creation paths accept client-supplied total, sub_total, tax, discount_val, and due_amount values without verifying that they match the submitted line items. An authenticated user can persist manipulated financial totals through InvoicesRequest::getInvoicePayload and the corresponding EstimatesRequest and RecurringInvoiceRequest handlers.

Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailable_id without verifying mailable_type, and the JSON handlers do not enforce EmailLog::isExpired. A token issued for one document type can disclose a different company's document when numeric identifiers collide, and an expired token can remain usable on the JSON routes.

Prior to version 2.4.0, InvoiceShelf NotesController::show, update, and destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy, so neither method checks the target note's company_id. An authenticated staff user can read, modify, or delete another company's note templates.

Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. An authenticated user can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in their own company.

In Markdown Preview Enhanced prior to 0.8.30, the _crossnote.updateMarkdown command accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that the target is the Markdown file represented by the current preview. JavaScript already executing in the preview webview can invoke this command through the extension message bridge and write any file permitted by the VS Code user's operating-system privileges.

Markdown Preview Enhanced, a Markdown preview extension for Visual Studio Code, prior to 0.8.30 does not validate the command value or arguments sent from the webview. JavaScript running in the preview can invoke privileged extension commands, including file modification, code execution, export-tool execution, and arbitrary URL opening. Exploitation requires a separate webview JavaScript execution path, such as the .crossnote/head.html injection.

In Markdown Preview Enhanced prior to 0.8.30, the extension reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document without removing executable content. Script-capable markup executes while the document loads, before the React application and DOMPurify initialize, and can access acquireVsCodeApi.

Markdown Preview Enhanced, a Markdown preview extension for Visual Studio Code, prior to 0.8.29 evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js host realm. Opening a Markdown file in a malicious repository automatically loads these files, and prototype-chain traversal can reach the host Function constructor and process object, allowing OS command execution as the victim account without further interaction.

A security vulnerability has been detected in cemtan sar2html 4.0.0 affecting the deleteHost/deleteRange/deleteAll functions in sar2html.py. The manipulation leads to missing authentication and the attack may be performed remotely.

In cemtan sar2html 4.0.0, the index function in sar2html.py does not properly sanitize the sort argument, leading to SQL injection. The attack can be carried out remotely, and a public exploit is available that could be used in attacks. The project was informed of the issue but has not responded.

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover the RSA-wrapped envelope key and decrypt the object.

Plane, an open-source project management tool, in 1.3.1 and earlier has an EntityAssetEndpoint at /api/public/assets/v2/anchor/{anchor}/ that requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a published project's public DeployBoard.anchor can create FileAsset records in that project and soft-delete existing assets by identifier, allowing cross-workspace file injection, storage abuse, and data loss.

In Plane 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's is_active field, including deactivating a project administrator. Additionally, ProjectMemberPreferenceEndpoint.patch trusts the member_id path value and lets a project member overwrite another member's preferences. The vulnerability is fixed in 1.4.0.