Chakradhar1228

**Nome do Software Vulnerável e Versões Afetadas** Dokploy versões anteriores a 0.26.6 **Descrição** Dokploy é uma Plataforma como Serviço (PaaS) auto-hospedável que contém um problema de path traversal. Isso permite que usuários autenticados escrevam arquivos arbitrários no sistema de arquivos durante a implantação da aplicação. Quando utilizado com o recurso de implantação de servidor remoto, permite a escrita de arquivos arbitrários em sistemas de arquivos de servidores remotos, execução remota de código automática via cron jobs, comprometimento total do servidor, exfiltração de dados sem interação do usuário e instalação de backdoors persistentes. Este problema ignora todo o isolamento de contêiner em implantações de servidores remotos. **Recomendações** Atualize para uma versão posterior a 0.26.5.

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. This issue has been patched in version 16.3.0.

**Name of the Vulnerable Software and Affected Versions** Frappe versions prior to 14.100.1 Frappe versions prior to 15.100.0 Frappe versions prior to 16.6.0 **Description** Frappe is a full-stack web application framework. A malicious user could send a crafted request to an ''endpoint'' which would lead to the server making an HTTP call to a service of the user's choice. The vulnerability involves manipulating a request sent to an endpoint, causing the server to initiate an HTTP call to a service specified by the attacker. The `endpoint` receives the crafted request. **Recommendations** Update Frappe to version 14.100.1 or later. Update Frappe to version 15.100.0 or later. Update Frappe to version 16.6.0 or later.

**Name of the Vulnerable Software and Affected Versions** Lychee versions prior to 7.1.0 **Description** Lychee is a free, open-source photo-management tool. A flaw exists in the album password unlock functionality that could allow users to gain unauthorized access to other users' password-protected albums. When a user unlocks a password-protected public album, the system automatically unlocks all other public albums sharing the same password, bypassing authorization controls. **Recommendations** Update to version 7.1.0 or later.