Alacerda

**Name of the Vulnerable Software and Affected Versions** MK-AUTH versions through 19.01 K4.9 **Description** The issue allows for XSS via the "admin/logs ajax.php" endpoint, specifically through the `tipo` parameter. An attacker can exploit this to read the `centralmka2` (session token) cookie, which is not set to HTTPOnly. **Recommendations** For MK-AUTH versions through 19.01 K4.9, consider restricting access to the "admin/logs ajax.php" endpoint until a patch is available. As a temporary workaround, avoid using the `tipo` parameter in the affected endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MK-AUTH versions through 19.01 K4.9 **Description** The issue allows remote attackers to obtain sensitive information, such as a CPF number, by modifying the `titulo` (also known as invoice number) value in the "central/recibo.php" URI. **Recommendations** For MK-AUTH versions through 19.01 K4.9, as a temporary workaround, consider restricting access to the "central/recibo.php" URI until a patch is available. Avoid using modified `titulo` values in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.