Avihay Eldad

**Name of the Vulnerable Software and Affected Versions** Taiga version 6.8.1 **Description** A CSV injection issue allows attackers to execute arbitrary code via uploading a crafted CSV file. This is achieved by loading a specifically manipulated CSV file, enabling the execution of arbitrary code. **Recommendations** For Taiga version 6.8.1, consider disabling the CSV upload feature until a patch is available to prevent exploitation. Restrict access to areas where CSV files can be uploaded to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Taiga version 8.6.1 **Description** A Client-Side Template Injection (CSTI) issue in the /project/new/scrum component allows remote attackers to execute arbitrary code by injecting a malicious payload within the new project details. **Recommendations** For Taiga version 8.6.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Taiga version 6.8.1 **Description** The issue allows attackers to redirect users to arbitrary websites by appending a crafted link to the `/login?next=` parameter in the login page URL. This can potentially lead to unauthorized access. **Recommendations** For Taiga version 6.8.1, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the `/login` endpoint or validating the `next` parameter to prevent redirects to unauthorized websites.

Name of the Vulnerable Software and Affected Versions: Snipe-IT version 7.0.13 build 15514 Description: The issue allows a low-privileged attacker to modify their profile name and inject a malicious payload into the `Name` field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal system data from the CSV file to a remote server. Recommendations: For Snipe-IT version 7.0.13 build 15514, as a temporary workaround, consider restricting access to the `Name` field in the profile management section to prevent malicious payload injection until a patch is available. Additionally, restrict the export of data as CSV files from the People Management page to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Snipe-IT version 7.0.13 Description: A Stored Cross-Site Scripting (XSS) issue allows an attacker to upload a malicious XML file containing JavaScript code, potentially leading to privilege escalation when the payload is executed. This could grant the attacker super admin permissions within the Snipe-IT system. The vulnerability can be exploited via an unknown part of the file `/users/{{user-id}}/#files`, allowing a remote attacker to escalate privileges. Recommendations: For Snipe-IT version 7.0.13, consider disabling the file upload feature or restricting access to the `/users/{{user-id}}/#files` endpoint until a patch is available. Avoid using the `user-id` variable in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Webkul Krayin CRM version 1.3.0 **Description** A Client-side Template Injection (CSTI) vulnerability allows remote attackers to execute arbitrary client-side template code by injecting a malicious payload during the lead creation process. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system. **Recommendations** For Webkul Krayin CRM version 1.3.0, consider disabling the lead creation process until a patch is available to prevent exploitation of the CSTI vulnerability. Restrict access to the CRM system to minimize the risk of privilege escalation. Avoid using the vulnerable template injection functionality in the lead creation process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Webkul Krayin CRM version 1.3.0 **Description** A Stored Cross-Site Scripting (XSS) issue allows remote attackers to inject arbitrary JavaScript code by submitting a malicious payload within the `username` field. This can lead to privilege escalation when the payload is executed, granting the attacker elevated permissions within the CRM system. **Recommendations** For Webkul Krayin CRM version 1.3.0, consider disabling the submission of user input in the `username` field until a patch is available to prevent the injection of malicious JavaScript code. Restrict access to sensitive areas of the CRM system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.