Bertrand Lorente Yáñez

Name of the Vulnerable Software and Affected Versions: h6web (affected versions not specified) Description: The issue is related to an insecure direct object reference (IDOR) vulnerability. It allows an authenticated attacker to access other users' information by making a POST request and modifying the `pkrelated` parameter in the "/h6web/ha datos hermano.php" endpoint to refer to another user. Additionally, the first request could also allow the attacker to impersonate other users, resulting in all subsequent requests being executed with the privileges of the impersonated user. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: h6web versions (affected versions not specified) Description: The issue is a Reflected Cross-Site Scripting (XSS) flaw that could allow an attacker to inject malicious JavaScript code into a URL. When a user accesses that URL, the injected code is executed in their browser, potentially leading to the theft of sensitive information, identity theft, or the execution of unauthorized actions on behalf of the affected user. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.