Flamberik

**Name of the Vulnerable Software and Affected Versions** Comerzzia Backoffice: Sales Orchestrator version 3.0.15 **Description** The issue allows an attacker to retrieve, create, update, and delete databases via the `uidActivity`, `codCompany`, and `uidInstance` parameters of the "/comerzzia/login" endpoint. **Recommendations** For Comerzzia Backoffice: Sales Orchestrator version 3.0.15, consider restricting access to the "/comerzzia/login" endpoint until a patch is available. As a temporary workaround, avoid using the `uidActivity`, `codCompany`, and `uidInstance` parameters in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.