Pyuysig

**Name of the Vulnerable Software and Affected Versions** Actual versions prior to 26.6.0 **Description** In OpenID multi-user mode, disabling a user only prevents future OpenID logins for that identity. Existing session tokens remain valid because the shared session validation path does not check if the associated user is still enabled. This allows a disabled user to continue accessing authenticated server endpoints. The issue is particularly persistent in default deployments where the `token expiration` variable is set to `never`. A disabled user can maintain access to their own budgets, shared budgets containing sensitive financial data, or even administrative privileges if the disabled account had an admin role. The vulnerability involves the `validateSession()` function and affects endpoints protected by `validateSessionMiddleware`, such as the sync API and the `/users` update route via the `enabled` variable. **Recommendations** Update Actual to version 26.6.0.

**Name of the Vulnerable Software and Affected Versions** Kestra versions prior to 1.3.19 Kestra versions prior to 1.2.19 Kestra versions prior to 1.1.19 Kestra versions prior to 1.0.43 **Description** Kestra is an open-source, event-driven orchestration platform. The `inputFiles` task writes rendered file names directly under the task working directory. If a flow forwards untrusted execution or webhook data into an `inputFiles` file name, a caller can use `../` path segments to create or overwrite files outside the task working directory on the worker filesystem. This is a path traversal issue, where `../` sequences are used to access and manipulate files and directories outside the intended folder. **Recommendations** Update to version 1.3.19 Update to version 1.2.19 Update to version 1.1.19 Update to version 1.0.43

An issue in the attachment handling component of Feuerhamster MailForm v1.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted request.

**Name of the Vulnerable Software and Affected Versions** Benjamin Jonard Koillection version 1.8.0 **Description** An authenticated Server-Side Request Forgery (SSRF) exists in the custom scraper subsystem component. This allows attackers to scan internal resources by supplying a crafted URL. SSRF is a flaw where a server is tricked into making requests to an unintended location, often bypassing network security controls. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LLDAP version 0.6.2 **Description** An input handling flaw in the HTTP refresh token process allows attackers to cause a Denial of Service (DoS), which is a condition where a service becomes unavailable to its intended users, by sending a crafted `refresh-token` header. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** grocy version 4.6.0 **Description** SQL injection occurs at the '/stockreports/spendings' endpoint through the `product-group` parameter. This allows attackers to access sensitive database information by using a crafted SQL statement. SQL injection is a type of flaw where an attacker can interfere with the queries that an application makes to its database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/stockreports/spendings' endpoint or avoid using the `product-group` parameter.

**Name of the Vulnerable Software and Affected Versions** Filestash version 0.4.0 **Description** Incorrect access control in the '/admin/api/config' endpoint allows attackers to escalate privileges by sending a crafted request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nginx Proxy Manager version 2.14.0 **Description** Incorrect access control in the "Let's Encrypt" certificate download endpoint allows authenticated attackers to obtain TLS private key material by sending a crafted GET request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vector versions prior to 0.55.0 **Description** The ClickHouse sink contains a SQL/identifier injection flaw. The software escaped the `table` identifier but interpolated the `database` value raw into the INSERT statement, allowing a crafted database value to break out of identifier quoting. This occurs in the `KeyPartitioner::partition()` function via the `set uri query` parameter, which could allow attackers to access sensitive database information using crafted SQL statements. **Recommendations** Update to version 0.55.0.

**Name of the Vulnerable Software and Affected Versions** Vector version 0.54.0 **Description** An issue in the '/util/http/prelude.rs' endpoint allows attackers to cause a Denial of Service (DoS), which is a condition where a service becomes unavailable to its intended users, by sending a crafted request or payload. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request.

**Name of the Vulnerable Software and Affected Versions** whoogle-search version 1.2.3 **Description** An information disclosure issue in the configuration endpoint allows attackers to obtain sensitive information by sending a crafted GET request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** kanishka-linux Reminiscence version 0.3.0 **Description** An OS command injection flaw exists in the media archiving and export pipeline component. This allows attackers to execute arbitrary commands on the operating system by providing a specially crafted input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** fossar selfoss version 2.20-SNAPSHOT **Description** An issue in the loopback request handling component allows attackers to execute arbitrary commands and obtain sensitive information by supplying a crafted HTTP request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** flatnotes version 5.5.4 **Description** An arbitrary file upload issue exists in the attachment handling component. This allows attackers to execute arbitrary code by uploading a specially crafted HTML or SVG file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** kanishka-linux Reminiscence version 0.3.0 **Description** An OS command injection allows attackers to execute arbitrary commands by supplying crafted input to the '/manage/features/media' endpoint. OS command injection is a flaw where an application executes system-level commands provided by a user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Deck9 Input version 2.0.1 **Description** Incorrect access control in the "/{form}/webhooks/{webhook}" endpoint allows authenticated attackers to arbitrarily modify or delete webhooks belonging to other tenants by sending a crafted request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Deck9 Input version 2.0.1 **Description** A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML through the use of a crafted payload. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zhoros SuperBin version 1.0.0 **Description** A directory traversal issue exists where attackers can execute the traversal by supplying files with names containing traversal characters. Directory traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An issue in the uploadPostHandler component of Andrei Marcu linx-server v2.3.8 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.