Rayyb0T

kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key by sending a GET request to the modules/activate dialog endpoint. The plugin's activate dialog handler in lib/areas.php returns the complete key via ModulesLicense::readKey() without performing an administrator check, as the dialog is gated only by the access.system permission which defaults to true for all non-admin roles, enabling attackers to use the disclosed key to activate the plugin on arbitrary third-party installations.

**Name of the Vulnerable Software and Affected Versions** Dockwatch versions prior to 0.6.568 **Description** An unauthenticated OS command injection exists due to a chain of two issues. First, a missing `exit()` function after an authentication redirect in `loader.php` allows attackers to seed a required session flag. Second, unsanitized input is passed to the `shell exec()` function in `ajax/compose.php`. Remote attackers can exploit this by sending arbitrary commands via the `composePath` POST parameter in the `composePull` action. In standard deployments where the Docker socket is mounted, this can lead to full host compromise through container escape. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `ajax/compose.php` endpoint or avoid mounting the Docker socket to the container to minimize the risk of host compromise.

**Name of the Vulnerable Software and Affected Versions** phpUploader versions prior to 2.0.2 **Description** An unauthenticated information disclosure exists where remote attackers can access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block. This exposes sensitive data including uploader IP addresses, Argon2ID key hashes (a secure password hashing algorithm), internal filenames, and SHA-256 fingerprints. **Recommendations** Update phpUploader to version 2.0.2 or later.