Sonntb21Dcat164

**Name of the Vulnerable Software and Affected Versions** InvoicePlane version 1.7.0 **Description** InvoicePlane is a self-hosted open source application used for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) issue exists in the upload Login Logo function. The application permits the uploading of SVG files. While administrator privileges are needed to exploit this, it is considered a critical issue because it could lead to unauthorized modification of application data, the creation of persistent backdoors through stored malicious scripts, and complete compromise of the application’s integrity. **Recommendations** Update to version 1.7.1.

**Name of the Vulnerable Software and Affected Versions** InvoicePlane version 1.7.0 **Description** InvoicePlane is a self-hosted open source application used for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) issue exists in the Edit Invoices functionality. The application does not validate user input for the `invoice number` parameter when editing invoices. Exploitation requires administrator privileges and could lead to unauthorized modification of application data, the creation of persistent backdoors through stored malicious scripts, and a full compromise of the application’s integrity. **Recommendations** Update to version 1.7.1 to address the issue.

**Name of the Vulnerable Software and Affected Versions** InvoicePlane version 1.7.0 **Description** InvoicePlane is a self-hosted open source application used for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) issue exists in the Edit Quotes function. The application does not validate user input at the `quote number` parameter, potentially allowing unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Administrator privileges are required to exploit this issue. **Recommendations** Versions prior to 1.7.1 are affected. Update to version 1.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** InvoicePlane version 1.7.0 **Description** InvoicePlane is a self-hosted open source application used for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) issue exists in the upload Invoice Logo function. The function allows the application to upload svg files. While administrator privileges are needed to exploit this, it is considered a critical issue because it could lead to unauthorized modification of application data, the creation of persistent backdoors through stored malicious scripts, and a full compromise of the application’s integrity. **Recommendations** Update to version 1.7.1.

**Name of the Vulnerable Software and Affected Versions** OpenProject versions prior to 16.6.7 OpenProject versions prior to 17.0.3 **Description** OpenProject is a web-based project management software. A flaw exists in the time tracking function where the application fails to properly handle HTML tags. An attacker possessing administrator privileges can inject HTML through the name field when creating a work package within the Work package section during time tracking. This could lead to the execution of malicious code. **Recommendations** Update to OpenProject version 16.6.7 or later. Update to OpenProject version 17.0.3 or later.

**Name of the Vulnerable Software and Affected Versions** ChurchCRM versions prior to 6.7.2 **Description** ChurchCRM is an open-source church management system. A SQL Injection issue exists in the `/PaddleNumEditor.php` endpoint. Any authenticated user, even with limited permissions, can exploit SQL injection through the `PerID` parameter. **Recommendations** Update to version 6.7.2.

**Name of the Vulnerable Software and Affected Versions** ChurchCRM versions prior to 6.7.2 **Description** ChurchCRM, an open-source church management system, contains a Stored Cross-Site Scripting (XSS) issue in the Create Events feature within the Church Calendar. A user with limited privileges can inject malicious code into the Description field. This code is then saved to the database and executed when other users, including administrators, view the event. This can lead to account compromise. **Recommendations** Update to ChurchCRM version 6.7.2 or later.