Trexnegro

**Name of the Vulnerable Software and Affected Versions** NocoDB versions prior to 2026.05.1 **Description** The 'spreadsheet-fetch' endpoint, specifically within the `axiosRequestMake()` function, improperly validated URLs. It accepted paths containing permitted extensions anywhere in the string and utilized a manual regex blocklist that failed to include the `127.0.0.0/8` and `169.254.0.0/16` IP ranges. This allowed authenticated users with editor permissions to reach the 'cloud-metadata' endpoint and other internal HTTP endpoints via crafted URLs, potentially leading to the exfiltration of credentials on cloud hosts. **Recommendations** Update to version 2026.05.1.

**Name of the Vulnerable Software and Affected Versions** NocoDB versions prior to 2026.05.1 **Description** The 'base-migration' endpoint accepts a caller-supplied URL that the migration worker dereferences without enforcing the protocol or destination. This allows for scheme abuse, such as using `file:` or `ftp:`, and the probing of internal HTTP destinations. Specifically, the `body.migrationUrl` variable in the 'migrate' endpoint lacked protocol validation, which could coerce the migration worker into reading local files or communicating with non-HTTP services. Access to this endpoint is restricted to the workspace owner role via Access Control List (ACL). **Recommendations** Update to version 2026.05.1.

**Name of the Vulnerable Software and Affected Versions** Krayin CRM versions 2.2.x **Description** SQL injection is possible via the `rotten lead` parameter at the '/Lead/LeadDataGrid.php' endpoint. SQL injection is a type of flaw that allows an attacker to interfere with the queries that an application makes to its database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Webkul Krayin CRM versions 2.2.x **Description** A Broken Object-Level Authorization (BOLA) exists in the '/Settings/UserController.php' endpoint. This allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover by supplying a crafted HTTP request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Krayin CRM versions 2.2.x and earlier **Description** An authenticated arbitrary file upload flaw exists in the `/admin/tinymce/upload` endpoint. This issue allows an authenticated attacker to upload a crafted PHP file, leading to remote code execution (RCE) and potential full system compromise. The flaw is associated with the TinyMCE upload component. Approximately 2,700 services have been identified as potentially exposed. **Recommendations** Restrict access to the admin panel to minimize the risk of exploitation. Mitigate script execution within the upload paths. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Webkul Krayin CRM versions 2.2.x **Description** A Broken Object-Level Authorization (BOLA) issue exists in the '/Contact/Persons/PersonController.php' endpoint. This allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users by supplying a crafted GET request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Snipe-IT version 8.4.0 **Description** Improper authorization in the '/api/v1/users/{id}' endpoint allows authenticated attackers with the `users.edit` permission to modify sensitive authentication and account-state fields of other non-admin users by sending a crafted PUT request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Webkul Krayin CRM versions 2.2.x **Description** A Broken Object-Level Authorization (BOLA) exists in the '/Controllers/Lead/LeadController.php' endpoint. This allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users by supplying a crafted GET request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Webkul Krayin CRM versions 2.2.x **Description** A Server-Side Request Forgery (SSRF) exists in the '/settings/webhooks/create' component. This allows attackers to scan internal resources by sending a specially crafted POST request. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.