64 matches found
Crater-CVE-2023-46865-RCE
Crater-CVE-2023-46865-RCE Crater =6.0.6, CVE-2023-46865 Post-Auth RCE Superadmin Descrizione della vulnerabilità Crater Invoice è vulnerabile al caricamento di file senza restrizioni con tipo pericoloso a causa della mancanza di una corretta validazione dell'input. La classe di controllo Base64Mi...
CVE-2026-57863
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...
CVE-2026-57863 Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...
CVE-2026-57863
Crater Invoice (through 6.0.6 ) contains a path traversal vulnerability in its self-update API. The root cause is unsanitized ZIP entry names containing ../ sequences passed to PHP's ZipArchive::extractTo(), allowing authenticated company owners to write arbitrary files outside the intended extra...
EUVD-2026-65478
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...
CVE-2026-57863 Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...
CVE-2026-14791 crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting
A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attac...
CVE-2026-14791
CVE-2026-14791 affects crater-invoice-inc crater up to 6.0.6. The vulnerability exists in the function getFormattedString of app/Http/Requests/InvoicesRequest.php within the Invoice Note Handler . Manipulating the argument notes may lead to cross-site scripting (XSS) . The attack can be launched ...
EUVD-2026-41802
A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attac...
CVE-2022-0515
Cross-Site Request Forgery CSRF in GitHub repository crater-invoice/crater prior to 6.0.4...
CVE-2022-0242
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0...
EUVD-2022-15643
Malicious code in bioql PyPI...
EUVD-2022-15642
Malicious code in bioql PyPI...
EUVD-2022-24382
Malicious code in bioql PyPI...
EUVD-2022-0491
Malicious code in bioql PyPI...
EUVD-2022-0743
Malicious code in bioql PyPI...
CVE-2024-55556
A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APPKEY to achieve remote command execution on the server by manipulating the laravelsession cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this...
CVE-2022-0514
Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5...