41 matches found
CVE-2026-54596
CVE-2026-54596 - Authenticated SQL Injection via recurringinvoicefrequency Parameter Enables Full Database Exfiltration Severity: High Advisory: GHSA-f9m3-qjc9-v27j Fixed in: Commit 7211426 Author: iltosec Summary An SQL injection vulnerability in ITFlow's recurring invoice creation endpoint allo...
CVE-2026-54597
CVE-2026-54597 - ITFlow Time-Based Blind SQL Injection Severity: High Advisory: GHSA-m63v-j7fw-hq2h Affected: ITFlow agent/ajax.php — expires parameter Fixed in: Commit 63d8691 Author: iltosec Summary A time-based blind SQL injection vulnerability in ITFlow's share link generation handler. The...
CVE-2026-97735
ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...
CVE-2026-97735
Versions of ITFlow before 26.08 are vulnerable to a flaw in the ticket email parser (cron/ticket_email_parser.php). The software allows SVG attachments in email messages arriving over SMTP from arbitrary senders. This vulnerability could allow an attacker to process malicious SVG files, potential...
CVE-2026-97735
ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...
CVE-2026-97735
ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...
CVE-2026-97735
ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...
EUVD-2026-86514
ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...
CVE-2026-54597
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...
CVE-2026-54596
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...
EUVD-2026-82470
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...
CVE-2026-54597 ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...
CVE-2026-54597 ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...
CVE-2026-54597 ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...
CVE-2026-54597
ITFlow , an IT documentation and ticketing system for managed service providers, is vulnerable to an authenticated time-based blind SQL injection via the expires GET parameter in the share_generate_link handler of agent/ajax.php. The root cause is that sanitizeInput applies string-context escapin...
CVE-2026-54596 ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...
CVE-2026-54596 ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...
CVE-2026-54596 ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...
CVE-2026-54596
ITFlow , an IT documentation, ticketing, and accounting platform for managed service providers, is affected by an authenticated SQL injection in its recurring invoice endpoint (agent/post/recurring_invoice.php). The recurring_invoice_frequency parameter passes through sanitizeInput but is interpo...
EUVD-2026-82469
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...