CVE-2026-67395: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directory restrictions and access files outside the...

PT-2026-84073

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directory restrictions and access files outside the...

EUVD-2026-65177

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78435

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78435 Faveo Helpdesk Logo SettingsController.php unlink path traversal

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78435 Faveo Helpdesk Logo SettingsController.php unlink path traversal

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78435

A path traversal vulnerability exists in Faveo Helpdesk up to version 2.0.3 . The flaw is in the unlink function within app/Http/Controllers/Admin/helpdesk/SettingsController.php (component: Logo Handler ). Manipulation of the data1 argument allows an authenticated attacker (high privileges requi...

CVE-2026-78435 Faveo Helpdesk Logo SettingsController.php unlink path traversal

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78337

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

EUVD-2026-64825

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2026-78337

Roskus Prospero Flow CRM versions before 5.15.13 are affected by an unrestricted file upload in the company logo feature. An authenticated user with create company and update company permissions can upload an SVG document containing an embedded script element , resulting in stored cross-site scri...

CVE-2026-78337 Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2026-78337 Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2026-78337 Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2026-78435: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

PT-2026-80804

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

CVE-2026-78337: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an...

PT-2026-81066

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-57262

A vulnerability has been identified in LOGO! Soft Comfort All versions V9. Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker to extract the master key from the application files or memory and use it to decrypt project files or...

CVE-2026-57263

A vulnerability has been identified in LOGO! Soft Comfort All versions V9. The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allow an attacker who has obtained the project file to perform efficient offline dictionary or brute-force...