EUVD-2026-120545

Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to...

CVE-2026-125382

Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to...

CVE-2026-125382: RamonSilva20 mapos: Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows…

Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to...

CVE-2026-125382

Map-OS versions 5.0.0 to before 5.2.2 are vulnerable to a privilege escalation flaw in the REST users API . Non-administrator operators with the cUsuario permission can bypass permission-delegation and super-administrator protections. By sending POST , PUT , or DELETE requests to /api/v1/usuarios...

CVE-2026-125382 Map-OS 5.0.0 to before 5.2.2 Privilege Escalation via /api/v1/usuarios

Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to...

PT-2026-141205

Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to...

CVE-2024-35545

MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting XSS vulnerability...

CVE-2024-36819

MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting XSS. This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee...

CVE-2024-35545

MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting XSS vulnerability...

CVE-2024-35545: Improper Neutralization of Input During Web Page Generation

MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting XSS vulnerability...

CVE-2024-35545

MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting XSS vulnerability...

CVE-2024-35545

MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting XSS vulnerability...

PT-2024-26533 · Mapos · Mapos

Name of the Vulnerable Software and Affected Versions: MAP-OS versions 4.45.0 and earlier Description: The issue is related to a cross-site scripting XSS vulnerability. Cross-site scripting is a type of security vulnerability that occurs when an attacker is able to inject malicious scripts into a...

CVE-2024-35545

MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting XSS vulnerability...

CVE-2024-35545

MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting XSS vulnerability...

CVE-2024-35545

The service order control system MAP-OS (developed by Ramon Silva) version v4.45.0 and earlier is vulnerable to a cross-site scripting (XSS) flaw. This vulnerability occurs due to the improper neutralization of input during web page generation , which could allow an attacker to inject malicious s...

CVE-2024-36819

MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting XSS. This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee...

PT-2024-27168 · Mapos · Mapos

Name of the Vulnerable Software and Affected Versions: MAP-OS versions 4.45.0 and earlier Description: The issue allows malicious users to insert a malicious payload into the Client Name input, resulting in unauthorized script execution on the administrator and employee dashboards when a service...

CVE-2024-36819

MAP-OS versions 4.45.0 and earlier are vulnerable to a Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. A malicious user can insert a payload into the Client Name input field. When a service order is created for that client, the payload executes ...

CVE-2024-36819

MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting XSS. This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee...