CVE-2020-15849

Re:Desk 2.3 contains a blind authenticated SQL injection in the SettingsController::actionEmailTemplates() method. A user with admin access could retrieve sensitive data, bypass authorization, and modify password-reset tokens, potentially leading to account takeovers. The issue could also enable ...

PT-2020-14667

Name of the Vulnerable Software and Affected Versions Re:Desk version 2.3 Description The issue allows a malicious actor with administrative access to exploit a blind authenticated SQL injection vulnerability in the SettingsController class, specifically in the actionEmailTemplates method. This...