GHSA-CV65-7CG8-R623 FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents

Summary The static file controllers in FacturaScripts decide whether a request is authorized by looking at the URL string instead of the canonical filesystem path. A request that starts with an allow-listed folder name but contains a ../ segment in the middle ends up serving a file from a differe...

FacturaScripts: Unauthenticated Path Traversal in Static File Controllers Reads Private MyFiles Documents

Summary The static file controllers in FacturaScripts decide whether a request is authorized by looking at the URL string instead of the canonical filesystem path. A request that starts with an allow-listed folder name but contains a ../ segment in the middle ends up serving a file from a differe...

PT-2026-58961

Summary The static file controllers in FacturaScripts decide whether a request is authorized by looking at the URL string instead of the canonical filesystem path. A request that starts with an allow-listed folder name but contains a ../ segment in the middle ends up serving a file from a differe...

PT-2026-60076

Summary The static file controllers in FacturaScripts decide whether a request is authorized by looking at the URL string instead of the canonical filesystem path. A request that starts with an allow-listed folder name but contains a ../ segment in the middle ends up serving a file from a differe...

CVE-2022-48326

Multiple Cross Site Scripting XSS vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: 1 nome, 2 aCliente, 3 eCliente, 4 dCliente, 5 vCliente, 6 aProduto, 7 eProduto, 8 dProduto, 9 vProduto, 10 aServico, 11 eServico, 12 dServico, 13 vServico...