CVE-2026-54597

CVE-2026-54597 - ITFlow Injection SQL aveugle basée sur le temps Gravité : Élevée Avis : GHSA-m63v-j7fw-hq2h Affecté : ITFlow agent/ajax.php — paramètre expires Corrigé dans : Commit 63d8691 Auteur : iltosec Résumé Une vulnérabilité d'injection SQL aveugle basée sur le temps dans le gestionnaire ...

CVE-2026-54596

CVE-2026-54596 - Injection SQL Authentifiée via le Paramètre recurringinvoicefrequency Permet l'Exfiltration Complète de la Base de Données Gravité : Élevée Avis : GHSA-f9m3-qjc9-v27j Corrigé dans : Commit 7211426 Auteur : iltosec Résumé Une vulnérabilité d'injection SQL dans le point de...

CVE-2026-97735

ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...

CVE-2026-97735

ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...

EUVD-2026-86514

ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...

CVE-2026-97735

ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...

CVE-2026-97735

Versions of ITFlow before 26.08 are vulnerable to a flaw in the ticket email parser (cron/ticket_email_parser.php). The software allows SVG attachments in email messages arriving over SMTP from arbitrary senders. This vulnerability could allow an attacker to process malicious SVG files, potential...

CVE-2026-97735

ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...

PT-2026-98350

Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.08 Description The ticket email parser, located at the endpoint 'cron/ticket email parser.php', allows SVG attachments in email messages received via SMTP from arbitrary senders. Recommendations Update to version...

CVE-2026-97735: Improper Neutralization of Input During Web Page Generation

ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...

CVE-2026-54597

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

CVE-2026-54596

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-54597 ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

CVE-2026-54597

ITFlow , an IT documentation and ticketing system for managed service providers, is vulnerable to an authenticated time-based blind SQL injection via the expires GET parameter in the share_generate_link handler of agent/ajax.php. The root cause is that sanitizeInput applies string-context escapin...

CVE-2026-54597 ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

CVE-2026-54597 ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

EUVD-2026-82470

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

CVE-2026-54596 ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-54596 ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-54596

ITFlow , an IT documentation, ticketing, and accounting platform for managed service providers, is affected by an authenticated SQL injection in its recurring invoice endpoint (agent/post/recurring_invoice.php). The recurring_invoice_frequency parameter passes through sanitizeInput but is interpo...