PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass Summary praisonai-platform lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner/admin authorization. For...

GHSA-C78W-2Q4R-68R7 PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass Summary praisonai-platform lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner/admin authorization. For...

CVE-2025-56450

Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the leadid parameter in the /l2s/api/selfcareLeadHistory endpoint. A remote attacker can exploit this by sending a specially crafted POST request, resulting in the execution of arbitrary SQL queries. T...

CVE-2025-56450

Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the leadid parameter in the /l2s/api/selfcareLeadHistory endpoint. A remote attacker can exploit this by sending a specially crafted POST request, resulting in the execution of arbitrary SQL queries. T...

CVE-2025-56450

Log2Space Subscriber Management Software 1.1 is vulnerable to an unauthenticated SQL injection vulnerability in the /l2s/api/selfcareLeadHistory endpoint. The root cause is a failure to sanitize the lead_id parameter, which allows a remote attacker to send a specially crafted POST request to exec...

CVE-2025-56450: Improper Neutralization of Special Elements used in an SQL Command

Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the leadid parameter in the /l2s/api/selfcareLeadHistory endpoint. A remote attacker can exploit this by sending a specially crafted POST request, resulting in the execution of arbitrary SQL queries. T...