PT-2025-11502

Name of the Vulnerable Software and Affected Versions FileCloud version 23.241.2 Description A stored cross-site scripting XSS issue in the Send for Approval function allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations For version 23.241.2, consider...

CVE-2025-26127: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

GHSA-335X-5WCM-8JV2 Backoffice User can bypass "Publish" restriction

Impact Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Explanation of the vulnerability Backoffice users without permission to publish content, but only to send for approval, can bypass the restriction by modifying the request...

Backoffice User can bypass "Publish" restriction

Impact Backoffice users with send for approval permission but not publish permission are able to publish in some scenarios. Explanation of the vulnerability Backoffice users without permission to publish content, but only to send for approval, can bypass the restriction by modifying the request...