CVE-2023-32761

CVE-2023-32761 is a CSRF vulnerability in Archer Platform prior to version 6.13. An authenticated attacker can execute arbitrary code via a crafted request. The issue is fixed in Archer Platform versions 6.12.0.6 and 6.13.0. No exploitation details are provided beyond the authenticated vector; no...

CVE-2023-32760

CVE-2023-32760 affects Archer Platform prior to version 6.13, with fixes in 6.12.0.6 and 6.13.0. An authenticated attacker could access sensitive information via API calls related to data feeds and data publication. The vulnerability’s impact and exact exploited components are described in the li...

CVE-2024-49209

CVE-2024-49209 affects Archer Platform 2024.03 through 2024.08. The vulnerability is an API authorization bypass related to supporting application files, allowing a remote unprivileged attacker to elevate privileges and upload additional system icons. Remediation: upgrade to Archer Platform 2024....

CVE-2024-26312

CVE-2024-26312 affects Archer Platform 6 prior to 2024.03. The vulnerability is described as a sensitive information disclosure that could be triggered by an authenticated user through a popup warning message, with the reported impact being partial disclosure of information (confidentiality: Low)...

CVE-2024-26310

Archer Platform 6.8 before 6.14 P2 (6.14.0.2) contains an improper access control vulnerability. A remote authenticated malicious user could exploit this to access API information that should only be accessible with extra privileges. The available sources describe the affected version range and t...

CVE-2024-41706

CVE-2024-41706 describes a stored XSS flaw in Archer Platform versions prior to 2024.06. A remote authenticated Archer user could store malicious HTML/JavaScript in a trusted application data store, which is then executed by victim users’ browsers in the vulnerable app context. Public details spe...

CVE-2024-26309

CVE-2024-26309 affects Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2). An unauthenticated attacker could disclose sensitive information via an internal URL due to a vulnerability in Archer Platform. Impact is described as information disclosure; attack vector is network with no privileges re...

CVE-2024-26313

Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a stored Cross-Site Scripting (XSS) vulnerability. A remote authenticated Archer user could store malicious HTML/JavaScript in a trusted data store, causing victim users’ browsers to execute code in the context of the vulnerable applica...

CVE-2024-41707

Archer Platform (v6) prior to 2024.06 is vulnerable to stored HTML content injection. Authenticated users can store malicious HTML in the trusted application data store, which is then executed by victim users’ browsers in the vulnerable app context. Remediation cited in available sources is to up...

CVE-2024-41705

Archer Platform is affected by CVE-2024-41705: a stored XSS in the web data store allows a remote authenticated Archer user to store malicious HTML/JavaScript that executes in the browser context when other users view the data store. Affected versions include 6.8 prior to 2024.06, with fixed rele...

CVE-2023-30639

Archer Platform is affected by a stored XSS vulnerability (CVE-2023-30639) in versions 6.8 through 6.12 P6 before HF1 (6.12.0.6.1). A remote authenticated Archer user could store malicious HTML/JavaScript in a trusted data store, which would be executed by other users’ browsers in the context of ...

CVE-2024-34092

CVE-2024-34092 affects Archer Platform 6 before 2024.04. The issue is an authentication mishandling where a lock did not terminate an existing session, allowing continued access. A fixed release is 6.14 P3 (6.14.0.3) and later. The CVSS metrics indicate a high impact to confidentiality, integrity...

CVE-2024-34093

Archer Platform 6 before 2024.03 is affected by an X-Forwarded-For Header Bypass vulnerability. The issue allows an unauthenticated attacker to bypass intended whitelisting when the X-Forwarded-For header is enabled. Affected software is Archer Platform (v6 prior to 2024.03); root cause is header...

CVE-2024-34090

CVE-2024-34090 affects Archer Platform 6 prior to 2024.04. The vulnerability is a stored cross-site scripting (XSS) flaw in the Archer Control Panel (ACP) login banner, where content was not properly escaped. This could allow an attacker with access to the ACP to inject and render malicious scrip...

CVE-2024-34091

Archer Platform 6 before 2024.04 contains a stored XSS vulnerability in the trusted application data store. A remote authenticated Archer user can store malicious HTML/JS, which executes in other users’ browsers and can render content inaccessible. A fixed release exists: 6.14.0.3 (and later). Re...

CVE-2024-34089

CVE-2024-34089 concerns Archer Platform 6 prior to 2024.04 with a stored cross-site scripting (XSS) flaw. A remote authenticated Archer user can inject malicious HTML/JavaScript into a trusted application data store, which is then executed by victims’ browsers in the vulnerable app’s context. The...

CVE-2025-27893

Archer Platform 6–6.14.00202.10024 is affected by CVE-2025-27893. An authenticated user with record-creation privileges can intercept and modify a Copy request to GenericContent/Record.aspx?id=, manipulating immutable fields (e.g., creation date). However, according to sources, when switching to ...

CVE-2024-49208

CVE-2024-49208 affects Archer Platform 2024.03 (before 2024.08). The vulnerability is an authorization bypass related to supporting application files, enabling a remote unprivileged attacker to potentially elevate privileges and delete system icons. The issue is confirmed across multiple feeds, i...

CVE-2024-26311

Archer Platform 6.x before 6.14 P2 HF1 (6.14.0.2.1) is affected by a reflected XSS vulnerability. A remote authenticated Archer user could trick a victim application user into submitting malicious JavaScript to the vulnerable web app, which is then reflected back and executed in the browser conte...

CVE-2024-49211

CVE-2024-49211 describes a Reflected XSS in the Dashboard Listing Archer Platform UX page for Archer Platform 6.x before 2024.08 . The vulnerability allows a remote, unauthenticated attacker to lure a victim user into submitting malicious HTML/JavaScript, which is then reflected and executed in t...

CVE-2024-49210

Summary: CVE-2024-49210 describes a reflected XSS in Archer Platform 6.x (prior to 2024.09) via the iView List Archer Platform UX page. An unauthenticated remote attacker could entice a user to submit malicious HTML/JavaScript, which is then reflected and executed in the victim’s browser within t...

CVE-2023-37223

CVE-2023-37223 affects Archer Platform. A Cross Site Scripting (XSS) vulnerability in versions prior to 6.13 allows a remote authenticated attacker to execute arbitrary code via a crafted script. The issue is mitigated by upgrading to Archer Platform 6.13.0 or later, and 6.12.0.6 is listed as a f...

CVE-2023-45357

CVE-2023-45357 affects Archer Platform 6.x prior to 6.13 P2 HF2 (6.13.0.2.2). An authenticated attacker can disclose sensitive information via a popup warning message. A fixed release is 6.14 (6.14.0). No exploitation details are provided in the documents. Remediation: upgrade to 6.14+. If upgrad...

CVE-2023-48641

CVE-2023-48641 affects Archer Platform 6.x prior to 6.14 P1 HF2 (6.14.0.1.2). The vulnerability is an insecure direct object reference that could allow an authenticated user in a multi‑instance deployment to bypass authorization by manipulating resource references in requests, gaining execute acc...

CVE-2023-32759

CVE-2023-32759 (Archer Platform) : The affected product is Archer Platform, prior to version 6.13. The issue allows an authenticated attacker to obtain sensitive information through a crafted URL. The root cause is not detailed in the provided documents beyond this exposure path. A fixed version ...

CVE-2023-37224

Archer Platform has a vulnerability (CVE-2023-37224) causing information disclosure via log files in versions prior to 6.13. It is fixed in 6.12.0.6 and 6.13.0. Upgrade to 6.12.0.6 or later (6.13.0 or newer) to remediate. The advisory does not specify exploitation details beyond authenticated acc...

CVE-2023-48642

CVE-2023-48642 affects Archer Platform 6.x up to 6.13 P2 (6.13.0.2). The issue is an authenticated HTML content injection vulnerability in the data store; a remote authenticated Archer user can store malicious HTML code in a trusted application data store, with victim users’ browsers executing it...

CVE-2023-45358

Archer Platform 6.x prior to 6.13 P2 HF2 (6.13.0.2.2) is affected by a stored XSS vulnerability. A remote authenticated Archer user can store malicious HTML/JavaScript in a trusted application data store, leading to execution in victims’ browsers in the context of the vulnerable application. The ...