CVE-2024-48590

Inflectra SpiraTeam 7.2.00 is vulnerable to a Server-Side Request Forgery (SSRF) via the NewsReaderService component. An attacker can send specially crafted requests to this service, prompting the server to make unintended requests. This vulnerability can lead to elevation of privileges and infor...

CVE-2024-48591

Inflectra SpiraTeam version 7.2.00 is vulnerable to Cross-Site Scripting (XSS) within the TestRuns section . The root cause is the ability to upload specially crafted SVG files that execute JavaScript when viewed directly. This vulnerability could potentially lead to an escalation of privileges ....