CVE-2023-25260

CVE-2023-25260 affects Stimulsoft Designer (Web) 2023.1.3 and is described in connected documents as vulnerable to a Local File Inclusion (LFI) issue. The sources consistently identify the affected product and vulnerability type but provide no detailed technical specifics (e.g., exact vulnerable ...

CVE-2023-25262

CVE-2023-25262 affects Stimulsoft Designer (Web) 2023.1.3. The issue is an SSRF in the Reporting Designer (Web): when a user embeds sources from external locations, the server performs the request, potentially causing outbound traffic and data import, with possible exfiltration of internal-networ...

CVE-2023-25263

Stimulsoft Designer (Desktop) 2023.1.4–2023.1.5 is affected. Decompiling Stimulsoft.report.dll allows an attacker to decrypt any connection string stored in .mrt files due to a static secret used across tested versions and OSes. Root cause: hard-coded/static secret in the DLL enables bypassing op...

CVE-2023-25261

CVE-2023-25261 affects Stimulsoft products: Desktop 2023.1.4; Web 2023.1.3 (Designer and Viewer). The issue enables Remote Code Execution by permitting unrestricted access to the local file system, allowing an attacker to read/write local directories/files and potentially render collected data vi...