CVE-2024-55417

DevDojo Voyager versions through 1.8.0 are vulnerable to a file type verification bypass in the /admin/media/upload endpoint. An authenticated user can exploit this flaw to upload a web shell, leading to arbitrary code execution on the server with web server privileges. To remediate this vulnerab...

CVE-2024-55416

DevDojo Voyager version 1.8.0 and earlier is vulnerable to reflected Cross-Site Scripting (XSS) via the /admin/compass endpoint. The root cause is improper input sanitization, which allows user-supplied input to be reflected in the response without sufficient encoding or filtering. An authenticat...

CVE-2024-55415

DevDojo Voyager (through version 1.8.0 ) is vulnerable to a path traversal flaw located at the /admin/compass endpoint. The root cause stems from improper validation of user-supplied input, which allows an attacker to traverse directories and access restricted files. This vulnerability can lead t...

CVE-2019-17050

The Voyager package for Laravel (versions through 1.2.7 ) is vulnerable to unauthorized file access due to an authorization bypass . An attacker with admin privileges and Compass access can read or delete arbitrary files, specifically targeting sensitive files like .env . This could allow an atta...

CVE-2020-36070

CVE-2020-36070 affects Voyager (Yoyager) versions 1.4 and earlier. The vulnerability is described as an insecure permission issue that allows a remote attacker to execute arbitrary code by supplying a crafted PHP file to the media component. The issue is classified as critical (CVSS v3.1: 9.8, Ne...