pyuysig

Summary

Nginx Proxy Manager 2.14.0 returns private TLS key material through the certificate download API. A user with certificate read access can download a ZIP archive containing privkey.pem for the selected certificate.

Details

The route GET /api/nginx/certificates/:certificate_id/download is handled by backend/internal/certificate.js::download(). The handler packages files from the live certificate directory into a ZIP archive.

The authorization boundary is certificate read access, such as the certificates:get capability for the target certificate. The returned archive includes private key files from the certificate directory instead of limiting the response to public certificate or chain material.

The affected object is the private key associated with the selected Nginx Proxy Manager certificate. This issue is distinct from creating or importing a certificate; the disclosure occurs through the existing download endpoint.

pyuysig

Summary

Filestash 0.4.0 exposes its admin configuration API during first-run setup while auth.admin is unset. A remote attacker who reaches the instance before setup completes can set the administrator password hash and take over the admin plane.

Details

The AdminOnly middleware only enforces the admin cookie check when auth.admin is non-empty. During initial setup, auth.admin is empty, so /admin/api/config proceeds without an admin session.

GET /admin/api/session also reports an authenticated state in that setup condition. The configuration update handler accepts JSON, overwrites config.json, and reloads configuration immediately.

The attacker-controlled input is the submitted config JSON, specifically the auth.admin password hash. The missing boundary is external access control around first-run setup before the application has an administrator credential to enforce.

pyuysig

Summary

grocy 4.6.0 concatenates the authenticated product-group query parameter into the stock spending report SQL when group-by=product is used. A logged-in user can inject SQL into the report query path.

Details

StockReportsController::Spendings handles /stockreports/spendings. When group-by=product and product-group is neither all nor ungrouped, the controller appends the submitted product-group value into the SQL WHERE clause instead of validating it as a product group identifier or binding it as a parameter.

The resulting SQL reaches Grocy\Services\DatabaseService::ExecuteDbQuery(). In the audited path, the raw SQL is executed before query results are fetched, so attacker-controlled SQL can affect the report query.

A previously explored custom include code-execution chain was not confirmed on the current target. Exact custom_js.html and custom_css.html attachment attempts hit file is not a database errors, so this advisory is limited to the confirmed SQL injection

pyuysig

Summary

LLDAP 0.6.2 panics while processing malformed refresh-token header bytes on refresh and logout routes. A remote unauthenticated request can crash the HTTP worker and sustain denial of service under the default single-worker configuration.

Details

The /auth/refresh and /auth/logout handlers call get_refresh_token() in server/src/auth_service.rs. That helper accepts a refresh-token header as an alternate token source.

When the header is present, get_refresh_token() calls HeaderValue::to_str().unwrap() before token parsing. HTTP header values can contain opaque non-ASCII bytes that are rejected by to_str().

The attacker-controlled input is the raw refresh-token header value. Instead of returning an authentication error for malformed header bytes, the unwrap() panics and drops the request path.

pyuysig

Summary

Koillection 1.8.0 lets a regular authenticated user submit arbitrary scraper target URLs and user-defined extraction rules. The server fetches the target URL and returns selected response content in JSON output.

Details

The custom scraper subsystem exposes endpoints such as /scrapers/item-scrapers/scrap, /scrapers/collection-scrapers/scrap, and /scrapers/wish-scrapers/scrap to authenticated users with the scraping feature enabled. In 1.8.0, the scraping feature is enabled by default for users.

A user-owned scraper definition can include custom request headers and Path.path extraction values. The scraper service sends an outbound request to the submitted url, applies the user-defined XPath or path rules to the response, and serializes the extracted values back to the client.

The attacker-controlled inputs are the target url, optional headers, and extraction paths. The missing boundary is a target allowlist or internal-address block before the server-side fetch, combined with retu

pyuysig

Summary

Shlink 5.0.1 can fetch an authenticated user's longUrl from the server side during automatic short URL title resolution. When AUTO_RESOLVE_TITLES is enabled and no explicit title is supplied, a valid API key can trigger requests to internal destinations.

Details

Short URL create and edit flows pass the submitted longUrl into the short URL title-resolution helper when automatic title resolution is enabled. The helper issues a server-side GET request through the configured HTTP client and extracts the page title from the response.

The create/edit request controls longUrl, and the reachability condition is AUTO_RESOLVE_TITLES being enabled with no explicit title in the request. The long URL validation accepts URL-shaped values and does not enforce an internal-address block before the title fetch.

The returned page title can be stored or returned with the short URL. This makes the issue both an outbound request primitive and a limited response-content disclosure primitive through th

pyuysig

Summary

Firefly III 6.5.9 allows a low-privileged authenticated API user to create and trigger webhooks on deployments where webhooks are enabled. Because loopback webhook URLs are accepted, the user can cause server-side POST requests to localhost or other reachable internal HTTP services.

Details

The webhook create and update API request classes use normal authenticated-user handling and leave the accepted role list empty instead of enforcing the dedicated webhook management role. The codebase defines webhook roles, but the create, update, and trigger paths do not require that role in the affected flow.

Once the user can create a webhook, the submitted url reaches the webhook URL validator. That validator resolves the hostname and explicitly accepts IPv4 loopback addresses in 127.0.0.0/8.

StandardWebhookSender later revalidates the stored URL and sends a server-side Guzzle POST to it. The same user can create an attacker-owned transaction group and call `POST /api/v1/webhooks/{webhook}/tr

pyuysig

Summary

Sismics Docs (Teedy) 1.11 merges the untrusted share query parameter into ACL target evaluation for read endpoints. An unauthenticated or low-privileged requester who knows a valid document or file identifier can use reserved administrator target values to bypass read authorization.

Details

Anonymous requests receive an AnonymousPrincipal, so share-capable read paths still build an ACL target list. BaseResource.getTargetIdList(shareId) appends the raw share value to that list.

AclDao.checkPermission(...) calls SecurityUtil.skipAclCheck(targetIdList) before checking ACL rows. SecurityUtil.skipAclCheck(...) returns true when the target list contains the literal identifiers admin or administrators.

Because the request-controlled share value can be one of those reserved strings, read authorization is skipped without requiring a real share object. The affected read paths include document view, file list, file download, file ZIP export, exported document output, and comment li

pyuysig

Summary

statping-ng 0.93.0 treats any valid user API key as full authentication for routes protected by the admin middleware. A non-admin user API key can be used to invoke administrative endpoints such as user creation.

Details

handlers/authentication.go::hasAPIQuery() accepts the api query parameter when it matches either the global core.App.ApiSecret or a value in users.api_key. It does not require the matched user key to belong to an administrator.

handlers/handlers.go::IsFullAuthenticated() accepts hasAPIQuery() as sufficient full authentication. Routes such as POST /api/users are protected by authenticated(...), so they trust that result before any administrator-role boundary is enforced.

The attacker-controlled input is the api query parameter containing a normal user's API key. The missing rule is distinguishing user API keys from administrator-grade credentials before allowing admin-only route handlers to run.

pyuysig

Summary

wastebin 3.4.1 returns unescaped long paste lines from the syntax highlighting fallback and renders them as trusted HTML. An attacker can store raw HTML in the formatted paste page.

Details

In crates/wastebin_highlight/src/highlight.rs, the highlighter uses a fallback for lines longer than the configured threshold. That fallback returns line.to_string() instead of an escaped representation.

The formatted paste template then renders the produced HTML as trusted content. For a line longer than 2048 characters, attacker-controlled HTML metacharacters can therefore move from paste text into the rendered DOM.

The default content security policy can limit direct inline script execution. The confirmed boundary is stored raw HTML injection in the formatted paste page, not a claim that every browser context executes inline JavaScript.