Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Affected Versions: Tested on current dev branch (build fingerprint 505[...]7bd86) CVSS v4 Score: 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) Privileges Required: Web application admin account (for file write), any authenticated user (for RCE trigger) --- Summary Two separate vulnerabilities in Idno can be chained to achieve RCE from a web application admin account. A web application admin can cause the server to fetch an attacker-controlled URL during WordPress import processing, writing a PHP file to the server's temp directory. The admin or a separate, lower-privileged authenticated user can then trigger inclusion of that file via an unsanitized template name parameter, executing arbitrary operating system commands as the web server user. --- Vulnerability 1: Arbitrary PHP File Write via WordPress Import (SSRF + File Write) Location Idno/Core/Migration.php — importImagesFromBodyHTML() Required Privilege Web application admin (any user with the admin flag…
Recommended action: Upgrade to 1.6.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoint itself, this allows an attacker to force the server to make arbitrary outbound HTTP requests to any host, including internal network addresses and cloud instance metadata services, and retrieve the response content. Component: Idno/Pages/Service/Web/UrlUnfurl.php, Idno/Core/Session.php, Idno/Core/Actions.php Vulnerability Class: Server-Side Request Forgery (SSRF) Authentication Required: None CVSSv4 Base Score: 9.2 (High) - AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Affected Endpoint: GET /service/web/unfurl?url=<attacker-controlled-url Handled by Idno\Pages\Service\Web\UrlUnfurl::getContent(). Affected Versions: <= 1.6.3 Code Flow Step 1 — Endpoint access control UrlUnfurl::getContent() (UrlUnfurl.php:36) enforces two access…
Recommended action: Upgrade to 1.6.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Critical Broken Authentication vulnerability exists in Known 1.6.2. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. Details The vulnerability occurs within the password reset flow. When a reset is requested, the application generates a verification code. However, the subsequent reset page (/account/password/reset/) incorrectly reflects this code back to the client in the HTML source code. Specifically, the sensitive token is embedded in: <input type="hidden" name="code" value="[SECRETTOKEN]" Because this page is accessible via a GET request using the victim's email as a parameter, an attacker can programmatically extract the token. PoC 1. The attacker asks for a password reset for the victim <img…
Recommended action: Upgrade to 1.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.