Vulnerabilities we have found and responsibly disclosed in widely used software. Original research, coordinated disclosure, and the CVEs that come out of it.
A stored XSS (CWE-79) in Chamilo's self-registration form. A null byte hidden inside an event handler defeats HTMLPurifier, and the admin user list renders the stored name without escaping — firing the payload in an administrator's session and enabling full platform admin takeover. CVSS 9.3 Critical. Found by Voke Cyber, fixed in 1.11.40.
An insecure direct object reference (CWE-639/CWE-862) in Coolify's service views lets any authenticated user on a shared instance access, modify, and redeploy services belonging to other teams — including container image swaps that lead to remote code execution. CVSS 8.8 High. Found by Voke Cyber, fixed in v4.1.1.
A stored cross-site scripting flaw (CWE-79) in HeyForm's form builder lets any team member implant a persistent payload enabling full team ownership takeover. Fixed in commit cc97d27 with no public advisory published. Found by Voke Cyber.
An incorrect-authorization flaw (CWE-863) in Snipe-IT lets a user with only the users.edit permission lock every administrator out of the instance. Found by Voke Cyber and fixed in Snipe-IT 8.6.0.
An authorization bypass (CWE-862) in GLPI's planning module lets a technician-level user delete any object in the instance. Found by Voke Cyber and fixed in GLPI 10.0.25 and 11.0.7.
The manual, by-hand testing that finds bugs like this is exactly what we do for clients across the Charlotte, NC area and nationwide.
Get a Quote