Craterapp: >> Crater >> 3.1.1 Security Vulnerabilities
/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image.
CVSS Score
7.2
EPSS Score
0.682
Published
2023-10-30
Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.
CVSS Score
7.2
EPSS Score
0.004
Published
2022-03-29
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.
CVSS Score
7.2
EPSS Score
0.002
Published
2022-03-23
Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.
CVSS Score
6.5
EPSS Score
0.002
Published
2022-03-21
Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.
CVSS Score
4.3
EPSS Score
0.001
Published
2022-03-21
Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.
CVSS Score
7.6
EPSS Score
0.003
Published
2022-01-27
Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.
CVSS Score
7.5
EPSS Score
0.003
Published
2022-01-26
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
CVSS Score
7.2
EPSS Score
0.005
Published
2022-01-17
crater is vulnerable to Unrestricted Upload of File with Dangerous Type
CVSS Score
8.8
EPSS Score
0.004
Published
2022-01-12