CVE Vulnerability Catalog

A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument transaction_idS leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

A flaw was found in onetwothreeneth HospitalManagementSystem in the update_subaccount function of php/controller.php (Account Administration component). Manipulating the user_id argument causes improper authorization, and the vulnerability can be exploited remotely. The exploit has been published and may be used.

In Plane (versions 0.13 to 1.4.0), the InstanceAdminSignUpEndpoint uses InstanceAdmin.objects.first() for the first-admin check and creates accounts without an atomic transaction, row lock, or uniqueness guard. Two concurrent unauthenticated requests with different email addresses can both observe no instance administrator exists, create separate accounts, and receive sessions with instance-admin authority.

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is already assigned to a cycle, the operation removes it from the victim's cycle, causing a destructive cross-tenant write. This issue is fixed in 1.4.0.

In Plane prior to 1.4.0, the GET /api/workspaces/{slug}/entity-search/?query_type=user_mention endpoint returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even if not a member. It also exposes ProjectMember rows under the same condition, because SearchEndpoint inherits BaseAPIView with only permission_classes = [IsAuthenticated] and performs no workspace-membership check.

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission decorator on each endpoint validates only that the caller is a member or administrator of the workspace and project named in the URL. BulkDeleteIssuesEndpoint can destroy CycleIssue and ModuleIssue associations belonging to foreign issues. SubIssuesEndpoint can re-parent foreign issues under an attacker-selected issue and return the foreign issues' metadata. This issue is fixed in 1.4.0.

In Plane prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace via PATCH /api/workspaces/{slug}/projects/{project_id}/estimates/{estimate_id}/, and inject comments into an issue from another workspace via POST /api/workspaces/{slug}/projects/{project_id}/issues/{issue_id}/comments/. ProjectEntityPermission verifies membership from the URL, but estimate_id and issue_id are fetched by primary key without confirming the same scope.

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace on the instance, leaking issue metadata through activity events. This issue is fixed in 1.4.0.

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a project in another workspace when the victim project UUID is known. This violates tenant isolation and permits unauthorized cross-workspace changes to project metadata and configuration. This issue is fixed in 1.4.0.

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{slug}/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether the requester belongs to each project. Any authenticated workspace member, including a Guest with access to only one project, can enumerate names, descriptions, sprint dates, issue counts, progress snapshots, external integration IDs, linked URLs, and member lists for cycles and modules in private projects. The sibling WorkspaceLabelsEndpoint and WorkspaceStatesEndpoint apply the correct filter, making the cycle and module endpoints inconsistent outliers. This issue is fixed in 1.4.0.

Prior to version 1.4.0 of the Plane tool, the GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ endpoint exposes the full project member roster, including email addresses, names, avatars, and roles. The ProjectMemberPermission access control only checks whether the caller is an active member of any project in the workspace, but does not bind the check to the specific project_id. As a result, any authenticated user belonging to one project, including a Guest, can read the roster of another private project in the same workspace.

Prior to version 1.4.0 of the Plane tool, the WorkspaceOwnerPermission does not require is_active=True when checking whether a user is a workspace owner. A deactivated user can therefore remain authorized as the workspace owner and retain owner-level access.

Prior to version 1.4.0 of the Plane tool, the GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint allows downloading project-bound files without enforcing access to the owning project. An authenticated user from the same workspace, not a member of the secret project, knowing the asset UUID, can receive a 302 redirect to a signed download URL. Affected types include ISSUE_ATTACHMENT, COMMENT_DESCRIPTION, PAGE_DESCRIPTION, and PROJECT_COVER.

Prior to version 1.4.0 of the Plane tool, the unauthenticated public issues endpoint accepts group_by and sub_group_by query parameters without an allowlist and passes them to grouped paginators, where they are used as ORM field names. An attacker can supply arbitrary field paths that trigger unhandled FieldError or KeyError and HTTP 500 responses, or use them as a blind traversal oracle. The earlier fix for order_by did not cover these parameters.

Prior to version 1.4.0 of the Plane tool, a Project Member with role 15 can send a PATCH request to the project-member update endpoint and change another user's project role. The role-update logic blocks only a new role higher than the requester's role, so assigning the equal Member role bypasses the validation and promotes a Project Guest with role 5 to Member without Project Admin approval.

Prior to version 1.4.0 of the Plane tool, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace.

Prior to version 1.4.0 of the Plane tool, the GET /api/users/api-tokens/ endpoint allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/{token_id}/ allows modifying the allowed_rate_limit field without server-side validation. A user can raise the limit arbitrarily and bypass API rate-limiting controls, enabling high-volume automated requests and potential resource exhaustion.

The Joomla extension TF Content versions 2.9.0 - 2.9.4 exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.

The Joomla extension Event Gallery versions < 6.6.0 contains a server-side request forgery vulnerability in the Google Photos picker on the back-end upload page. The picker fetches thumbnails of picked images through the server, using the OAuth access token of the Google Photos account. The task takes the address from the request without checking it and asks for no form token. A prepared page on another web site could make the server send the access token to any address, or fetch addresses inside the server's network, in the name of a logged in administrator.

adm-zip prior to 0.6.1 applies Unix permission bits from a zip entry directly to the extracted file via fs.chmodSync() when keepOriginalPermission=true is passed to extractAllTo()/extractEntryTo() — and never filters out setuid/setgid/sticky bits. A crafted zip can produce an extracted binary with mode 04755, leading to attacker code execution as root when extraction runs as root.