CVE-2025-71419
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.
वीकनेस
UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.
संदर्भ
- https://github.com/uvdesk/community-skeleton/releases/tag/v1.1.8
- https://github.com/uvdesk/core-framework
- https://github.com/uvdesk/core-framework/blob/v1.1.6/Controller/SwiftMailer.php#L38-L46
- https://github.com/uvdesk/core-framework/blob/v1.1.6/Resources/views/SwiftMailer/manageConfigurations.html.twig#L324
- https://github.com/uvdesk/core-framework/commit/e5e92d1f5bdb24d1b96751213fb427035736371f
- https://github.com/uvdesk/core-framework/releases/tag/v1.1.7
हमलावर से पहले बग आप ढूँढें।
GitHub से साइन इन करें और एक मिनट से भी कम में अपना पहला ऑडिट चलाएँ। फ़्री प्लान के लिए क्रेडिट कार्ड की ज़रूरत नहीं।