Vendors / crater-invoice Records 13 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 8
Exploited now crater-invoice records in CISA KEV No crater-invoice vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 52
/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image.
CVSS 3.1 HIGH 7.2· Network · High privileges · No interaction · EPSS 0.23799 · Published 2023-10-30 · No fix listed CWE-94
Priority MEDIUM 41
crater is vulnerable to Unrestricted Upload of File with Dangerous Type
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01522 · Published 2022-01-12 · Fixed in 6.0.0 CWE-434
Priority LOW 36
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.
CVSS 3.1 HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00925 · Published 2022-03-23 · Fixed in 6.0.6 CWE-434
Priority LOW 35
Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.
CVSS 3.1 HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01604 · Published 2022-03-29 · Fixed in 6.0.6 CWE-502
Priority LOW 35
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
CVSS 3.1 HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01413 · Published 2022-01-17 · Fixed in 6.0 CWE-434
Priority LOW 31
Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00956 · Published 2022-03-21 · Fixed in 6.0.5 CWE-840
Priority LOW 26
Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01213 · Published 2022-01-26 · Fixed in 6.0.2 CWE-284
Priority LOW 25
Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00613 · Published 2022-01-27 · Fixed in 6.0.2, 6.0.0 CWE-79
Priority LOW 20
Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.
CVSS 3.1 MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00429 · Published 2022-03-21 · Fixed in 6.0.4 CWE-352
Open these records in search → All records by CVSS severity
0 8 5 0 0
THREATIST.IORead the docs