| Package | Affected versions | Patched versions |
|---|---|---|
| ledgersmb | ≥ 1.1.0, ≤ 1.1.12≥ 1.2.0, ≤ 1.2.26≥ 1.3.0, ≤ 1.3.47≥ 1.4.0, ≤ 1.4.42≥ 1.5.0, ≤ 1.5.30≥ 1.6.0, ≤ 1.6.33≥ 1.7.0, ≤ 1.7.32≥ 1.8.0, ≤ 1.8.17 |
LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free