Server-Side Request Forgery in API Checker leads to Privilege Escalation

Cross-Site Request Forgery on Extension Pages

SQL Injection in Custom Fields leads to Database Compromise

SQL Injection in Module Search leads to Database Compromise

OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution

OS Command Injection in Network Report leads to Remote Code Execution

QuickShell Authenticated Command Injection

Post-auth Arbitrary File Read in the Server Plugins Section

SQL Injection in CSV Module Data Collection

SQL Injection in Visual Console

Uploading executables via the file manager

Linux Local Privilege Escalation Via GoTTY Page

Remote Code Execution via File Uploader

Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager

Stored Cross-Site Scripting via Directory Name in File Manager Create Directory

Session Fixation in Authentication leads to Session Hijacking

CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

Arbitrary File Read As Root Via GoTTY Page

Misassignment of privileges can cause DOS attack

Arbitrary File Read

CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager

SQL Injection in Grafana Integration Endpoint (query.php)

OS Command Injection in Event Response Execution

Unrestricted File Upload in Extension Uploader leads to Remote Code Execution

Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure