https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 11:12:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-308637 EUVD-2026-308637 https://cve.radiocsirt.org/vuln/euvd-2026-308637 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32699 <p>FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable.</p> <p>FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32699 https://cve.radiocsirt.org/vuln/ghsa-pp79-hqv6-vmc3 <p><strong>Affected:</strong> Packagist: facturascripts/facturascripts</p> <p>### Summary The application fails to validate the ```nick``` parameter during a ```POST``` request to the ```EditUser``` controller. Although the UI prevents editing this field, a user can bypass this restriction using a proxy to rename any account (including the Administrator). This leads to Broken Access Control and potential Audit Log Corruption.</p> <p>### Details The vulnerability exists in the user update logic. When a ```POST``` request is sent to ```/EditUser```, the backend processes the ```nick``` form-data parameter without checking if it matches the original value or if the user has the privilege to change a unique identifier that is intended to be immutable.</p> <p>### PoC ***1.*** Log in to the dashboard as any user (e.g. admin user).</p> <p>***2.*** Go to your Profile by clicking your username/avatar in the top right.</p> <p>***3.*** Open Burp Suite and ensure Intercept is ON.</p> <p>***5.*** Click the Save button in the UI.</p> <p>***6.*** In Burp Suite, locate ```nick``` in the body:</p> <p>&lt;img width=&#34;1915&#34; height=&#34;1013&#34; alt=&#34;Screenshot_2026-03-04_05_26_32&#34; src=&#34;https://github.com/user-attachments/assets/aea4e6fd-beba-4a47-96da-8b9bd9075681&#34; /&gt;</p> <p>***7.*** Change the value admin to Vulnerable (or any other string).</p> <p>***8.*** Click Forward in Burp Suite.</p> <p>The application will log the user out. It is possible to now log back in using the username &#34;Vulnerable&#34; and the original password.</p> <p>### Impact An attacker can effectively sabotage the system’s audit trail, performing malicious actions and then…</p> <p><strong>Affected:</strong> Packagist: facturascripts/facturascripts</p> <p>### Summary The application fails to validate the ```nick``` parameter during a ```POST``` request to the ```EditUser``` controller. Although the UI prevents editing this field, a user can bypass this restriction using a proxy to rename any account (including the Administrator). This leads to Broken Access Control and potential Audit Log Corruption.</p> <p>### Details The vulnerability exists in the user update logic. When a ```POST``` request is sent to ```/EditUser```, the backend processes the ```nick``` form-data parameter without checking if it matches the original value or if the user has the privilege to change a unique identifier that is intended to be immutable.</p> <p>### PoC ***1.*** Log in to the dashboard as any user (e.g. admin user).</p> <p>***2.*** Go to your Profile by clicking your username/avatar in the top right.</p> <p>***3.*** Open Burp Suite and ensure Intercept is ON.</p> <p>***5.*** Click the Save button in the UI.</p> <p>***6.*** In Burp Suite, locate ```nick``` in the body:</p> <p>&lt;img width=&#34;1915&#34; height=&#34;1013&#34; alt=&#34;Screenshot_2026-03-04_05_26_32&#34; src=&#34;https://github.com/user-attachments/assets/aea4e6fd-beba-4a47-96da-8b9bd9075681&#34; /&gt;</p> <p>***7.*** Change the value admin to Vulnerable (or any other string).</p> <p>***8.*** Click Forward in Burp Suite.</p> <p>The application will log the user out. It is possible to now log back in using the username &#34;Vulnerable&#34; and the original password.</p> <p>### Impact An attacker can effectively sabotage the system’s audit trail, performing malicious actions and then…</p> https://cve.radiocsirt.org/vuln/ghsa-pp79-hqv6-vmc3