Search
Find a vulnerability
Search criteria
6 vulnerabilities by itflow-org
CVE-2026-54597 (GCVE-0-2026-54597)
Vulnerability from nvd – Published: 2026-09-17 20:34 – Updated: 2026-09-18 13:26
VLAI
EPSS
VEX
Title
ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter
Summary
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with module_support write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of the share_generate_link handler in agent/ajax.php. sanitizeInput applies string-context escaping, but expires is inserted unquoted into the item_expire_at MySQL INTERVAL expression, allowing a crafted expression and interval unit to execute conditional database queries whose results are inferred from response delays. This can expose password hashes, SMTP credentials, API keys, encrypted vault data, and database metadata and support administrative takeover after credential cracking. This issue is fixed in version 26.07.
Severity
8.3 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 13:25 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/itflow-org/itflow/security/adv… | x_refsource_CONFIRM |
| https://github.com/itflow-org/itflow/pull/1289 | x_refsource_MISC |
| https://github.com/itflow-org/itflow/commit/63d86… | x_refsource_MISC |
| https://github.com/itflow-org/itflow/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| itflow-org | itflow |
Affected:
< 26.07
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54597",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T13:25:43.723521Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T13:26:07.177Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/itflow-org/itflow/security/advisories/GHSA-m63v-j7fw-hq2h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "itflow",
"vendor": "itflow-org",
"versions": [
{
"status": "affected",
"version": "\u003c 26.07"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with module_support write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of the share_generate_link handler in agent/ajax.php. sanitizeInput applies string-context escaping, but expires is inserted unquoted into the item_expire_at MySQL INTERVAL expression, allowing a crafted expression and interval unit to execute conditional database queries whose results are inferred from response delays. This can expose password hashes, SMTP credentials, API keys, encrypted vault data, and database metadata and support administrative takeover after credential cracking. This issue is fixed in version 26.07."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T20:34:22.555Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/itflow-org/itflow/security/advisories/GHSA-m63v-j7fw-hq2h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/itflow-org/itflow/security/advisories/GHSA-m63v-j7fw-hq2h"
},
{
"name": "https://github.com/itflow-org/itflow/pull/1289",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itflow-org/itflow/pull/1289"
},
{
"name": "https://github.com/itflow-org/itflow/commit/63d86917ae0438548d21d4e28e4d3c55176f5cbf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itflow-org/itflow/commit/63d86917ae0438548d21d4e28e4d3c55176f5cbf"
},
{
"name": "https://github.com/itflow-org/itflow/releases/tag/v26.07",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itflow-org/itflow/releases/tag/v26.07"
}
],
"source": {
"advisory": "GHSA-m63v-j7fw-hq2h",
"discovery": "UNKNOWN"
},
"title": "ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54597",
"datePublished": "2026-09-17T20:34:22.555Z",
"dateReserved": "2026-06-15T19:45:23.539Z",
"dateUpdated": "2026-09-18T13:26:07.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54596 (GCVE-0-2026-54596)
Vulnerability from nvd – Published: 2026-09-17 20:33 – Updated: 2026-09-24 20:46
VLAI
EPSS
VEX
Title
ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
Summary
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by agent/post/recurring_invoice.php. The handler passes recurring_invoice_frequency through sanitizeInput but interpolates it unquoted into DATE_ADD, allowing SQL syntax to escape the interval expression, assign additional INSERT columns, store subquery results in recurring_invoice_note, and expose those results through agent/recurring_invoice.php. The persisted recurring_invoice_frequency can execute again when Force Recurring uses it in a later UPDATE, allowing another legitimate user to trigger the second-order injection. This can expose password hashes, SMTP credentials, user records, and database metadata, modify database fields, and enable administrative takeover after credential cracking. This issue is fixed in version 26.07.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 20:46 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/itflow-org/itflow/security/adv… | x_refsource_CONFIRM |
| https://github.com/itflow-org/itflow/pull/1284 | x_refsource_MISC |
| https://github.com/itflow-org/itflow/commit/72114… | x_refsource_MISC |
| https://github.com/itflow-org/itflow/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| itflow-org | itflow |
Affected:
< 26.07
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54596",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T20:46:35.350822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T20:46:48.125Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/itflow-org/itflow/security/advisories/GHSA-f9m3-qjc9-v27j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "itflow",
"vendor": "itflow-org",
"versions": [
{
"status": "affected",
"version": "\u003c 26.07"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by agent/post/recurring_invoice.php. The handler passes recurring_invoice_frequency through sanitizeInput but interpolates it unquoted into DATE_ADD, allowing SQL syntax to escape the interval expression, assign additional INSERT columns, store subquery results in recurring_invoice_note, and expose those results through agent/recurring_invoice.php. The persisted recurring_invoice_frequency can execute again when Force Recurring uses it in a later UPDATE, allowing another legitimate user to trigger the second-order injection. This can expose password hashes, SMTP credentials, user records, and database metadata, modify database fields, and enable administrative takeover after credential cracking. This issue is fixed in version 26.07."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T20:33:23.638Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/itflow-org/itflow/security/advisories/GHSA-f9m3-qjc9-v27j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/itflow-org/itflow/security/advisories/GHSA-f9m3-qjc9-v27j"
},
{
"name": "https://github.com/itflow-org/itflow/pull/1284",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itflow-org/itflow/pull/1284"
},
{
"name": "https://github.com/itflow-org/itflow/commit/721142629296ac8e335a79b32fd4d2df721234a8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itflow-org/itflow/commit/721142629296ac8e335a79b32fd4d2df721234a8"
},
{
"name": "https://github.com/itflow-org/itflow/releases/tag/v26.07",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itflow-org/itflow/releases/tag/v26.07"
}
],
"source": {
"advisory": "GHSA-f9m3-qjc9-v27j",
"discovery": "UNKNOWN"
},
"title": "ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54596",
"datePublished": "2026-09-17T20:33:23.638Z",
"dateReserved": "2026-06-15T19:45:23.539Z",
"dateUpdated": "2026-09-24T20:46:48.125Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47755 (GCVE-0-2026-47755)
Vulnerability from nvd – Published: 2026-07-23 17:08 – Updated: 2026-07-28 14:55
VLAI
EPSS
VEX
Title
ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal
Summary
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal with an arbitrary `credential_id`. The endpoint does not enforce client scoping or object-level authorization before loading and decrypting the credential record. Version 26.05 fixes the issue.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 14:25 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/itflow-org/itflow/security/adv… | x_refsource_CONFIRM |
| https://github.com/itflow-org/itflow/compare/v26.… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| itflow-org | itflow |
Affected:
< 26.05
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:25:05.583571Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T14:55:37.555Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "itflow",
"vendor": "itflow-org",
"versions": [
{
"status": "affected",
"version": "\u003c 26.05"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal with an arbitrary `credential_id`. The endpoint does not enforce client scoping or object-level authorization before loading and decrypting the credential record. Version 26.05 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T17:08:24.133Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/itflow-org/itflow/security/advisories/GHSA-987x-g5f9-2rpq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/itflow-org/itflow/security/advisories/GHSA-987x-g5f9-2rpq"
},
{
"name": "https://github.com/itflow-org/itflow/compare/v26.04...v26.05",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itflow-org/itflow/compare/v26.04...v26.05"
}
],
"source": {
"advisory": "GHSA-987x-g5f9-2rpq",
"discovery": "UNKNOWN"
},
"title": "ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47755",
"datePublished": "2026-07-23T17:08:24.133Z",
"dateReserved": "2026-05-19T22:16:39.505Z",
"dateUpdated": "2026-07-28T14:55:37.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54597 (GCVE-0-2026-54597)
Vulnerability from cvelistv5 – Published: 2026-09-17 20:34 – Updated: 2026-09-18 13:26
VLAI
EPSS
VEX
Title
ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter
Summary
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with module_support write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of the share_generate_link handler in agent/ajax.php. sanitizeInput applies string-context escaping, but expires is inserted unquoted into the item_expire_at MySQL INTERVAL expression, allowing a crafted expression and interval unit to execute conditional database queries whose results are inferred from response delays. This can expose password hashes, SMTP credentials, API keys, encrypted vault data, and database metadata and support administrative takeover after credential cracking. This issue is fixed in version 26.07.
Severity
8.3 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 13:25 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/itflow-org/itflow/security/adv… | x_refsource_CONFIRM |
| https://github.com/itflow-org/itflow/pull/1289 | x_refsource_MISC |
| https://github.com/itflow-org/itflow/commit/63d86… | x_refsource_MISC |
| https://github.com/itflow-org/itflow/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| itflow-org | itflow |
Affected:
< 26.07
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54597",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T13:25:43.723521Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T13:26:07.177Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/itflow-org/itflow/security/advisories/GHSA-m63v-j7fw-hq2h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "itflow",
"vendor": "itflow-org",
"versions": [
{
"status": "affected",
"version": "\u003c 26.07"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with module_support write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of the share_generate_link handler in agent/ajax.php. sanitizeInput applies string-context escaping, but expires is inserted unquoted into the item_expire_at MySQL INTERVAL expression, allowing a crafted expression and interval unit to execute conditional database queries whose results are inferred from response delays. This can expose password hashes, SMTP credentials, API keys, encrypted vault data, and database metadata and support administrative takeover after credential cracking. This issue is fixed in version 26.07."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T20:34:22.555Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/itflow-org/itflow/security/advisories/GHSA-m63v-j7fw-hq2h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/itflow-org/itflow/security/advisories/GHSA-m63v-j7fw-hq2h"
},
{
"name": "https://github.com/itflow-org/itflow/pull/1289",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itflow-org/itflow/pull/1289"
},
{
"name": "https://github.com/itflow-org/itflow/commit/63d86917ae0438548d21d4e28e4d3c55176f5cbf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itflow-org/itflow/commit/63d86917ae0438548d21d4e28e4d3c55176f5cbf"
},
{
"name": "https://github.com/itflow-org/itflow/releases/tag/v26.07",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itflow-org/itflow/releases/tag/v26.07"
}
],
"source": {
"advisory": "GHSA-m63v-j7fw-hq2h",
"discovery": "UNKNOWN"
},
"title": "ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54597",
"datePublished": "2026-09-17T20:34:22.555Z",
"dateReserved": "2026-06-15T19:45:23.539Z",
"dateUpdated": "2026-09-18T13:26:07.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54596 (GCVE-0-2026-54596)
Vulnerability from cvelistv5 – Published: 2026-09-17 20:33 – Updated: 2026-09-24 20:46
VLAI
EPSS
VEX
Title
ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
Summary
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by agent/post/recurring_invoice.php. The handler passes recurring_invoice_frequency through sanitizeInput but interpolates it unquoted into DATE_ADD, allowing SQL syntax to escape the interval expression, assign additional INSERT columns, store subquery results in recurring_invoice_note, and expose those results through agent/recurring_invoice.php. The persisted recurring_invoice_frequency can execute again when Force Recurring uses it in a later UPDATE, allowing another legitimate user to trigger the second-order injection. This can expose password hashes, SMTP credentials, user records, and database metadata, modify database fields, and enable administrative takeover after credential cracking. This issue is fixed in version 26.07.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 20:46 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/itflow-org/itflow/security/adv… | x_refsource_CONFIRM |
| https://github.com/itflow-org/itflow/pull/1284 | x_refsource_MISC |
| https://github.com/itflow-org/itflow/commit/72114… | x_refsource_MISC |
| https://github.com/itflow-org/itflow/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| itflow-org | itflow |
Affected:
< 26.07
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54596",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T20:46:35.350822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T20:46:48.125Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/itflow-org/itflow/security/advisories/GHSA-f9m3-qjc9-v27j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "itflow",
"vendor": "itflow-org",
"versions": [
{
"status": "affected",
"version": "\u003c 26.07"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by agent/post/recurring_invoice.php. The handler passes recurring_invoice_frequency through sanitizeInput but interpolates it unquoted into DATE_ADD, allowing SQL syntax to escape the interval expression, assign additional INSERT columns, store subquery results in recurring_invoice_note, and expose those results through agent/recurring_invoice.php. The persisted recurring_invoice_frequency can execute again when Force Recurring uses it in a later UPDATE, allowing another legitimate user to trigger the second-order injection. This can expose password hashes, SMTP credentials, user records, and database metadata, modify database fields, and enable administrative takeover after credential cracking. This issue is fixed in version 26.07."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T20:33:23.638Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/itflow-org/itflow/security/advisories/GHSA-f9m3-qjc9-v27j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/itflow-org/itflow/security/advisories/GHSA-f9m3-qjc9-v27j"
},
{
"name": "https://github.com/itflow-org/itflow/pull/1284",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itflow-org/itflow/pull/1284"
},
{
"name": "https://github.com/itflow-org/itflow/commit/721142629296ac8e335a79b32fd4d2df721234a8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itflow-org/itflow/commit/721142629296ac8e335a79b32fd4d2df721234a8"
},
{
"name": "https://github.com/itflow-org/itflow/releases/tag/v26.07",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itflow-org/itflow/releases/tag/v26.07"
}
],
"source": {
"advisory": "GHSA-f9m3-qjc9-v27j",
"discovery": "UNKNOWN"
},
"title": "ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54596",
"datePublished": "2026-09-17T20:33:23.638Z",
"dateReserved": "2026-06-15T19:45:23.539Z",
"dateUpdated": "2026-09-24T20:46:48.125Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47755 (GCVE-0-2026-47755)
Vulnerability from cvelistv5 – Published: 2026-07-23 17:08 – Updated: 2026-07-28 14:55
VLAI
EPSS
VEX
Title
ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal
Summary
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal with an arbitrary `credential_id`. The endpoint does not enforce client scoping or object-level authorization before loading and decrypting the credential record. Version 26.05 fixes the issue.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 14:25 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/itflow-org/itflow/security/adv… | x_refsource_CONFIRM |
| https://github.com/itflow-org/itflow/compare/v26.… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| itflow-org | itflow |
Affected:
< 26.05
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:25:05.583571Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T14:55:37.555Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "itflow",
"vendor": "itflow-org",
"versions": [
{
"status": "affected",
"version": "\u003c 26.05"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal with an arbitrary `credential_id`. The endpoint does not enforce client scoping or object-level authorization before loading and decrypting the credential record. Version 26.05 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T17:08:24.133Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/itflow-org/itflow/security/advisories/GHSA-987x-g5f9-2rpq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/itflow-org/itflow/security/advisories/GHSA-987x-g5f9-2rpq"
},
{
"name": "https://github.com/itflow-org/itflow/compare/v26.04...v26.05",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itflow-org/itflow/compare/v26.04...v26.05"
}
],
"source": {
"advisory": "GHSA-987x-g5f9-2rpq",
"discovery": "UNKNOWN"
},
"title": "ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47755",
"datePublished": "2026-07-23T17:08:24.133Z",
"dateReserved": "2026-05-19T22:16:39.505Z",
"dateUpdated": "2026-07-28T14:55:37.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}