Cypht
Monthly
PHP object injection in Cypht before 2.12.2 allows authenticated users to execute arbitrary OS commands as the web server process by submitting a crafted serialized payload via the logout handler. The `back_query` GET parameter is base64-decoded and passed directly to PHP's `unserialize()` with no allow-list, signature check, or type restriction, enabling gadget-chain exploitation. A vendor patch is available in v2.12.2 and no public exploit code has been identified at time of analysis.
Cross-site scripting in Cypht webmail's contacts module (all versions before 2.12.2) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious FROM email header. The contacts module's sanitizer strips only the first occurrence of each angle bracket character, so embedding redundant brackets around a script payload bypasses the filter entirely. Exploitation requires two deliberate user actions - opening the crafted email and invoking the Add Local Contacts function - limiting opportunistic mass exploitation; no public exploit has been identified at time of analysis.
PHP object injection in Cypht before 2.12.2 allows authenticated users to execute arbitrary OS commands as the web server process by submitting a crafted serialized payload via the logout handler. The `back_query` GET parameter is base64-decoded and passed directly to PHP's `unserialize()` with no allow-list, signature check, or type restriction, enabling gadget-chain exploitation. A vendor patch is available in v2.12.2 and no public exploit code has been identified at time of analysis.
Cross-site scripting in Cypht webmail's contacts module (all versions before 2.12.2) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious FROM email header. The contacts module's sanitizer strips only the first occurrence of each angle bracket character, so embedding redundant brackets around a script payload bypasses the filter entirely. Exploitation requires two deliberate user actions - opening the crafted email and invoking the Add Local Contacts function - limiting opportunistic mass exploitation; no public exploit has been identified at time of analysis.