Eimzamip
Monthly
Authenticated file upload in Eimzamip v1.6.4 and v1.6.5 (every release before v1.6.6) allows a low-privilege user to store files of dangerous type because the application fails to validate or restrict uploaded content (CWE-434). Per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N (score 7.3), remote exploitation requires a valid authenticated session on the product's upload functionality plus a user-interaction step - typically a victim or operator opening or processing the planted file - after which confidentiality and integrity impact is high, while scope remains unchanged. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a moderate-priority issue rather than a top-tier emergency.
Stored cross-site scripting in Eimzamip versions v1.6.4 up to but not including v1.6.7 allows an authenticated user to persist script-related HTML into a field that is later rendered to other users without neutralization. Exploitation requires a valid low-privileged account (PR:L per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N vector) plus a second user who views the poisoned page (UI:R), so unauthenticated or fully automated mass attacks are not possible. At CVSS 3.5 this is a low-severity issue; no public exploit has been identified at time of analysis, and CISA's SSVC decision data records Exploitation: none and Automatable: no.
Authenticated file upload in Eimzamip v1.6.4 and v1.6.5 (every release before v1.6.6) allows a low-privilege user to store files of dangerous type because the application fails to validate or restrict uploaded content (CWE-434). Per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N (score 7.3), remote exploitation requires a valid authenticated session on the product's upload functionality plus a user-interaction step - typically a victim or operator opening or processing the planted file - after which confidentiality and integrity impact is high, while scope remains unchanged. No public exploit code and no confirmed active exploitation were identified at time of analysis, making this a moderate-priority issue rather than a top-tier emergency.
Stored cross-site scripting in Eimzamip versions v1.6.4 up to but not including v1.6.7 allows an authenticated user to persist script-related HTML into a field that is later rendered to other users without neutralization. Exploitation requires a valid low-privileged account (PR:L per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N vector) plus a second user who views the poisoned page (UI:R), so unauthenticated or fully automated mass attacks are not possible. At CVSS 3.5 this is a low-severity issue; no public exploit has been identified at time of analysis, and CISA's SSVC decision data records Exploitation: none and Automatable: no.