Ezbookkeeping
Monthly
Privilege escalation in ezBookkeeping 1.2.0 through 2.0.0 lets an attacker who already holds a short-lived and/or IP-restricted API token exchange it for a full 30-day normal session token by calling POST /api/v1/tokens/refresh.json, because TokenRefreshHandler never verifies the token type before minting a replacement. The resulting session token outlives the original API token's expiry and its IP allowlist, though impact stays within the compromised account's own scope (low confidentiality and integrity impact). Rated CVSS 5.3 (CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N), it requires a prior valid API token (authenticated) and is fully remediated in v2.0.1; no public exploit code or confirmed active exploitation was identified at time of analysis.
mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in JSON and XML file import processing. [CVSS 6.5 MEDIUM]
An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Privilege escalation in ezBookkeeping 1.2.0 through 2.0.0 lets an attacker who already holds a short-lived and/or IP-restricted API token exchange it for a full 30-day normal session token by calling POST /api/v1/tokens/refresh.json, because TokenRefreshHandler never verifies the token type before minting a replacement. The resulting session token outlives the original API token's expiry and its IP allowlist, though impact stays within the compromised account's own scope (low confidentiality and integrity impact). Rated CVSS 5.3 (CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N), it requires a prior valid API token (authenticated) and is fully remediated in v2.0.1; no public exploit code or confirmed active exploitation was identified at time of analysis.
mayswind ezbookkeeping versions 1.2.0 and earlier contain a critical vulnerability in JSON and XML file import processing. [CVSS 6.5 MEDIUM]
An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.