Garage 24 Garage Management Software
Monthly
Cross-site scripting in Bdtask Garage 24 Garage Management Software 1.0 lets an authenticated user inject script through the first_name or last_name fields handled by /edit_profile, executing in a victim's browser when the affected profile view is loaded. Exploitation requires an authenticated account (PR:L) and user interaction (UI:P); a public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry or vendor-released patch was identified. This is a low-to-moderate priority issue that does not warrant emergency handling.
Improper authorization in the backend component of Bdtask Garage 24 Garage Management Software 1.0 allows a remote user holding a low-privilege authenticated session to perform actions beyond their intended permissions, with limited confidentiality, integrity, and availability impact. The assessed vector requires valid authentication (PR:L) and shows no scope change, so the flaw is not reachable by fully unauthenticated attackers, and the specific backend feature or endpoint that triggers it is not described in the available sources. A public PoC reference exists but is not verified as working exploit code; the vendor did not respond to the disclosure, no fixed version is provided, and the current priority label is monitor, making this a low-priority issue despite being remotely reachable.
Cross-site scripting in Bdtask Garage 24 Garage Management Software 1.0 lets an authenticated user inject script through the first_name or last_name fields handled by /edit_profile, executing in a victim's browser when the affected profile view is loaded. Exploitation requires an authenticated account (PR:L) and user interaction (UI:P); a public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry or vendor-released patch was identified. This is a low-to-moderate priority issue that does not warrant emergency handling.
Improper authorization in the backend component of Bdtask Garage 24 Garage Management Software 1.0 allows a remote user holding a low-privilege authenticated session to perform actions beyond their intended permissions, with limited confidentiality, integrity, and availability impact. The assessed vector requires valid authentication (PR:L) and shows no scope change, so the flaw is not reachable by fully unauthenticated attackers, and the specific backend feature or endpoint that triggers it is not described in the available sources. A public PoC reference exists but is not verified as working exploit code; the vendor did not respond to the disclosure, no fixed version is provided, and the current priority label is monitor, making this a low-priority issue despite being remotely reachable.