Kodbox
Monthly
Open redirect in kodbox 1.67 Build 02 SSO API Login allows unauthenticated remote attackers to redirect victims to arbitrary external URLs by manipulating the callbackUrl parameter at the /user/sso/apiLogin endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) confirms network-accessible, low-complexity exploitation requiring only passive user interaction - a victim clicking a crafted SSO link - with no authentication or special configuration needed from the attacker's side. A proof-of-concept exploit has been publicly disclosed on GitHub (E:P), lowering the exploitation barrier, though no CISA KEV listing indicates confirmed widespread exploitation at time of analysis.
Improper authorization in KodBox 1.67 Build 02 allows unauthenticated remote attackers to bypass access controls via the msgWarning plugin endpoint, resulting in limited unauthorized access to confidential data. The CVSS 4.0 vector (PR:N/UI:N) confirms no authentication is required, and a public proof-of-concept exploit has been published on GitHub. The vendor did not respond to responsible disclosure, leaving no confirmed patch available at time of analysis.
Server-side request forgery (SSRF) in Kalcaddle Kodbox up to version 1.64 allows unauthenticated remote attackers to perform arbitrary network requests via manipulation of the siteFrom/siteTo parameters in the shareMake/shareCheck component, with publicly available exploit code and high attack complexity. The vendor has not responded to disclosure efforts, leaving affected installations vulnerable to information disclosure and potential lateral network attacks.
Kodbox versions up to 1.61.10 contain a command injection vulnerability in the compression handler component that allows authenticated remote attackers to execute arbitrary commands with network access. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor.
An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.
kodbox 1.46.01 has a security flaw that enables user enumeration. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
kodbox 1.44 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in kodbox 1.26. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
kodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Open redirect in kodbox 1.67 Build 02 SSO API Login allows unauthenticated remote attackers to redirect victims to arbitrary external URLs by manipulating the callbackUrl parameter at the /user/sso/apiLogin endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) confirms network-accessible, low-complexity exploitation requiring only passive user interaction - a victim clicking a crafted SSO link - with no authentication or special configuration needed from the attacker's side. A proof-of-concept exploit has been publicly disclosed on GitHub (E:P), lowering the exploitation barrier, though no CISA KEV listing indicates confirmed widespread exploitation at time of analysis.
Improper authorization in KodBox 1.67 Build 02 allows unauthenticated remote attackers to bypass access controls via the msgWarning plugin endpoint, resulting in limited unauthorized access to confidential data. The CVSS 4.0 vector (PR:N/UI:N) confirms no authentication is required, and a public proof-of-concept exploit has been published on GitHub. The vendor did not respond to responsible disclosure, leaving no confirmed patch available at time of analysis.
Server-side request forgery (SSRF) in Kalcaddle Kodbox up to version 1.64 allows unauthenticated remote attackers to perform arbitrary network requests via manipulation of the siteFrom/siteTo parameters in the shareMake/shareCheck component, with publicly available exploit code and high attack complexity. The vendor has not responded to disclosure efforts, leaving affected installations vulnerable to information disclosure and potential lateral network attacks.
Kodbox versions up to 1.61.10 contain a command injection vulnerability in the compression handler component that allows authenticated remote attackers to execute arbitrary commands with network access. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor.
An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.
kodbox 1.46.01 has a security flaw that enables user enumeration. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
kodbox 1.44 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in kodbox 1.26. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
kodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.