Pachno
Monthly
Privilege escalation in Pachno 1.0.6 allows low-privilege authenticated users to hijack administrator sessions by manipulating the original_username cookie in the runSwitchUser() action, enabling unauthorized access to user ID 1 (admin) session tokens and password hashes. SSVC confirms proof-of-concept exists with partial technical impact, though EPSS indicates low exploitation probability (0.07%, 22nd percentile) and no active exploitation confirmed via CISA KEV.
XML External Entity (XXE) injection in Pachno 1.0.6's TextParser helper allows remote unauthenticated attackers to read arbitrary files from the server. The vulnerability is triggered through malicious XML entities embedded in wiki table syntax and inline tags within issue descriptions, comments, or wiki articles, exploiting unsafe simplexml_load_string() calls without LIBXML_NONET protections. With CVSS 9.3 and EPSS 0.04% (14th percentile), this represents a high-severity but low-probability threat. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Cross-site request forgery in Pachno 1.0.6 allows unauthenticated attackers to force authenticated users into performing unintended state-changing actions - including account creation, role modification, file upload, comment injection, and forced logout - by luring victims to attacker-controlled webpages. The absence of CSRF token validation across multiple sensitive endpoints (login, registration, file upload, milestone editing, and admin functions) is the root cause. No active exploitation has been confirmed (SSVC: Exploitation=none, EPSS 0.01%, 3rd percentile), and real-world risk is constrained by the social-engineering dependency and Pachno's limited deployment footprint.
Remote code execution in Pachno 1.0.6 allows authenticated users to upload and execute PHP5 scripts via the /uploadfile endpoint due to ineffective extension filtering. The vulnerability bypasses file type restrictions, enabling attackers to place executable code in web-accessible directories. With a low attack complexity (AC:L) and requiring only low-level authentication (PR:L), this is exploitable by any user with basic credentials. EPSS probability is relatively low (0.10%, 27th percentile), and no active exploitation is confirmed via CISA KEV status, though the attack technique is well-understood and documented in public advisories.
Open redirection in Pachno 1.0.6's return_to parameter enables phishing campaigns that harvest user credentials by redirecting victims to attacker-controlled domains after login. With CVSS 7.1 (High) and EPSS 0.03% (9th percentile), exploitation requires user interaction but no authentication, making it effective for social engineering attacks. No active exploitation (CISA KEV) or public exploit code confirmed at time of analysis, though detailed advisories exist from ZeroScience and VulnCheck.
Stored cross-site scripting in Pachno 1.0.6 allows authenticated users to inject persistent malicious scripts through five POST parameters (value, comment_body, article_content, description, message) that are stored in the database and executed in victims' browsers upon page load. The vulnerability is systemic, rooted in insufficient sanitization within the Request::getRawParameter() and Request::getParameter() framework methods across multiple controllers rather than isolated field-level failures. No public exploit code has been identified and EPSS sits at 0.03% (8th percentile), with SSVC also rating exploitation as none - aligning signals indicate minimal active targeting at this time.
A vulnerability has been identified in Pachno 1.0.6 allowing an authenticated attacker to execute a cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation in Pachno 1.0.6 allows low-privilege authenticated users to hijack administrator sessions by manipulating the original_username cookie in the runSwitchUser() action, enabling unauthorized access to user ID 1 (admin) session tokens and password hashes. SSVC confirms proof-of-concept exists with partial technical impact, though EPSS indicates low exploitation probability (0.07%, 22nd percentile) and no active exploitation confirmed via CISA KEV.
XML External Entity (XXE) injection in Pachno 1.0.6's TextParser helper allows remote unauthenticated attackers to read arbitrary files from the server. The vulnerability is triggered through malicious XML entities embedded in wiki table syntax and inline tags within issue descriptions, comments, or wiki articles, exploiting unsafe simplexml_load_string() calls without LIBXML_NONET protections. With CVSS 9.3 and EPSS 0.04% (14th percentile), this represents a high-severity but low-probability threat. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Cross-site request forgery in Pachno 1.0.6 allows unauthenticated attackers to force authenticated users into performing unintended state-changing actions - including account creation, role modification, file upload, comment injection, and forced logout - by luring victims to attacker-controlled webpages. The absence of CSRF token validation across multiple sensitive endpoints (login, registration, file upload, milestone editing, and admin functions) is the root cause. No active exploitation has been confirmed (SSVC: Exploitation=none, EPSS 0.01%, 3rd percentile), and real-world risk is constrained by the social-engineering dependency and Pachno's limited deployment footprint.
Remote code execution in Pachno 1.0.6 allows authenticated users to upload and execute PHP5 scripts via the /uploadfile endpoint due to ineffective extension filtering. The vulnerability bypasses file type restrictions, enabling attackers to place executable code in web-accessible directories. With a low attack complexity (AC:L) and requiring only low-level authentication (PR:L), this is exploitable by any user with basic credentials. EPSS probability is relatively low (0.10%, 27th percentile), and no active exploitation is confirmed via CISA KEV status, though the attack technique is well-understood and documented in public advisories.
Open redirection in Pachno 1.0.6's return_to parameter enables phishing campaigns that harvest user credentials by redirecting victims to attacker-controlled domains after login. With CVSS 7.1 (High) and EPSS 0.03% (9th percentile), exploitation requires user interaction but no authentication, making it effective for social engineering attacks. No active exploitation (CISA KEV) or public exploit code confirmed at time of analysis, though detailed advisories exist from ZeroScience and VulnCheck.
Stored cross-site scripting in Pachno 1.0.6 allows authenticated users to inject persistent malicious scripts through five POST parameters (value, comment_body, article_content, description, message) that are stored in the database and executed in victims' browsers upon page load. The vulnerability is systemic, rooted in insufficient sanitization within the Request::getRawParameter() and Request::getParameter() framework methods across multiple controllers rather than isolated field-level failures. No public exploit code has been identified and EPSS sits at 0.03% (8th percentile), with SSVC also rating exploitation as none - aligning signals indicate minimal active targeting at this time.
A vulnerability has been identified in Pachno 1.0.6 allowing an authenticated attacker to execute a cross-site scripting (XSS) attack. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.