Protectelmaj
Monthly
Stored cross-site scripting in the note editor of ARKETEAM Protectel PROTECTELMAJ (before 6.5.19) and BDF (before 6.4.67) lets an attacker with note access inject arbitrary HTML and JavaScript that runs when another user opens the note. The issue is medium severity (CVSS 4.0 base 5.1, CWE-79), a vendor patch is available, and there are no amplifying exploitation signals: it is not in CISA KEV, EPSS is not provided, and no public exploit identified at time of analysis. The privilege requirement is ambiguous because the description refers to a low-privileged attacker while the supplied CVSS vector contains PR:N, so authentication requirements are not confirmed from available data.
SQL injection in ARKETEAM Protectel modules PROTECTELMAJ and BDF allows an authenticated user to submit crafted input through the profilInput parameter and alter database queries, with HIGH confidentiality and integrity impact and LOW availability impact. Affected releases are PROTECTELMAJ before 6.5.19 and BDF before 6.4.67; the vendor CVSS 4.0 score is 8.4 (High), and fixed versions have been released. The supplied vector indicates adjacent-network access and high privileges (AV:A/PR:H), while the advisory says a low-privileged user can trigger the flaw, so the privilege and network preconditions remain unresolved; no public exploit was identified at time of analysis.
SQL injection in the ARKETEAM Protectel modules PROTECTELMAJ (before 6.5.19) and BDF (before 6.4.67) allows an authenticated user with adjacent-network access to inject arbitrary SQL through the "Utilisateur" parameter, potentially reading and modifying database contents and affecting availability. The issue is CWE-89 and has vendor-released fixes; no public exploit code or confirmed active exploitation was identified at time of analysis. Exposure is limited by the need for a valid account and adjacent-network reachability, and the supplied privilege metric is inconsistent with the described low-privileged user requirement.
Improper authorization in the ARKETEAM Protectel modules PROTECTELMAJ (before v6.5.19) and BDF (before v6.4.67) lets a low-privileged authenticated user forge a direct request to a specific administrator-only endpoint and reach functionality that should be reserved for admins. Exploitation requires an existing low-privileged account plus adjacent-network reachability to the Protectel service, and impact is partial (confidentiality, integrity and availability all rated low); no public exploit was identified at time of analysis and the issue is not flagged as actively exploited. The flaw was reported by CERT-PL and is rated CVSS 5.1 (CVSS 4.0: AV:A/AC:L/PR:L/UI:N), with vendor-released fixes available as PROTECTELMAJ v6.5.19 and BDF v6.4.67.
Unauthenticated file upload in ARKETEAM Protectel modules PROTECTELMAJ (before 6.5.19) and BDF (before 6.4.67) lets any user write arbitrary files into a temporary folder and overwrite existing ones. The security consequence does not fire on upload: embedded JavaScript is executed only when an authenticated user later downloads the attacker-overwritten file, so a second victim must retrieve it for impact to materialise; per the vendor CVSS 4.0 vector (AV:A/PR:N) the upload path sits on an adjacent network segment rather than the open internet. Severity is medium (vendor CVSS 4.0 base 5.3; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), no KEV entry and no public exploit identified at time of analysis, and the vuln.today decision label is 'this_month', making this a scheduled-patch item.
Stored cross-site scripting in the note editor of ARKETEAM Protectel PROTECTELMAJ (before 6.5.19) and BDF (before 6.4.67) lets an attacker with note access inject arbitrary HTML and JavaScript that runs when another user opens the note. The issue is medium severity (CVSS 4.0 base 5.1, CWE-79), a vendor patch is available, and there are no amplifying exploitation signals: it is not in CISA KEV, EPSS is not provided, and no public exploit identified at time of analysis. The privilege requirement is ambiguous because the description refers to a low-privileged attacker while the supplied CVSS vector contains PR:N, so authentication requirements are not confirmed from available data.
SQL injection in ARKETEAM Protectel modules PROTECTELMAJ and BDF allows an authenticated user to submit crafted input through the profilInput parameter and alter database queries, with HIGH confidentiality and integrity impact and LOW availability impact. Affected releases are PROTECTELMAJ before 6.5.19 and BDF before 6.4.67; the vendor CVSS 4.0 score is 8.4 (High), and fixed versions have been released. The supplied vector indicates adjacent-network access and high privileges (AV:A/PR:H), while the advisory says a low-privileged user can trigger the flaw, so the privilege and network preconditions remain unresolved; no public exploit was identified at time of analysis.
SQL injection in the ARKETEAM Protectel modules PROTECTELMAJ (before 6.5.19) and BDF (before 6.4.67) allows an authenticated user with adjacent-network access to inject arbitrary SQL through the "Utilisateur" parameter, potentially reading and modifying database contents and affecting availability. The issue is CWE-89 and has vendor-released fixes; no public exploit code or confirmed active exploitation was identified at time of analysis. Exposure is limited by the need for a valid account and adjacent-network reachability, and the supplied privilege metric is inconsistent with the described low-privileged user requirement.
Improper authorization in the ARKETEAM Protectel modules PROTECTELMAJ (before v6.5.19) and BDF (before v6.4.67) lets a low-privileged authenticated user forge a direct request to a specific administrator-only endpoint and reach functionality that should be reserved for admins. Exploitation requires an existing low-privileged account plus adjacent-network reachability to the Protectel service, and impact is partial (confidentiality, integrity and availability all rated low); no public exploit was identified at time of analysis and the issue is not flagged as actively exploited. The flaw was reported by CERT-PL and is rated CVSS 5.1 (CVSS 4.0: AV:A/AC:L/PR:L/UI:N), with vendor-released fixes available as PROTECTELMAJ v6.5.19 and BDF v6.4.67.
Unauthenticated file upload in ARKETEAM Protectel modules PROTECTELMAJ (before 6.5.19) and BDF (before 6.4.67) lets any user write arbitrary files into a temporary folder and overwrite existing ones. The security consequence does not fire on upload: embedded JavaScript is executed only when an authenticated user later downloads the attacker-overwritten file, so a second victim must retrieve it for impact to materialise; per the vendor CVSS 4.0 vector (AV:A/PR:N) the upload path sits on an adjacent network segment rather than the open internet. Severity is medium (vendor CVSS 4.0 base 5.3; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), no KEV entry and no public exploit identified at time of analysis, and the vuln.today decision label is 'this_month', making this a scheduled-patch item.