Ultimate Fosters
Monthly
Stored cross-site scripting in Ultimate POS (Stock Management & Point of Sale) version 7.2 and earlier enables low-privileged authenticated attackers to compromise higher-privileged user sessions by injecting script payloads into the first-name field at account creation time. When the attacker submits a leave request through the HRM/Leave module, the unsanitized first-name payload is rendered in the leave-application notification pane of any administrator or manager who views it, executing within the admin browser origin and enabling session theft or unauthorized administrative actions. A researcher-published proof-of-concept is publicly available; no CISA KEV listing has been confirmed at time of analysis.
Broken access control in Perfect Support Ticketing & Document Management System through version 1.7 permits authenticated Agent-level users to manipulate the Support Agent assignment field on tickets beyond their authorized scope, including adding or removing Superadmin accounts. The vulnerability stems from missing server-side authorization checks (CWE-862), allowing role-based access controls to be circumvented entirely by any Agent assigned to a ticket. A publicly available exploit exists per VulnCheck and a GitHub PoC disclosure; no CISA KEV listing is present at time of analysis.
Stored cross-site scripting in Perfect Support Ticketing & Document Management System through version 1.7 allows authenticated Agent-level users to inject persistent malicious scripts into ticket Notes fields. Any user who subsequently views the compromised ticket notes - including Superadmin users - executes the attacker's payload in their browser context, enabling session token theft and unauthorized actions performed on the victim's behalf. No public exploit identified at time of analysis for KEV listing, though a publicly available proof-of-concept exists per VulnCheck and the researcher's GitHub repository.
Stored cross-site scripting in Ultimate POS (Stock Management & Point of Sale) version 7.2 and earlier enables low-privileged authenticated attackers to compromise higher-privileged user sessions by injecting script payloads into the first-name field at account creation time. When the attacker submits a leave request through the HRM/Leave module, the unsanitized first-name payload is rendered in the leave-application notification pane of any administrator or manager who views it, executing within the admin browser origin and enabling session theft or unauthorized administrative actions. A researcher-published proof-of-concept is publicly available; no CISA KEV listing has been confirmed at time of analysis.
Broken access control in Perfect Support Ticketing & Document Management System through version 1.7 permits authenticated Agent-level users to manipulate the Support Agent assignment field on tickets beyond their authorized scope, including adding or removing Superadmin accounts. The vulnerability stems from missing server-side authorization checks (CWE-862), allowing role-based access controls to be circumvented entirely by any Agent assigned to a ticket. A publicly available exploit exists per VulnCheck and a GitHub PoC disclosure; no CISA KEV listing is present at time of analysis.
Stored cross-site scripting in Perfect Support Ticketing & Document Management System through version 1.7 allows authenticated Agent-level users to inject persistent malicious scripts into ticket Notes fields. Any user who subsequently views the compromised ticket notes - including Superadmin users - executes the attacker's payload in their browser context, enabling session token theft and unauthorized actions performed on the victim's behalf. No public exploit identified at time of analysis for KEV listing, though a publicly available proof-of-concept exists per VulnCheck and the researcher's GitHub repository.