craterapp records

9 published records for vendor craterapp.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 44.4%
Median publish → KEV: No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

9 records

CVE records
Action	CVE	Vulnerability	Severity	EPSS · Published
35Monitor	CVE-2023-46865Proof of concept	/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing thcraterapp · crater · CWE-94 RCE	High7.2	23.7%Oct 29, 2023
35Monitor	CVE-2021-4080No exploit	Unrestricted Upload of File with Dangerous Type in crater-invoice/cratercraterapp · crater · CWE-434 File upload	High8.8	1.5%Jan 12, 2022
31Monitor	CVE-2022-1033No exploit	Unrestricted Upload of File with Dangerous Type in crater-invoice/cratercraterapp · crater · CWE-434 File upload	High7.8	0.9%Mar 23, 2022
28Monitor	CVE-2022-1032No exploit	Insecure deserialization of not validated module file in crater-invoice/cratercraterapp · crater · CWE-502 Deserialization	High7.2	1.6%Mar 29, 2022
28Monitor	CVE-2022-0242No exploit	Unrestricted Upload of File with Dangerous Type in crater-invoice/cratercraterapp · crater · CWE-434 File upload	High7.2	1.4%Jan 17, 2022
26Monitor	CVE-2022-0514No exploit	Business Logic Errors in crater-invoice/cratercraterapp · crater · CWE-840	Medium6.5	0.9%Mar 21, 2022
21Monitor	CVE-2022-0203No exploit	Improper Access Control in crater-invoice/cratercraterapp · crater · CWE-284 Pre-auth Broken access control (IDOR)	Medium5.3	1.2%Jan 26, 2022
21Monitor	CVE-2022-0372No exploit	Cross-site Scripting (XSS) - Stored in crater-invoice/cratercraterapp · crater · CWE-79 XSS	Medium5.4	0.6%Jan 27, 2022
17Monitor	CVE-2022-0515No exploit	Cross-Site Request Forgery (CSRF) in crater-invoice/cratercraterapp · crater · CWE-352 Pre-auth CSRF	Medium4.3	0.4%Mar 21, 2022

CVE-2023-46865
35Monitor
/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing th
HighCVSS 7.2Proof of conceptEPSS 23%
- RCE
craterapp · craterOct 29, 2023
CVE-2021-4080
35Monitor
Unrestricted Upload of File with Dangerous Type in crater-invoice/crater
HighCVSS 8.8No exploitEPSS 1%
- File upload
craterapp · craterJan 12, 2022
CVE-2022-1033
31Monitor
Unrestricted Upload of File with Dangerous Type in crater-invoice/crater
HighCVSS 7.8No exploitEPSS 0%
- File upload
craterapp · craterMar 23, 2022
CVE-2022-1032
28Monitor
Insecure deserialization of not validated module file in crater-invoice/crater
HighCVSS 7.2No exploitEPSS 1%
- Deserialization
craterapp · craterMar 29, 2022
CVE-2022-0242
28Monitor
Unrestricted Upload of File with Dangerous Type in crater-invoice/crater
HighCVSS 7.2No exploitEPSS 1%
- File upload
craterapp · craterJan 17, 2022
CVE-2022-0514
26Monitor
Business Logic Errors in crater-invoice/crater
MediumCVSS 6.5No exploitEPSS 0%
craterapp · craterMar 21, 2022
CVE-2022-0203
21Monitor
Improper Access Control in crater-invoice/crater
MediumCVSS 5.3No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
craterapp · craterJan 26, 2022
CVE-2022-0372
21Monitor
Cross-site Scripting (XSS) - Stored in crater-invoice/crater
MediumCVSS 5.4No exploitEPSS 0%
- XSS
craterapp · craterJan 27, 2022
CVE-2022-0515
17Monitor
Cross-Site Request Forgery (CSRF) in crater-invoice/crater
MediumCVSS 4.3No exploitEPSS 0%
- Pre-auth
- CSRF
craterapp · craterMar 21, 2022