Craterapp
Craterapp Crater: vulnerabilidades y CVE
Craterapp Crater tiene 13 vulnerabilidades publicadas, 4 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE13
Últimos 12 meses4
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-57863 | Alta (8.7) | 0.90% | — | 25 ago 2026 | Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying… |
| CVE-2026-71242 | Alta (8.3) | 0.37% | — | 5 ago 2026 | Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify… |
| CVE-2026-55739 | Alta (8.3) | 0.37% | — | 5 ago 2026 | Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the… |
| CVE-2026-14791 | Baja (2) | 0.35% | — | 6 jul 2026 | A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a… |
| CVE-2023-46865 | Alta (7.2) | 20% | — | 30 oct 2023 | /api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image. |
| CVE-2022-1032 | Alta (7.2) | 1.6% | — | 29 mar 2022 | Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6. |
| CVE-2022-1033 | Alta (7.8) | 0.92% | — | 23 mar 2022 | Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6. |
| CVE-2022-0515 | Media (4.3) | 0.43% | — | 21 mar 2022 | Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4. |
| CVE-2022-0514 | Media (6.5) | 0.96% | — | 21 mar 2022 | Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5. |
| CVE-2022-0372 | Media (5.4) | 0.61% | — | 27 ene 2022 | Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2. |
| CVE-2022-0203 | Media (5.3) | 1.2% | — | 26 ene 2022 | Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2. |
| CVE-2022-0242 | Alta (7.2) | 1.4% | — | 17 ene 2022 | Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0. |
| CVE-2021-4080 | Alta (8.8) | 1.5% | — | 12 ene 2022 | crater is vulnerable to Unrestricted Upload of File with Dangerous Type |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.