https://www.faydin.blog/en/ 2026-10-08T00:00:00Z Ferat Aydin https://www.faydin.blog/en/cves/CVE-2026-79363/ 2026-10-06T00:00:00Z 2026-10-08T00:00:00Z

Cloudron’s branding footer allowed HTML to be stored persistently. In the versions I tested (9.1.7 and 9.2), the value was rendered as HTML on the public login / OpenID interaction page and in the event log without sufficient sanitization. This allowed stored JavaScript to execute within the Cloudron origin.

https://www.faydin.blog/en/publikationen/passive-exposure-analyse-dora/ 2026-02-09T00:00:00Z 2026-10-08T00:00:00Z

I wanted to understand what passive data alone can reveal about the external attack surface of organizations operating in a DORA-relevant environment. To explore this, I examined 195 Austrian domains using Certificate Transparency and DNS data—without active scanning.

https://www.faydin.blog/en/cves/CVE-2025-60917/ 2025-11-24T00:00:00Z 2026-10-08T00:00:00Z

In the OpenAtlas network overview, the color parameter could reach rendered output in a way that executed JavaScript. A crafted link was sufficient; the payload did not have to be stored.

https://www.faydin.blog/en/cves/CVE-2025-60916/ 2025-11-24T00:00:00Z 2026-10-08T00:00:00Z

The same network overview contained a second XSS vector through the charge parameter. Client-side processing could turn this data into executable content.

https://www.faydin.blog/en/cves/CVE-2025-60915/ 2025-11-24T00:00:00Z 2026-10-08T00:00:00Z

In OpenAtlas, the size parameter influenced the directory path used by a file endpoint. A low-privileged user could escape the intended directory and access files outside the uploads area.

https://www.faydin.blog/en/cves/CVE-2025-60914/ 2025-11-24T00:00:00Z 2026-10-08T00:00:00Z

The /display_logo endpoint served files from the uploads directory without properly checking authorization. Anyone who knew or could guess a valid filename could retrieve a file without logging in.

https://www.faydin.blog/en/cves/CVE-2025-56423/ 2025-11-24T00:00:00Z 2026-10-08T00:00:00Z

The OpenAtlas login form revealed whether a username existed by returning different error messages. This allowed valid accounts to be enumerated without knowing any passwords.

https://www.faydin.blog/en/cves/CVE-2025-51533/ 2025-08-07T00:00:00Z 2026-10-08T00:00:00Z

Internal Sage DPW forms could be discovered systematically using predictable resource IDs. This became a security issue when the discovered pages lacked effective server-side authentication or authorization checks.

https://www.faydin.blog/en/cves/CVE-2025-51532/ 2025-08-06T00:00:00Z 2026-10-08T00:00:00Z

The Sage DPW Database Monitor could be accessed directly without a valid session, allowing external users to inspect internal database structures and operational information.

https://www.faydin.blog/en/cves/CVE-2025-51531/ 2025-08-06T00:00:00Z 2026-10-08T00:00:00Z

The Sage DPW DB Monitor inserted the tabfields parameter into HTML output without proper filtering. A crafted link could therefore execute JavaScript in a user’s browser.

https://www.faydin.blog/en/cves/CVE-2025-51536/ 2025-08-04T00:00:00Z 2026-10-08T00:00:00Z

OpenAtlas 8.11.0 included a privileged default account with known or hard-coded credentials. If such an account remains active, an attacker needs no further exploit: the login itself provides access.

https://www.faydin.blog/en/cves/CVE-2025-51535/ 2025-08-04T00:00:00Z 2026-10-08T00:00:00Z

OpenAtlas 8.11.0 exposed an SQL console in its administrative interface, allowing privileged users to execute broad database commands. Public CVE databases classify the finding as SQL injection, whereas my original report concerned the unrestricted SQL function in the admin UI.

https://www.faydin.blog/en/cves/CVE-2025-51534/ 2025-08-04T00:00:00Z 2026-10-08T00:00:00Z

In OpenAtlas 8.11.0, a name field allowed JavaScript to be stored persistently. The payload subsequently reappeared in the interface and could execute in another user’s browser when that record was edited or deleted.