jesse-a/OpenCRM
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases 1 Packages Wiki Activity Actions
Labels Milestones
Search syntax
assignee:<username> Filter by assigned user
author:<username> Filter by the author
is:all All
is:closed Closed
is:open Open
mentions:<username> Filter by mentioned user
modified:[>|<]<date> Filter by last modified date
review:<username> Filter by user who reviewed
sort:<by>:[asc|desc] Sort by: created|comments|updated|deadline
New issue
0 Open 12 Closed 12 All
Label
Clear labels
deferred
fixed
security
severity-high
severity-low
severity-medium
Milestone
No milestone
Projects
Clear projects
Assignee
Clear assignees
No assignee
jesse-a
cPanel-host SSRF via userinfo-injection (evil.com@127.0.0.1)
fixed
security
severity-high
1
#126 by jesse-a was closed 2026-05-26 18:23:55 +00:00
HR-6: KVK-sandbox-API-key in broncode gecommit
fixed
security
severity-high
1
#118 by jesse-a was closed 2026-05-26 18:23:48 +00:00
F-02: Stored XSS in wachtwoordkluis (javascript:-URL)
fixed
security
severity-high
1
#112 by jesse-a was closed 2026-05-26 18:23:44 +00:00
F-01: standaard beheerderswachtwoord admin1234 (HIGH)
fixed
security
severity-high
1
#111 by jesse-a was closed 2026-05-26 18:23:43 +00:00
v0.12 — Sessies + TOTP volledig hardened (8 sub-fixes)
fixed
security
severity-high
1
#106 by jesse-a was closed 2026-05-26 18:23:40 +00:00
DOCUSEAL_WEBHOOK_SECRET was optioneel
fixed
security
severity-high
1
#105 by jesse-a was closed 2026-05-26 18:23:39 +00:00
Fiatteur-actions omzeilden MFA + resendApproverMail had geen rol-check
fixed
security
severity-high
1
#99 by jesse-a was closed 2026-05-26 18:23:33 +00:00
MFA-enforcement ontbrak in route-handlers (alleen requireRole/assertCanWrite was MFA-aware)
fixed
security
severity-high
1
#98 by jesse-a was closed 2026-05-26 18:23:32 +00:00
decryptString miste purpose-param → cPanel-token decryptie returnde null
fixed
security
severity-high
1
#90 by jesse-a was closed 2026-05-26 18:23:28 +00:00
SSRF via WordPress URL-input (interne services bereikbaar)
fixed
security
severity-high
1
#87 by jesse-a was closed 2026-05-26 18:23:26 +00:00
/data export-routes door VIEWER bereikbaar (privilege escalation)
fixed
security
severity-high
1
#86 by jesse-a was closed 2026-05-26 18:23:25 +00:00
MFA wordt alleen UI-side afgedwongen, niet server-side
fixed
security
severity-high
1
#85 by jesse-a was closed 2026-05-26 18:23:24 +00:00