jesse-a/OpenCRM
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases 1 Packages Wiki Activity Actions
Labels Milestones
Search syntax
assignee:<username> Filter by assigned user
author:<username> Filter by the author
is:all All
is:closed Closed
is:open Open
mentions:<username> Filter by mentioned user
modified:[>|<]<date> Filter by last modified date
review:<username> Filter by user who reviewed
sort:<by>:[asc|desc] Sort by: created|comments|updated|deadline
New issue
0 Open 23 Closed 23 All
Label
Clear labels
deferred
fixed
security
severity-high
severity-low
severity-medium
Milestone
No milestone
Projects
Clear projects
Assignee
Clear assignees
No assignee
jesse-a
WP- en cPanel-fetches: DNS-resolutie naar privé-IP werd niet gecontroleerd
fixed
security
severity-medium
1
#127 by jesse-a was closed 2026-05-26 18:23:56 +00:00
2FA verplicht voor ALLE gebruikers (geen opt-out)
fixed
security
severity-medium
1
#125 by jesse-a was closed 2026-05-26 18:23:54 +00:00
Step-up rate-limit + zwak-wachtwoord-check + security-alert-mails + extra headers (4 sub-fixes)
fixed
security
severity-medium
1
#123 by jesse-a was closed 2026-05-26 18:23:51 +00:00
HSTS-header ontbrak
fixed
security
severity-medium
1
#122 by jesse-a was closed 2026-05-26 18:23:50 +00:00
Middleware bouwt redirect uit X-Forwarded-Host (host-header-injection)
fixed
security
severity-medium
1
#120 by jesse-a was closed 2026-05-26 18:23:49 +00:00
HR-5: TOTP-code hergebruikbaar tussen enable/disable + login
fixed
security
severity-medium
1
#117 by jesse-a was closed 2026-05-26 18:23:47 +00:00
HR-1: geen brute-force-bescherming op login + 2FA-stap
fixed
security
severity-medium
1
#114 by jesse-a was closed 2026-05-26 18:23:45 +00:00
F-03: bon-download afgeschermd op rol
fixed
security
severity-medium
1
#113 by jesse-a was closed 2026-05-26 18:23:45 +00:00
v0.12 — Role-gating op AI/travel/search routes + safeNextPath + email-leak (5 sub-fixes)
fixed
security
severity-medium
1
#110 by jesse-a was closed 2026-05-26 18:23:43 +00:00
v0.12 — Input validation: CSV-formula, zip-slip, mass-assignment (3 sub-fixes)
fixed
security
severity-medium
1
#109 by jesse-a was closed 2026-05-26 18:23:42 +00:00
v0.12 — Webhook + cron-endpoint hardening (3 sub-fixes)
fixed
security
severity-medium
1
#108 by jesse-a was closed 2026-05-26 18:23:41 +00:00
v0.12 — Approval-flow + self-approval-bypass dichtgezet (3 sub-fixes)
fixed
security
severity-medium
1
#107 by jesse-a was closed 2026-05-26 18:23:40 +00:00
MIME-validatie ontbrak bij uploads + downloads serveerden zonder nosniff
fixed
security
severity-medium
1
#104 by jesse-a was closed 2026-05-26 18:23:37 +00:00
Open-redirect via login ?next=-parameter
fixed
security
severity-medium
1
#102 by jesse-a was closed 2026-05-26 18:23:35 +00:00
DocuSeal-webhook status-rollback: late decline/expired-events draaiden afgeronde deals terug
fixed
security
severity-medium
1
#101 by jesse-a was closed 2026-05-26 18:23:34 +00:00
SSRF nog niet dicht: cPanel-host onvalidated + fetches volgden redirects
fixed
security
severity-medium
1
#100 by jesse-a was closed 2026-05-26 18:23:34 +00:00
Audit-trail-misattributie: webhook-acties toegewezen aan eerste admin alfabetisch
fixed
security
severity-medium
1
#97 by jesse-a was closed 2026-05-26 18:23:32 +00:00
Dubbele factuur-mail door race-conditie in finalizeAcceptedQuote
fixed
security
severity-medium
1
#96 by jesse-a was closed 2026-05-26 18:23:31 +00:00
CSP script-src had 'unsafe-inline' — markup-injection-XSS mogelijk
fixed
security
severity-medium
1
#94 by jesse-a was closed 2026-05-26 18:23:30 +00:00
Logo-upload vertrouwde browser-gerapporteerd MIME-type
fixed
security
severity-medium
1
#92 by jesse-a was closed 2026-05-26 18:23:29 +00:00