Vulnerabilidades de Opensource-socialnetwork
CVEs publicadas que afetam produtos de Opensource-socialnetwork: 5 registro(s), com severidade, exploração e correções.
CVE-2026-108950
Média · 5.3
CWE-862 12/10/2026
Open Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Routes
Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos and other stored files without any access check.
CVE-2026-108164
Média · 6.5
CWE-639 10/10/2026
Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route
Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification.
CVE-2026-41309
Alta · 8.2
CWE-400 24/04/2026
Open Source Social Network (OSSN) Vulnerable to Resource Exhaustion via Malicious Image Processing
Open Source Social Network (OSSN) is open-source social networking software developed in PHP. Versions prior to 9.0 are vulnerable to resource exhaustion. An attacker can upload a specially crafted image with extreme pixel dimensions (e.g., $10000 \times 10000$ pixels). While the compressed file size on disk may be small, the server attempts to allocate significant memory and CPU cycles during the decompression and resizing process, leading to a Denial of Service (DoS) condition. It is highly recommended to upgrade to OSSN 9.0. This version introduces stricter validation of image dimensions and improved resource management during the processing phase. Those who cannot upgrade immediately can mitigate the risk by adjusting their `php.ini` settings to strictly limit `memory_limit` and `max_execution_time` and/or implementing a client-side and server-side check on image headers to reject files exceeding reasonable pixel dimensions (e.g., $4000 \times 4000$ pixels) before processing begins.
CVE-2025-63585
Média · 6.5
CWE-89 05/11/2025
SQL Injection em Opensource-socialnetwork Open Source Social Network
OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter.
CVE-2025-63441
Alta · 7.3
CWE-79 03/11/2025
Cross-site Scripting (XSS) em Opensource-socialnetwork Open Source Social Network
Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint u/administrator/friends.