Vulnerabilidades de Ricardoboss
CVEs publicadas que afetam produtos de Ricardoboss: 1 registro(s), com severidade, exploração e correções.
CVE-2025-65112
Crítica · 9.8
CWE-306 28/11/2025
PubNet Critical Authentication Bypass Allows Unauthenticated Package Upload and Identity Spoofing
PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain attacks. This issue has been patched in version 1.1.3.