Craterapp Crater — known CVE vulnerabilities

Every CVE whose affected-product data names Craterapp Crater, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (9)

• CVE-2021-4080 — CVSS 8.8 (high): crater is vulnerable to Unrestricted Upload of File with Dangerous Type
• CVE-2022-1033 — CVSS 7.8 (high): Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.
• CVE-2023-46865 — CVSS 7.2 (high): /api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing…
• CVE-2022-0242 — CVSS 7.2 (high): Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
• CVE-2022-1032 — CVSS 7.2 (high): Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.
• CVE-2022-0514 — CVSS 6.5 (medium): Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.
• CVE-2022-0372 — CVSS 5.4 (medium): Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.
• CVE-2022-0203 — CVSS 5.3 (medium): Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.
• CVE-2022-0515 — CVSS 4.3 (medium): Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.