Vendor
Capgo
83 known vulnerabilities.
4 results · Clear filters · Feed
-
Low 3.8
Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint
Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template …
-
Low 3.5
Capgo - Open Redirect via Unvalidated Stripe Billing URLs
Capgo before 12.128.2 contains an open redirect vulnerability in stripe_portal and stripe_checkout endpoints that accept unvalidated callbackUrl, successUrl, and cancelUrl parameters. Authenticated attackers can craft malicious billing URLs to redirect users …
-
Low 3.1
Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain Lookup
Capgo before 12.128.2 uses ILIKE pattern matching instead of exact matching for app_id lookup in the preview subdomain resolver, allowing underscore characters in app_id to act as SQL wildcards. Attackers can create apps with app_ids differing by one characte…
-
Low 3.8
Capgo - Improper 2FA Enforcement Logic via Team Security Settings
Capgo before 12.128.2 contains an authentication logic flaw: a user with permission to manage team or organization security settings can enable mandatory two-factor authentication for all team members without first enabling 2FA on their own account. The appli…