Skip to content
OpenAdvisories

Vendor

vas3k

5 known vulnerabilities.

Products

TaxHacker 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.2
    CVE-2026-125749

    TaxHacker through 0.8.5 IDOR via Settings Server Actions userId

    TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCa…

    vas3k TaxHacker
  • Medium 5.3
    CVE-2026-94040

    vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery

    A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/(app)/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to serve…

    vas3k TaxHacker
  • Medium 6.3
    CVE-2026-78061

    vas3k TaxHacker Email Sync imap-client.ts buildImapConfig server-side request forgery

    A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request f…

    vas3k TaxHacker