Vendor
venturedrake
2 known vulnerabilities.
Products
2 results · Clear filters · Feed
-
Medium 6.5
VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or…
-
Medium 6.5
VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on component…