| शीर्षक | Bottelet DaybydayCRM <= 2.2.1 Mass Assignment (CWE-915) |
|---|
| विवरण | A mass assignment vulnerability was found in Bottelet DaybydayCRM up to version 2.2.1. It has been rated as medium severity. The issue affects status update endpoints within TasksController, ProjectsController, and LeadsController. Due to the improper use of fill($request->all()) without filtering allowable input, an authenticated user can overwrite sensitive fields such as the title, description, or assigned user during a status update. The vulnerability was patched in Pull Request #363 by explicitly filtering inputs using the only() method. |
|---|
| स्रोत | ⚠️ https://github.com/Bottelet/DaybydayCRM/issues/348 |
|---|
| उपयोगकर्ता | Mitchell_45 (UID 98150) |
|---|
| सबमिशन | 11/05/2026 12:06 PM (30 दिन पहले) |
|---|
| संयम | 31/05/2026 06:26 PM (20 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 367576 [Bottelet DaybydayCRM तक 2.2.1 Setting कमजोर प्रमाणीकरण] |
|---|
| अंक | 0 |
|---|