A 9.1 SQLi-to-webshell in EasyAppointments and an Ansible auth bypass you can spoof with one header

EasyAppointments 1.5.1 and earlier has a SQL injection bug in the customer search endpoint's order_by parameter. An attacker can enumerate your entire database schema and extract data using time-based techniques. Worse, if your MySQL config allows file writes (like INTO OUTFILE), they can drop a PHP webshell and get full remote code execution on your server.

Affected estate

Anyone self-hosting EasyAppointments version 1.5.1 or earlier, especially internet-facing instances

How to check

Check the version in the EasyAppointments admin panel or in the application's source files (e.g., config or composer.json). Confirm whether the /customers/search endpoint is reachable externally.

Included because

unauthenticated; internet-facing; SQL injection to RCE; CVSS 9.1

Action

Upgrade to a patched release. If unavailable, restrict access to the /customers/search endpoint at the web server or WAF level and verify MySQL's secure_file_priv setting.

Why it matters

A CVSS 9.1 SQL injection on a typically internet-facing booking app can lead to full database compromise and, in some configs, remote code execution via webshell.

GIMP's FITS image plugin miscalculates buffer sizes using signed 32-bit math. A crafted FITS file with oversized dimensions triggers an integer overflow, allocates too little memory, then writes past the end of the buffer. An attacker who gets you to open a malicious FITS file could crash GIMP or potentially run arbitrary code. This requires user interaction: someone has to open the file.

Affected estate

Anyone using GIMP to open FITS image files, particularly in scientific imaging or astronomy workflows

How to check

Run 'gimp --version' or check your package manager. Confirm the file-fits plugin is present in GIMP's plugin directory.

Included because

user interaction required; common desktop application; heap overflow to potential code execution; CVSS 7.8

Action

Update GIMP to a patched version. If updating isn't possible, remove or disable the file-fits plugin from the plugins directory.

Why it matters

Opening a single malicious FITS image could give an attacker code execution under the current user's privileges.

Red Hat's Event-Driven Ansible (EDA) server trusts the Subject HTTP header for mTLS authentication but never checks whether that header actually came from a legitimate TLS-terminating proxy. Any attacker who can reach the EDA API can spoof the header and inject events into your automation pipelines. The 403 error response also leaks the expected certificate Distinguished Name, making it trivial to craft the right header value.

Affected estate

Teams running Event-Driven Ansible (EDA) server with mTLS-protected event streams, especially if the API is reachable from untrusted networks

How to check

Review your EDA server deployment for ExternalEventStreamViewSet endpoints. Check whether the API is accessible from outside your trusted proxy layer by testing connectivity to the event stream endpoint.

Included because

unauthenticated; header spoofing bypasses mTLS; can trigger downstream automation; information leakage aids exploitation

Action

Apply the vendor fix. Immediately restrict API access to trusted proxies only, and stop relying on the Subject header for authentication until the patch is in place.

Why it matters

An attacker can inject arbitrary events into your automation pipelines, potentially triggering destructive or privilege-escalating playbook runs across your environment.

GIMP's ICNS image plugin reads past the end of a buffer when processing a truncated mask resource. A crafted ICNS file can leak heap memory contents (exposed as alpha channel pixel values) or crash GIMP outright. Exploitation requires a user to open the malicious file, but no other interaction is needed.

Affected estate

Anyone using GIMP to open Apple ICNS icon files

How to check

Run 'gimp --version' or check your package manager. Confirm the file-icns plugin is present in GIMP's plugin directory.

Included because

user interaction required; out-of-bounds read; info disclosure and DoS; CVSS 7.1

Action

Update GIMP when a patched version is available. Optionally remove or disable the file-icns plugin if ICNS support is not needed.

Why it matters

A crafted ICNS file can leak heap data or crash the application, though the risk is lower since exploitation requires user interaction and the impact is primarily info disclosure or denial of service.