Open-source CRM erxes Faces 2024 Auth Bypass and Path Traversal Flaws Fixed in 1.6.2

·18 views

Security researchers counted roughly 3,394 internet-facing erxes instances, an open-source CRM with a plugin architecture, in an October 2026 scan. SonarSource disclosed three vulnerabilities in June 2025 affecting versions before 1.6.2. The most severe, rated 9.8, let attackers bypass authentication by forging a User HTTP header and reach any GraphQL endpoint. Two other flaws, rated 5.4, allowed unauthenticated file reads and authenticated file writes through path traversal. The findings suggest the problems stem from services trusting a header set by a gateway, so each component must be checked and updated individually, not just the front end.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Generate PDFs from HTML in n8n Cloud using only a Code node

n8n Cloud does not allow installing PDF libraries in Code nodes, so the author wrote a plain JavaScript generator that builds PDF files directly. The tool can be tested in a browser before being pasted into an n8n Code node, which then returns the PDF as binary data from items containing an HTML field. It handles headings, paragraphs, lists, line breaks, preformatted text, horizontal rules and common HTML entities on A4 pages with automatic page breaks. It does not support CSS, images, tables, links, inline bold or italics, or non-Latin text, so browser-based PDF services remain better for pixel-perfect output. The workflow was tested in n8n Cloud in October 2026, and the code and importable workflow are available free under the MIT license.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

CodeClash Adds a Local-LLM 'Ghost Racer' to Its 1v1 Codeforces Duels

CodeClash is a real-time competitive programming arena where two players, matched by Elo, race to get the first Accepted verdict on the same Codeforces problem. The platform offers ranked matchmaking, private challenge rooms, an embedded multi-language IDE, live verdict tracking, and a global leaderboard. For the Hacktoberfest Open-Source AI Challenge, its developer added a Ghost Racer, an open-weight AI agent that runs locally and competes against a player on the same problem without needing a human opponent. The agent attempts solutions, fails and retries on sample tests, and either wins or drops out. Verdicts are drawn from Codeforces' official submission data rather than a custom judge, and the backend runs on FastAPI with Neon PostgreSQL.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

eMudhra Intermediate CA Keys Found Weak, Enabling Private Key Recovery

eMudhra's April 30, 2025 key-generation ceremony reportedly produced weak private keys for eight intermediate certificate authorities using elliptic-curve cryptography. The affected values were far smaller than the roughly 384 bits of randomness a P-384 key should have, so the private keys could be recovered from the public keys in under a second. A researcher reported the flaw to the Chrome Root Program in October 2026, after the weak intermediates had been publicly trusted for about 18 months. Chrome and Firefox moved quickly to block the affected certificates, and eMudhra revoked the intermediates and announced customer migration support. No public evidence so far shows the weak keys were exploited, though eMudhra's final root-cause analysis is still pending.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Hướng dẫn vòng lặp while và do-while trong Java kèm break và continue

Bài viết tiếp tục đi sâu vào các khái niệm về vòng lặp while trong Java, bao gồm vòng lặp while, do-while và cách dùng các từ khóa break và continue. Vòng lặp while thực thi khối lệnh khi điều kiện còn đúng, và điều kiện được kiểm tra trước mỗi lần lặp. Vòng lặp do-while luôn chạy khối lệnh ít nhất một lần vì điều kiện được đánh giá ở cuối vòng lặp. Từ khóa break được dùng để thoát khỏi vòng lặp hoặc switch ngay lập tức, còn continue bỏ qua lần lặp hiện tại và chuyển sang lần tiếp theo. Bài viết kèm các ví dụ minh họa mã Java cho từng trường hợp.

0 comments Read more at DEV Community