Vendor
ChronoFrame versions 1.0.0 and earlier are vulnerable to a missing authentication flaw in API handlers, allowing unauthenticated attackers to reconfigure instance storage and site settings.