RentSyst – CRM solution for fleet management Security & Risk Analysis

The "rentsyst" plugin v2.0.125 presents a mixed security posture. While the absence of critical or high severity vulnerabilities in its history and no reported dangerous functions or file operations are positive signs, several concerning aspects arise from the static analysis. A significant portion of the REST API routes (4 out of 4) lack permission callbacks, and a notable percentage of output (64%) is not properly escaped, increasing the risk of Cross-Site Scripting (XSS) vulnerabilities. The presence of unsanitized paths in 50% of the analyzed taint flows, even without critical or high severity, warrants attention as it suggests potential for path traversal or similar issues. The plugin's vulnerability history shows a past of medium severity XSS and CSRF vulnerabilities, indicating a recurring pattern that, while currently unpatched, suggests a need for continued vigilance. The presence of outdated bundled libraries is also a minor concern. Overall, while the plugin isn't riddled with critical flaws, the unescaped output, unprotected REST API routes, and past vulnerability trends point to a moderate risk profile that requires attention to mitigate potential attacks.