16 matches found
EUVD-2024-31432
SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut...
CVE-2024-33722
SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut...
CVE-2024-33722
SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut...
CVE-2024-33722
The SOPlanning project management software (version 1.52.00 ) is vulnerable to SQL Injection via the projets.php script. The root cause is a lack of protective measures for the SQL query structure, specifically involving the statut[] parameter. An authenticated user can exploit this to execute ar...
CVE-2025-62297
SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening edited page. This issue was fixed in version 1.55...
EUVD-2025-198307
SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening edited page. This issue was fixed in version 1.55...
CVE-2025-62297
SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening edited page. This issue was fixed in version 1.55...
CVE-2025-62297
CVE-2025-62297 (SOPlanning) is a stored XSS vulnerability affecting the SOPlanning application. Multiple endpoints are reported where an attacker with medium privileges can inject arbitrary HTML/JS that is rendered when editors load pages, including /projets, /taches, /status, /groupe_form, and r...
CVE-2025-62297 Stored XSS in SOPlanning
SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening edited page. This issue was fixed in version 1.55...
CVE-2025-62297 Stored XSS in SOPlanning
SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening edited page. This issue was fixed in version 1.55...
PT-2025-47597
Name of the Vulnerable Software and Affected Versions SOPlanning versions prior to 1.55 Description SOPlanning is susceptible to a Stored Cross-Site Scripting XSS issue in the /projets API endpoint. An attacker with medium privileges can inject arbitrary HTML and JavaScript code into the website...
CVE-2025-62297: Improper Neutralization of Input During Web Page Generation
SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening edited page. This issue was fixed in version 1.55...
SOPlanning 跨站脚本漏洞
SOPlanning is a suite of online project management software from SOPlanning, Inc. A cross-site scripting vulnerability exists in SOPlanning versions prior to 1.55, which stems from the /projets endpoint that does not properly clean its input, and could lead to stored cross-site scripting...
Exploit for CVE-2024-33722
Exploit Title: SOPlanning v1.52.00 'groupesave.php' XSS Reflec...
SOPlanning SQL Injection Vulnerability (CNVD-2020-10632)
SOPlanning is an online planning tool for efficiently organizing projects and tasks. An SQL injection vulnerability exists in the OrderBy clause in SOPlanning 1.45. An attacker can exploit this vulnerability to obtain information about a user's table via the projets.php?order=nomcreateur&by=...