Cross site scripting

CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks...

CVE-2022-42751

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions...

CVE-2022-42751

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions...

CVE-2022-42750

CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user...

CVE-2022-42750

CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user...

Cross site request forgery (csrf)

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions...

Design/Logic Flaw

CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user...

CVE-2022-42744

CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks...

CVE-2022-42746

CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks...

CandidATS 跨站请求伪造漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. A security vulnerability exists in CandidATS version 3.0.0. An attacker can elevate privileges by exploiting the vulnerability...

CandidATS SQL注入漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. A security vulnerability exists in CandidATS version 3.0.0 that stems from the application not properly validating the entriesPerPage parameter against SQL injection attacks...

CandidATS 跨站脚本漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. CandidATS version 3.0.0 suffers from a security vulnerability that stems from not properly validating user uploaded files. An attacker exploits the vulnerability to steal an arbitrary user's cookie...

CVE-2022-42751

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions...

CVE-2022-42751

CandidATS 3.0.0 is affected by a CSRF-based vulnerability that lets an external attacker elevate privileges by persuading an administrator to create a new account with administrative permissions. Root cause: CSRF weakness in the application. Impact: potential admin-level access escalation. Exploi...

CVE-2022-42747

CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks...

CVE-2022-42745

CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE...

CandidATS 跨站脚本漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. steal is an extensible common module loader from StealJS open source. It can load JavaScript modules defined in ES6, AMD and CommonJS formats. A security vulnerability exists in CandidATS version 3.0.0 that stems...

CVE-2022-42750

CVE-2022-42750 affects CandidATS version 3.0.0. The root cause is improper validation of user-uploaded files, enabling an external attacker to steal cookies from arbitrary users. Multiple trusted sources (Red Hat advisory, NVD entry, and related vendor risk disclosures) corroborate this, with CVS...

PT-2022-26541 · Candidats · Candidats

Name of the Vulnerable Software and Affected Versions: CandidATS version 3.0.0 Description: The issue allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user. Recommendations: For...

CVE-2022-42749

CVE-2022-42749 affects CandidATS 3.0.0. The flaw is a cross-site scripting (XSS) vulnerability in the ajax.php resource, specifically via the page parameter, allowing an attacker to inject scripts and potentially steal cookie-based authentication credentials in the victim’s browser. Affected comp...