Cross site scripting

CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks...

CVE-2022-42751

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions...

CVE-2022-42751

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions...

CVE-2022-42750

CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user...

CVE-2022-42750

CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user...

Design/Logic Flaw

CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user...

Cross site request forgery (csrf)

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions...

CVE-2022-42744

CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks...

CVE-2022-42745

CVE-2022-42745 affects CandidATS 3.0.0. The connected documents state that an external attacker can read arbitrary files from the server due to XXE vulnerability in the application. The Red Hat/Other sources corroborate the same description. There is no explicit exploit code or active exploitatio...

PT-2022-26535 · Candidats · Candidats

Name of the Vulnerable Software and Affected Versions: CandidATS version 3.0.0 Description: The issue allows an external attacker to read arbitrary files from the server due to the application being vulnerable to XXE. Recommendations: For CandidATS version 3.0.0, consider restricting access to...

CandidATS 代码问题漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. A security vulnerability exists in CandidATS version 3.0.0. An attacker exploited the vulnerability to read arbitrary files from the server...

CandidATS 跨站脚本漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. A security vulnerability exists in CandidATS version 3.0.0 that stems from not properly validating user input. An attacker exploits the vulnerability to steal an arbitrary user's cookie...

CVE-2022-42750

CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user...

CVE-2022-42750

CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user...

CVE-2022-42744

CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks...

PT-2022-26541 · Candidats · Candidats

Name of the Vulnerable Software and Affected Versions: CandidATS version 3.0.0 Description: The issue allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user. Recommendations: For...

CVE-2022-42750

CVE-2022-42750 affects CandidATS version 3.0.0. The root cause is improper validation of user-uploaded files, enabling an external attacker to steal cookies from arbitrary users. Multiple trusted sources (Red Hat advisory, NVD entry, and related vendor risk disclosures) corroborate this, with CVS...

CandidATS SQL注入漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. A security vulnerability exists in CandidATS version 3.0.0 that stems from the application not properly validating the entriesPerPage parameter against SQL injection attacks...

CVE-2022-42747

CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks...

CandidATS 跨站脚本漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. steal is an extensible common module loader from StealJS open source. It can load JavaScript modules defined in ES6, AMD and CommonJS formats. A security vulnerability exists in CandidATS version 3.0.0 that stems...