CVE-2022-42744

CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks...

CandidATS 跨站脚本漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. A security vulnerability exists in CandidATS version 3.0.0 that stems from not properly validating user input. An attacker exploits the vulnerability to steal an arbitrary user's cookie...

CandidATS 代码问题漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. A security vulnerability exists in CandidATS version 3.0.0. An attacker exploited the vulnerability to read arbitrary files from the server...

CVE-2022-42746

CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks...

CandidATS 跨站脚本漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. A security vulnerability exists in CandidATS version 3.0.0 that stems from not properly validating user input. An attacker exploits the vulnerability to steal an arbitrary user's cookie...

CandidATS 跨站脚本漏洞

CandidATS is a free and open source recruiter tracking system from CandidATS India. A security vulnerability exists in CandidATS version 3.0.0 that stems from not properly validating user input. An attacker exploits the vulnerability to steal an arbitrary user's cookie...

PT-2022-26534 · Candidats · Candidats

Name of the Vulnerable Software and Affected Versions: CandidATS version 3.0.0 Description: The issue allows an external attacker to perform CRUD operations on the application databases due to incorrect validation of the entriesPerPage parameter against SQL injection attacks. Recommendations: For...

CVE-2022-42748

CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks...

CVE-2022-42750

CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user...

CVE-2022-42747

CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks...

PT-2022-26538 · Candidats · Candidats

Name of the Vulnerable Software and Affected Versions: CandidATS version 3.0.0 Description: The issue allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not properly validate user input against XSS attacks, specifically on the...

CVE-2022-42748

CandidATS 3.0.0 is affected by a Cross-Site Scripting (XSS) flaw in the sortDirection parameter of ajax.php. The Nuclei template confirms exploitation by injecting arbitrary script in the victim's browser, enabling cookie-based credential theft and related attacks. The root cause is improper inpu...

PT-2022-26542 · Candidats · Candidats

Name of the Vulnerable Software and Affected Versions: CandidATS version 3.0.0 Description: The issue allows an external attacker to elevate privileges in the application due to a Cross-Site Request Forgery CSRF weakness. This enables the attacker to persuade an administrator into creating a new...

PT-2022-26536 · Candidats · Candidats

Name of the Vulnerable Software and Affected Versions: CandidATS version 3.0.0 Description: The issue allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not properly validate user input against XSS attacks, specifically on the...

PT-2022-26539 · Candidats · Candidats

Name of the Vulnerable Software and Affected Versions: CandidATS version 3.0.0 Description: The issue allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not properly validate user input against XSS attacks, specifically on the 'page' ...

CVE-2022-42748

CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks...

CVE-2022-42749

CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks...

CVE-2022-42744

CVE-2022-42744 affects CandidATS at version 3.0.0. The root cause is improper validation of the entriesPerPage parameter, enabling an external attacker to perform CRUD operations on the application databases via SQL injection. Impact is high: confidentiality, integrity, and availability are all c...

CVE-2022-42746

CandidATS 3.0.0 has a cross-site scripting (XSS) vulnerability via the indexFile parameter of ajax.php. The Nuclei template and related sources describe that an attacker can inject arbitrary script into the victim’s browser, enabling cookie-based credential theft and potential session hijacking. ...

CVE-2022-42747

CandidATS 3.0.0 is vulnerable to a Cross‑Site Scripting (XSS) flaw in the sortBy parameter of ajax.php. An attacker can inject scripts to steal cookies from victims. The issue is documented across several sources (NVD, Nuclei template, Red Hat advisory). Remediation options cited include upgradin...