CVE-2018-16809

Dolibarr up to 7.0.0: the expense reports module (expensereport/card.php) is vulnerable to SQL injection via integer parameters qty and value_unit due to insufficient input validation. Root cause described as an injectable SQL path in that file; impact per CVE notes is high, with a NVD CVSS v3 ba...

CVE-2018-16808

An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note...

PT-2019-9376

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 7.0.1 Description An issue was discovered in the expense reports module, specifically in expensereport/card.php, which allows SQL injection via the integer parameters qty and value unit. Recommendations For versions...

PT-2019-9375

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 7.0.1 Description The issue concerns Stored XSS in the expense reports plugin. It occurs via the comments parameter, or a public or private note, in the expensereport/card.php file. Recommendations For versions prior...

Expensify - Expense Reports - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Expensify - Expense Reports published at the 'play' market has multiple vulnerabilities...

Unspecified Vulnerability in Oracle PeopleSoft Products (CNVD-2015-06955)

Oracle PeopleSoft Products is a suite of enterprise human capital management solutions from Oracle. An unspecified vulnerability exists in Oracle PeopleSoft Products 9.2. It allows an authenticated remote user to affect confidentiality through the associated expense report general unknown vector...

CVE-2002-0582

WorkforceROI Xpede 4.1 stores temporary expense claim reports in a world-readable and indexable /reports/temp directory, which allows remote attackers to read the reports by accessing the directory...

CVE-2002-0583

CVE-2002-0583 affects WorkforceROI Xpede 4.1. The vulnerability stems from using a small random namespace (5 alphanumeric chars) for temporary expense claim reports stored under /reports/temp, enabling remote attackers to read these reports through brute-force access. Impact described as confiden...