Cross site scripting

Cross-site scripting XSS vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Unrestricted file upload

Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file...

CVE-2015-7904

CVE-2015-7904 affects Mango Automation by Infinite Automation Systems. An authenticated remote user can trigger arbitrary JSP code execution due to improper verification of uploaded image files, allowing unrestricted file upload in Mango Automation 2.5.x and 2.6.x prior to 2.6.0 build 430. Public...

CVE-2015-7903

Mango Automation (Infinite Automation Systems) is affected by CVE-2015-7903: an SQL injection vulnerability in Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 that allows an authenticated remote user to execute arbitrary SQL commands via unspecified vectors. Public discussions indicate th...

CVE-2015-7901

Infinite Automation Mango Automation versions 2.5.x–2.6.0 beta (builds prior to 430) contain an OS command injection vulnerability that can be exploited by an authenticated remote user to execute arbitrary commands. Affected component/issue is demonstrated by public exploit references (e.g., Expl...

CVE-2015-6494

Summary: CVE-2015-6494 is a cross-site scripting (XSS) vulnerability in Infinite Automation Mango Automation, affecting version series 2.5.x and 2.6.x before 2.6.0 build 430. An authenticated remote user could inject arbitrary web script/HTML via unspecified vectors. The issue was publicized with...