EUVD-2026-98931

Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit, Extra::edit, Leaves::delete,...

PT-2025-52949

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s wifi subsystem, specifically within the cfg80211 and OCB Operation Channel Binding components. The issue involves unnecessary requests to the driver o...

CVE-2024-22133

SAP Fiori Front End Server - version 605, allows altering of approver details on the read-only field when sending leave request information. This could lead to creation of request with incorrect approver causing low impact on Confidentiality and Integrity with no impact on Availability of the...

PT-2024-19219 · Sap · Sap Fiori Front End Server

Name of the Vulnerable Software and Affected Versions: SAP Fiori Front End Server version 605 Description: The issue allows altering of approver details on the read-only field when sending leave request information, potentially leading to the creation of requests with incorrect approvers. This...

CVE-2023-45540

An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page...

CVE-2023-45540

An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page...

CVE-2023-45540

An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page...

PT-2023-29568 · Unknown · Jorani Leave Management System

Name of the Vulnerable Software and Affected Versions: Jorani Leave Management System version 1.0.3 Description: The issue allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page. This can potentially lead to malicious...

CVE-2023-45540: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page...

WP ERP < 1.12.4 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the employeename parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. As an admin user, visit the following URL on the site:...

CVE-2018-2474

SAP Fiori 1.0 for SAP ERP HCM Approve Leave Request, version 2 application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection...