CVE-2018-8978

Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI...

CVE-2018-8979

Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI...

CVE-2018-8978

CVE-2018-8978 affects Open-AudIT Professional 2.1. A cross-site scripting vulnerability exists where an attacker can inject arbitrary script via a crafted src attribute of an IMG element in a URI. Documents indicate Open-AudIT Professional is vulnerable due to this XSS path; no additional exploit...

CVE-2018-8979

Open-Audit Professional 2.1 is documented to be vulnerable to Cross-Site Request Forgery (CSRF). The Open-AuditIT product (Professional 2.1) can be affected via a CSRF flaw that allows an attacker to modify a user account and, with chaining to XSS, compromise authentication context. Public refere...

CVE-2018-8978: Improper Neutralization of Input During Web Page Generation

Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI...

PT-2018-18756

Name of the Vulnerable Software and Affected Versions Open-AudIT Professional version 2.1 Description The issue is related to a crafted src attribute of an IMG element within a URI, which can lead to XSS. Recommendations For Open-AudIT Professional version 2.1, consider validating and sanitizing...

PT-2018-18757

Name of the Vulnerable Software and Affected Versions Open-AudIT Professional version 2.1 Description The issue allows for Cross-Site Request Forgery CSRF attacks, which can be used to modify user accounts or inject XSS sequences. This can be achieved by manipulating the credentials URI...

CVE-2018-8979: Improper Neutralization of Input During Web Page Generation

Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI...

CVE-2018-8903

Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen...

CVE-2018-8903

Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen...

Cross site scripting

Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen...

CVE-2018-8903

Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen...

CVE-2018-8903

Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen...

CVE-2018-8903

CVE-2018-8903 affects Open-AuditIT/Open‑Audit Professional 2.1. The vulnerability is a stored XSS via the Name or Description fields on the Credentials page, stemming from insufficient input sanitization. Public references in the connected documents confirm exploitation guidance (stored XSS PoC) ...

PT-2018-18704

Name of the Vulnerable Software and Affected Versions Open-AudIT Professional version 2.1 Description The issue allows for cross-site scripting XSS attacks via the Name or Description field on the Credentials screen. Recommendations For Open-AudIT Professional version 2.1, update to a version tha...

CVE-2018-8903: Improper Neutralization of Input During Web Page Generation

Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen...

Open Audit - SQL Injection

Exploit Title : Open Audit SQL Injection Vulnerability Exploit Author : Rahul Pratap Singh Date : 2/Jan/2016 Home page Link : https://github.com/jonabbey/open-audit Website : 0x62626262.wordpress.com Twitter : @0x62626262 Linkedin : https://in.linkedin.com/in/rahulpratapsingh94 1. Description "id...

Open Audit - SQL Injection

Exploit for php platform in category web applications Exploit Title : Open Audit SQL Injection Vulnerability Exploit Author : Rahul Pratap Singh Date : 2/Jan/2016 Home page Link : https://github.com/jonabbey/open-audit Website : 0x62626262.wordpress.com Twitter : @0x62626262 Linkedin :...

Open Audit SQL Injection Vulnerability

Open Audit suffers from a remote SQL injection vulnerability. Exploit Title : Open AuditGPL version SQL injection vulnerability Author : WICS Date : 9/12/2015 Software Link : https://github.com/jonabbey/open-audit Overview: deletemissedaudit.php is accessible without authentication and GET Method...

Open Audit SQL Injection

Exploit Title : Open AuditGPL version SQL injection vulnerability Author : WICS Date : 9/12/2015 Software Link : https://github.com/jonabbey/open-audit Overview: deletemissedaudit.php is accessible without authentication and GET Method parameter pc is not getting filter before passing to SQL quer...