290 matches found
CVE-2020-9338: Improper Neutralization of Input During Web Page Generation
SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field...
SOPlanning SQL Injection Vulnerability (CNVD-2020-10631)
SOPlanning is an online planning tool for efficiently organizing projects and tasks. SOPlanning 1.45 suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to execute commands via the users parameter of exportical.php...
SOPlanning SQL Injection Vulnerability (CNVD-2020-10632)
SOPlanning is an online planning tool for efficiently organizing projects and tasks. An SQL injection vulnerability exists in the OrderBy clause in SOPlanning 1.45. An attacker can exploit this vulnerability to obtain information about a user's table via the projets.php?order=nomcreateur&by=...
SOPlanning Cross-Site Request Forgery Vulnerability
SOPlanning is an online planning tool for efficiently organizing projects and tasks. SOPlanning 1.45 suffers from a cross-site request forgery vulnerability. An attacker can exploit this vulnerability to create arbitrary users via process/xajaxserver.php...
CVE-2020-9269
SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by exportical.php...
CVE-2020-9268
SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nomcreateur&by= substring...
CVE-2020-9269
SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by exportical.php...
CVE-2020-9268
SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nomcreateur&by= substring...
CVE-2020-9266
SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajaxserver.php...
CVE-2020-9267
SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajaxserver.php...
CVE-2020-9266
SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajaxserver.php...
CVE-2020-9268
SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nomcreateur&by= substring...
Sql injection
SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by exportical.php...
Cross site request forgery (csrf)
SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajaxserver.php...
Sql injection
SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nomcreateur&by= substring...
CVE-2020-9266
SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajaxserver.php...
Cross site request forgery (csrf)
SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajaxserver.php...
CVE-2020-9269
SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by exportical.php...
CVE-2020-9266
SOPlanning 1.45 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that lets an attacker arbitrarily change the administrator password via the endpoint process/xajax_server.php. The underlying issue is a CSRF in the admin password change flow; this is documented across multiple sour...
