56 matches found
CVE-2019-16059
Sentrifugo 3.2 lacks CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code at index.php/dashboard/viewprofile via a crafted HTML page...
EUVD-2020-19339
Malware in sbrugna...
EUVD-2019-6731
Malware in sbrugna...
EUVD-2024-26867
Malicious code in bioql PyPI...
EUVD-2024-26861
Malicious code in bioql PyPI...
EUVD-2024-26864
Malicious code in bioql PyPI...
CVE-2019-15814
Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML...
CVE-2024-29878
Cross-Site Scripting XSS vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/sitepreference/add, 'description' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data...
CVE-2024-29878
Cross-Site Scripting XSS vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/sitepreference/add, 'description' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data...
CVE-2024-29879
Cross-Site Scripting XSS vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'businessid' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data...
CVE-2024-29875
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/exportactiveuserrpt, 'sortname' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it...
CVE-2024-29875
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/exportactiveuserrpt, 'sortname' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it...
CVE-2024-29873
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/businessunits/format/html, 'bunitname' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it...
CVE-2024-29873
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/businessunits/format/html, 'bunitname' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it...
CVE-2024-29872
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/empscreening/add, 'agencyids' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it...
CVE-2024-29870
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'businessid' parameter./sentrifugo/index.php/index/getdepartments/format/html, 'businessid' parameter. The exploitation of this vulnerability could allow a remote user to send a speciall...
CVE-2024-29870
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'businessid' parameter./sentrifugo/index.php/index/getdepartments/format/html, 'businessid' parameter. The exploitation of this vulnerability could allow a remote user to send a speciall...
CVE-2024-29879
CVE-2024-29879 describes a Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2. The flaw arises in the business_id parameter of the URL path /sentrifugo/index.php/index/getdepartments/format/html, where insufficient input filtering/escaping enables injection of arbitrary script code. Impac...
CVE-2024-29877
Sentrifugo 3.2 is affected by a Cross-Site Scripting (XSS) vulnerability in the endpoint /sentrifugo/index.php/expenses/expensecategories/edit, via the expense_category_name parameter. The issue arises from insufficient input filtering/escaping, enabling a remote attacker to craft a URL that coul...
CVE-2024-29875
Summary: CVE-2024-29875 concerns a SQL injection in Sentrifugo 3.2 via the sort_name parameter in /sentrifugo/index.php/default/reports/exportactiveuserrpt. Several connected sources corroborate the flaw and its impact of potentially exposing all data. The available documents do not specify a fix...