CVE-2020-9338

SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field...

CVE-2020-9339

SOPlanning 1.45 allows XSS via the Name or Comment to status.php...

CVE-2020-9338

SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field...

CVE-2020-9339

SOPlanning 1.45 allows XSS via the Name or Comment to status.php...

Session fixation

SOPlanning 1.45 allows XSS via the Name or Comment to status.php...

CVE-2020-9338

SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field...

Cross site scripting

SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field...

CVE-2020-9338

SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field...

CVE-2020-9338

CVE-2020-9338 affects SoPlanning 1.45, where an XSS flaw exists in the "+Your SoPlanning url+" field. Multiple connected sources confirm a cross-site scripting vulnerability in SoPlanning 1.45, enabling script execution when the vulnerable URL field is manipulated. The Attackerkb entry notes this...

CVE-2020-9339

CVE-2020-9339 affects SOPlanning 1.45. A cross-site scripting (XSS) vulnerability exists in status.php via the Name or Comment fields, allowing injected JavaScript code to be executed. Reports from multiple sources (CNVD, Red Hat, CVE list, CNVD) consistently describe XSS via Name/Comment in stat...

CVE-2020-9339

SOPlanning 1.45 allows XSS via the Name or Comment to status.php...

SOPlanning SQL Injection Vulnerability (CNVD-2020-10631)

SOPlanning is an online planning tool for efficiently organizing projects and tasks. SOPlanning 1.45 suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to execute commands via the users parameter of exportical.php...

SOPlanning Cross-Site Request Forgery Vulnerability

SOPlanning is an online planning tool for efficiently organizing projects and tasks. SOPlanning 1.45 suffers from a cross-site request forgery vulnerability. An attacker can exploit this vulnerability to create arbitrary users via process/xajaxserver.php...

SOPlanning SQL Injection Vulnerability (CNVD-2020-10632)

SOPlanning is an online planning tool for efficiently organizing projects and tasks. An SQL injection vulnerability exists in the OrderBy clause in SOPlanning 1.45. An attacker can exploit this vulnerability to obtain information about a user's table via the projets.php?order=nomcreateur&by=...

CVE-2020-9269

SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by exportical.php...

CVE-2020-9268

SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nomcreateur&by= substring...

CVE-2020-9268

SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nomcreateur&by= substring...

CVE-2020-9269

SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by exportical.php...

CVE-2020-9266

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajaxserver.php...

CVE-2020-9267

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajaxserver.php...