Cross site scripting

SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field...

Session fixation

SOPlanning 1.45 allows XSS via the Name or Comment to status.php...

CVE-2020-9338

CVE-2020-9338 affects SoPlanning 1.45, where an XSS flaw exists in the "+Your SoPlanning url+" field. Multiple connected sources confirm a cross-site scripting vulnerability in SoPlanning 1.45, enabling script execution when the vulnerable URL field is manipulated. The Attackerkb entry notes this...

CVE-2020-9338

SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field...

CVE-2020-9339

SOPlanning 1.45 allows XSS via the Name or Comment to status.php...

CVE-2020-9339

CVE-2020-9339 affects SOPlanning 1.45. A cross-site scripting (XSS) vulnerability exists in status.php via the Name or Comment fields, allowing injected JavaScript code to be executed. Reports from multiple sources (CNVD, Red Hat, CVE list, CNVD) consistently describe XSS via Name/Comment in stat...

CVE-2020-9339

SOPlanning 1.45 allows XSS via the Name or Comment to status.php. Recent assessments: horshark at March 09, 2020 8:38pm UTC reported: Recap Javascript execution. Where On the ip/www/status.php page, you can execute Javascript in the name and comment fields. Assessed Attacker Value: 2 Assessed...

CVE-2020-9338

SOPlanning 1.45 allows XSS via the “Your SoPlanning url” field. Recent assessments: horshark at March 09, 2020 8:34pm UTC reported: Not a lot of information provided for this CVE. However, this is a javascript code execution in Your SoPlanning Url field which you can find in Global Settings leadi...

SOPlanning Cross-Site Request Forgery Vulnerability

SOPlanning is an online planning tool for efficiently organizing projects and tasks. SOPlanning 1.45 suffers from a cross-site request forgery vulnerability. An attacker can exploit this vulnerability to create arbitrary users via process/xajaxserver.php...

SOPlanning SQL Injection Vulnerability (CNVD-2020-10632)

SOPlanning is an online planning tool for efficiently organizing projects and tasks. An SQL injection vulnerability exists in the OrderBy clause in SOPlanning 1.45. An attacker can exploit this vulnerability to obtain information about a user's table via the projets.php?order=nomcreateur&by=...

SOPlanning SQL Injection Vulnerability (CNVD-2020-10631)

SOPlanning is an online planning tool for efficiently organizing projects and tasks. SOPlanning 1.45 suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to execute commands via the users parameter of exportical.php...

CVE-2020-9268

SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nomcreateur&by= substring...

CVE-2020-9269

SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by exportical.php...

CVE-2020-9269

SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by exportical.php...

CVE-2020-9268

SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nomcreateur&by= substring...

CVE-2020-9266

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajaxserver.php...

CVE-2020-9266

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajaxserver.php...

CVE-2020-9267

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajaxserver.php...

Sql injection

SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nomcreateur&by= substring...

Cross site request forgery (csrf)

SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajaxserver.php...