CVE-2019-20179

SOPlanning 1.45 has SQL injection via the userlist.php "by" parameter...

Sql injection

SOPlanning 1.45 has SQL injection via the userlist.php "by" parameter...

CVE-2019-20179

SOPlanning 1.45 is vulnerable to a SQL injection via the user_list.php parameter "by". The root cause is a lack of validation of externally entered SQL in a database-driven application. Documented impact is consistent with a high-severity risk (CVSS3.1: 8.8; CVSS2.0: 6.5) affecting confidentialit...

CVE-2019-20179

SOPlanning 1.45 has SQL injection via the userlist.php "by" parameter...

PT-2020-10360

Name of the Vulnerable Software and Affected Versions SOPlanning version 1.45 Description The issue is related to SQL injection, which can be exploited via the user list.php API endpoint, specifically through the by parameter. Recommendations For SOPlanning version 1.45, avoid using the by...

CVE-2019-20179: Improper Neutralization of Special Elements used in an SQL Command

SOPlanning 1.45 has SQL injection via the userlist.php "by" parameter...

Cross site scripting

Multiple Cross-Site Scripting XSS vulnerabilities exist in Simple Online Planning SOPlanning before 1.33 via the document.cookie in nbmois and mbligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code...

CVE-2014-8674

Multiple Cross-Site Scripting XSS vulnerabilities exist in Simple Online Planning SOPlanning before 1.33 via the document.cookie in nbmois and mbligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code...

CVE-2014-8674

SOPlanning (Simple Online Planning) is affected by multiple vulnerabilities in versions prior to 1.33. The CVE entries describe cross-site scripting via document.cookie in nb_mois and mb_ligness and through a debug GET parameter to export.php, enabling arbitrary code execution under XSS condition...

PT-2020-7755

Name of the Vulnerable Software and Affected Versions SOPlanning versions prior to 1.33 Description The issue concerns multiple Cross-Site Scripting XSS vulnerabilities. These vulnerabilities allow malicious users to execute arbitrary code via the document.cookie in nb mois and mb ligness and the...

CVE-2014-8674: Improper Neutralization of Input During Web Page Generation

Multiple Cross-Site Scripting XSS vulnerabilities exist in Simple Online Planning SOPlanning before 1.33 via the document.cookie in nbmois and mbligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code...

SOPlanning Detection (HTTP)

HTTP based detection of SOPlanning. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.112034";...

SOPlanning < 1.33 Multiple Vulnerabilities

SOPlanning is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:soplanning:soplanning";...

CVE-2014-8675

Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash...

CVE-2014-8677

The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and...

Default credentials

Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash...

Code injection

The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and...

CVE-2014-8676

Directory traversal vulnerability in the filegetcontents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. dot dot in a URL path parameter...

Directory traversal

Directory traversal vulnerability in the filegetcontents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. dot dot in a URL path parameter...

CVE-2014-8677

The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and...