75 matches found
CVE-2011-10013
CVE-2011-10013 affects Traq versions 2.0–2.3. The vulnerability resides in admincp/common.php where flawed authorization allows unauthenticated access to admin-only functionality via plugins.php, enabling remote code execution. Documented exploit references exist (e.g., Exploit-DB entries; Metasp...
CVE-2011-10013 Traq 2.0–2.3 admincp/common.php RCE
Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt execution after a failed access check, allowing unauthenticated users to reach admin-only functionality. This can be exploited via plugins.php...
Traq security vulnerabilities
Traq is a PHP-based project management and issue tracking system from the individual developer Jack Polgar. A security vulnerability exists in Traq versions 2.0 through 2.3, which stems from a flaw in the authorization logic of the admincp/common.php script that could lead to remote code executio...
CVE-2011-10013: Improper Control of Generation of Code
Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt execution after a failed access check, allowing unauthenticated users to reach admin-only functionality. This can be exploited via plugins.php...
PT-2025-33082 · Traq · Traq
Name of the Vulnerable Software and Affected Versions: Traq versions 2.0 through 2.3 Description: Traq versions 2.0 through 2.3 contain a remote code execution issue in the admincp/common.php script. The flawed authorization logic does not halt execution after a failed access check, allowing...
CVE-2018-20779
Traq 3.7.1 allows SQL Injection via a tickets?search= URI...
CVE-2018-20779
Traq 3.7.1 allows SQL Injection via a tickets?search= URI...
CVE-2018-20780
Traq 3.7.1 allows admin/users/new CSRF to create an admin account aka groupid=1...
CVE-2018-20780
Traq 3.7.1 allows admin/users/new CSRF to create an admin account aka groupid=1...
Sql injection
Traq 3.7.1 allows SQL Injection via a tickets?search= URI...
Cross site request forgery (csrf)
Traq 3.7.1 allows admin/users/new CSRF to create an admin account aka groupid=1...
CVE-2018-20780
The CVE-2018-20780 entry concerns Traq 3.7.1, where a cross-site request forgery allows an attacker to trigger creation of an admin account (group_id=1). The vulnerability is CSRF in the web application, enabling unauthorized admin account creation without requiring user interaction beyond a craf...
CVE-2018-20779
The connected sources confirm a concrete vulnerability in Traq 3.7.1: an SQL Injection via the URI parameter tickets?search=, caused by insufficient input validation. Affected component is the Traq web application (PHP-based project management/issue tracker) and the flaw enables manipulation of S...
CVE-2018-20780
Traq 3.7.1 allows admin/users/new CSRF to create an admin account aka groupid=1...
CVE-2018-20779
Traq 3.7.1 allows SQL Injection via a tickets?search= URI...
PT-2019-10224
Name of the Vulnerable Software and Affected Versions: Traq version 3.7.1 Description: The issue allows creation of an admin account through a CSRF attack, specifically by setting group id to 1, which designates an admin role. This can be exploited by tricking an administrator into performing an...
Traq Cross-Site Request Forgery Vulnerability
Traq is a PHP-based project management and issue tracking system. Traq suffers from a cross-site request forgery vulnerability that arises from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could use this vulnerability to send...
CVE-2018-20780: Cross-Site Request Forgery (CSRF)
Traq 3.7.1 allows admin/users/new CSRF to create an admin account aka groupid=1...
Traq SQL Injection Vulnerability
Traq is a PHP-based project management and issue tracking system. Traq suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit this vulnerability to execute illegal SQL commands...