CVE-2022-34134

Jorani v1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /application/controllers/Users.php...

CVE-2022-34133

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

CVE-2022-34132: Improper Neutralization of Special Elements used in an SQL Command

Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php...

CVE-2022-34134: Cross-Site Request Forgery (CSRF)

Jorani v1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /application/controllers/Users.php...

CVE-2022-34133: Improper Neutralization of Input During Web Page Generation

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

CVE-2021-40612

An issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in codeigniter/application/controllers/util.php allows an attacker perform command execution without echoes...

CVE-2021-40612: Undefined Security Weakness

An issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in codeigniter/application/controllers/util.php allows an attacker perform command execution without echoes...

Cross-site scripting in application/controllers/dropbox.php in JustWriting

Cross-site scripting XSS vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter...

CVE-2021-41467

Cross-site scripting XSS vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter...

CVE-2021-41467: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter...

PT-2021-23309

Name of the Vulnerable Software and Affected Versions JustWriting versions 1.0.0 and below Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the challenge parameter in the application/controllers/dropbox.php file. Recommendations For...

CVE-2019-9960: Improper Limitation of a Pathname to a Restricted Directory

The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path...

CVE-2018-8057

A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channelname or platform parameter in a /index.php?/manage/channel/addchannel request, related to /application/controllers/manage/channel.php...

CVE-2015-4628

SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote authenticated administrators to execute arbitrary SQL commands via the sid parameter...

PT-2015-6644

Name of the Vulnerable Software and Affected Versions LimeSurvey versions prior to 2.06+ Build 150618 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the sid parameter in the application/controllers/admin/questiongroups.php...

CVE-2014-5016

Multiple cross-site scripting XSS vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via 1 the pid attribute to the getAttributejson function to application/controllers/admin/participantsaction.php in CPDB, 2 the sa parameter to...

CVE-2014-5016: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via 1 the pid attribute to the getAttributejson function to application/controllers/admin/participantsaction.php in CPDB, 2 the sa parameter to...

PT-2014-6248

Name of the Vulnerable Software and Affected Versions LimeSurvey versions 2.05 and later Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved through the pid attribute to the getAttribute json function in...

PT-2014-6249

Name of the Vulnerable Software and Affected Versions LimeSurvey versions 2.05 and later Description The issue allows remote attackers to execute arbitrary SQL commands via the sidx parameter in a JSON request to "admin/participants/sa/getParticipants json", related to a search parameter. This is...

Sql injection

SQL injection vulnerability in application/controllers/invoice.php in NeoInvoice might allow remote attackers to execute arbitrary SQL commands via vectors involving the sortcol variable in the listitems function, a different vulnerability than CVE-2012-3477...