CVE-2017-17990

Biometric Shift Employee Management System has CSRF via index.php in an editholiday action...

Design/Logic Flaw

Biometric Shift Employee Management System has XSS via the index.php holidayname parameter in an editholiday action...

Server side request forgery (ssrf)

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

Server side request forgery (ssrf)

Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competencycriteria request...

Cross site request forgery (csrf)

Biometric Shift Employee Management System has XSS via the expensename parameter in an index.php?user=expenses request...

Design/Logic Flaw

Biometric Shift Employee Management System has CSRF via index.php in an editholiday action...

CVE-2017-17994

Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competencycriteria request...

CVE-2017-17994

Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competencycriteria request...

CVE-2017-17991

Biometric Shift Employee Management System has XSS via the expensename parameter in an index.php?user=expenses request...

CVE-2017-17993

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...

CVE-2017-17992

Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php formfilename parameter in a downloadform action...

CVE-2017-17989

Biometric Shift Employee Management System has XSS via the index.php holidayname parameter in an editholiday action...

CVE-2017-17989

Biometric Shift Employee Management System has XSS via the index.php holidayname parameter in an editholiday action...

CVE-2017-17995

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

CVE-2017-17995

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

CVE-2017-17992

Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php formfilename parameter in a downloadform action...

CVE-2017-17989

The vulnerability described for CVE-2017-17989 affects the Biometric Shift Employee Management System. The issue is a Cross-Site Scripting (XSS) flaw that can be triggered via the index.php holiday_name parameter in the edit_holiday action. According to the available data, this is the scope, with...

CVE-2017-17995

Biometric Shift Employee Management System is affected by a stored/reflected XSS via the Last_Name parameter in the index.php?user=ajax request. The issue, reported across multiple sources (NVD/CNVD/CVELIST, etc.), is caused by improper sanitization of user-supplied input leading to script inject...

CVE-2017-17993

Biometric Shift Employee Management System is affected by a cross-site scripting (XSS) vulnerability exposed via the amount parameter in the index.php?user=addition_deduction request. NVD records show XSS with CVSS v2 base score 3.5 (LOW) and a CVSS v3 base score of 5.4 (MEDIUM); attack vector is...

CVE-2017-17990

Biometric Shift Employee Management System is affected by a CSRF vulnerability in the edit_holiday action controlled by index.php. The issue originates fromCross-Site Request Forgery via the edit_holiday operation, enabling unauthorized requests to potentially change holiday data. The CVE entry c...