CVE-2014-2231

Cross-site scripting XSS vulnerability in the API in synetics i-doit pro before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via a property title...

CVE-2019-1010248

Synetics GmbH I-doit 1.12 and earlier is affected by: SQL Injection. The impact is: Unauthenticated mysql database access. The component is: Web login form. The attack vector is: An attacker can exploit the vulnerability by sending a malicious HTTP POST request. The fixed version is: 1.12.1...

CVE-2019-6965

An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter...

CVE-2018-20159

i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file...

CVE-2025-31750: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in doit Breaking News WP breaking-news-wp allows Stored XSS.This issue affects Breaking News WP: from n/a through = 1.3...

i-doit SQL注入漏洞

i-doit is a configuration management database software from i-doit Inc. An SQL injection vulnerability exists in i-doit that originates from an information disclosure vulnerability contained in the ID parameter in isysapimodelcmdbobjectsbyrelation.class.php...

CVE-2023-46003

I-doit pro 25 and below is vulnerable to Cross Site Scripting XSS via index.php...

Cross site scripting

I-doit pro 25 and below is vulnerable to Cross Site Scripting XSS via index.php...

CVE-2023-46003

CVE-2023-46003 affects i-doit pro 25 and below, with a Cross-Site Scripting (XSS) vulnerability exploitable via the index.php endpoint. Available sources consistently state the issue but do not provide exploit details. Potential remediation notes from a PT Security advisory suggest deprioritizing...

CVE-2023-46003

I-doit pro 25 and below is vulnerable to Cross Site Scripting XSS via index.php...

I-doit pro Cross-Site Scripting Vulnerability

i-doit is a configuration management database software from i-doit Inc. A security vulnerability exists in I-doit pro 25 and prior versions that stems from vulnerability to cross-site scripting XSS attacks via index.php...

CVE-2023-46003

I-doit pro 25 and below is vulnerable to Cross Site Scripting XSS via index.php...

CVE-2023-46003: Improper Neutralization of Input During Web Page Generation

I-doit pro 25 and below is vulnerable to Cross Site Scripting XSS via index.php...

CVE-2023-37756

I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack...

Code injection

I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack...

CVE-2023-37755

i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator...

CVE-2023-37755

i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator...

CVE-2023-37739

i-doit Pro v25 and below was discovered to be vulnerable to path traversal...

CVE-2023-37739

i-doit Pro v25 and below was discovered to be vulnerable to path traversal...

CVE-2023-37755

i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator...