7 matches found
CVE-2026-52607
A directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the targetformat parameter in conjunction with the executemode=EXECUTE parameter of the run.php endpoint...
CVE-2026-52606
A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the executemode=PREPARE parameter of run.php...
CVE-2026-52609
A reflected XSS flaw in reportico-web ≤ 8.1.0 lets attackers inject JavaScript via the reportico_criteria parameter paired with execute_mode=CRITERIA in run.php. CVSS 6.1 (Medium), network-exploitable, requires user interaction. No patch version or exploit code is provided in the documents; CISA ...
CVE-2026-52607
reportico-web versions up to and including 8.1.0 are affected by a directory traversal vulnerability in the run.php endpoint. By supplying a crafted filename in the target_format parameter combined with execute_mode=EXECUTE, a remote unauthenticated attacker can expose or execute arbitrary PHP fi...
CVE-2026-52606
CVE-2026-52606 is a reflected cross-site scripting (XSS) vulnerability in reportico-web versions up to and including 8.1.0 . The flaw is triggered by including a malicious payload in the loadTemplate parameter in conjunction with the execute_mode=PREPARE parameter of run.php , allowing a remote a...
Reportico affected by Incorrect Access Control
An issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via executemode parameter of the URL...