CVE-2019-16417

HRworks FLOW 3.36.9 allows XSS via the purpose of a travel-expense report...

CVE-2019-16417

HRworks FLOW 3.36.9 allows XSS via the purpose of a travel-expense report...

CVE-2019-16416

HRworks 3.36.9 allows XSS via the purpose of a travel-expense report...

CVE-2019-16416

HRworks 3.36.9 allows XSS via the purpose of a travel-expense report...

Design/Logic Flaw

HRworks 3.36.9 allows XSS via the purpose of a travel-expense report...

Design/Logic Flaw

HRworks FLOW 3.36.9 allows XSS via the purpose of a travel-expense report...

CVE-2019-16417

CVE-2019-16417 affects HRworks FLOW 3.36.9. The vulnerability is described as XSS via the purpose of a travel-expense report. The connected documents confirm the affected product/version and the nature of the issue, but do not provide a root-cause analysis, specific vulnerable parameter/file, or ...

CVE-2019-16417

HRworks FLOW 3.36.9 allows XSS via the purpose of a travel-expense report...

CVE-2019-16416

HRworks 3.36.9 contains an XSS vulnerability exploitable via the purpose field of a travel-expense report. The issue is documented across multiple connected sources (e.g., Red Hat CVE entry, NVD) with the same description. The provided documents do not specify a patch/version fixed or exploit det...

CVE-2019-16416

HRworks 3.36.9 allows XSS via the purpose of a travel-expense report...

CVE-2019-16417: Improper Neutralization of Input During Web Page Generation

HRworks FLOW 3.36.9 allows XSS via the purpose of a travel-expense report...

CVE-2019-16416: Improper Neutralization of Input During Web Page Generation

HRworks 3.36.9 allows XSS via the purpose of a travel-expense report...

Daily Expense Manager 1.0 - Cross-Site Request Forgery (Delete Income) Vulnerability

Exploit for php platform in category web applications Exploit Title: Daily Expense Manager - CSRF Delete Income Exploit Author: Mr Winst0n Author E-mail: email protected Vendor Homepage: https://sourceforge.net/projects/daily-expense-manager/ Tested Version: 1.0 Tested on: Parrot OS PoC: 0day.tod...

Daily Expense Manager 1.0 - Cross-Site Request Forgery (Delete Income)

Exploit Title: Daily Expense Manager - CSRF Delete Income Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: August 8, 2019 Vendor Homepage: https://sourceforge.net/projects/daily-expense-manager/ Tested Version: 1.0 Tested on: Parrot OS PoC:...

Daily Expense Manager 1.0 - Cross-Site Request Forgery (Delete Income)

Daily Expense Manager 1.0 - Cross-Site Request Forgery Delete Income Exploit Title: Daily Expense Manager - CSRF Delete Income Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: August 8, 2019 Vendor Homepage: https://sourceforge.net/projects/daily-expense-manager...

Daily Expense Manager 1.0 Cross Site Request Forgery

Exploit Title: Daily Expense Manager - CSRF Delete Income Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: August 8, 2019 Vendor Homepage: https://sourceforge.net/projects/daily-expense-manager/ Tested Version: 1.0 Tested on: Parrot OS PoC:...

SQL Injection

github.com/Dolibarr/dolibarr is vulnerable to SQL injection. A remote attacker is able to inject and execute arbitrary SQL queries in the application via the qty and valueunit parameters in the expense reports module due to a lack of input validation and sanitization...

CVE-2018-16809

An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and valueunit...

Sql injection

An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and valueunit...

CVE-2018-16808

An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note...