CVE-2017-17993

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...

CVE-2017-17995

Biometric Shift Employee Management System is affected by a stored/reflected XSS via the Last_Name parameter in the index.php?user=ajax request. The issue, reported across multiple sources (NVD/CNVD/CVELIST, etc.), is caused by improper sanitization of user-supplied input leading to script inject...

CVE-2017-17989

Biometric Shift Employee Management System has XSS via the index.php holidayname parameter in an editholiday action...

CVE-2017-17991

Biometric Shift Employee Management System has XSS via the expensename parameter in an index.php?user=expenses request...

CVE-2017-17990: Cross-Site Request Forgery (CSRF)

Biometric Shift Employee Management System has CSRF via index.php in an editholiday action...

PT-2017-15147

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper validation of user input in the...

PT-2017-15151

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper input validation in the Last Name...

CVE-2017-17991: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the expensename parameter in an index.php?user=expenses request...

PT-2017-15150

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved through the criteria parameter in a specific request...

CVE-2017-17994: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competencycriteria request...

CVE-2017-17992: Improper Limitation of a Pathname to a Restricted Directory

Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php formfilename parameter in a downloadform action...

PT-2017-15146

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue is related to a CSRF flaw in the Biometric Shift Employee Management System. Specifically, it affects the edit holiday action in index.php...

PT-2017-15148

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue allows for Arbitrary File Download via directory traversal sequences. This is achieved by manipulating the form file name parameter in a download...

CVE-2017-17989: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the index.php holidayname parameter in an editholiday action...

PT-2017-15145

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue is related to a security problem where an attacker can inject malicious code. This is possible due to the lack of proper input validation in the...

CVE-2017-17993: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...

PT-2017-15149

Name of the Vulnerable Software and Affected Versions Biometric Shift Employee Management System affected versions not specified Description The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper validation of user input in the...

CVE-2017-17995: Improper Neutralization of Input During Web Page Generation

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

CVE-2017-17900: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the socid parameter...

CVE-2017-17911: Improper Neutralization of Input During Web Page Generation

packages/core/contact.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?p=core/contact request, aka Open Bug Bounty ID OBB-278503...