CVE-2018-15917

Persistent cross-site scripting XSS issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language...

Sql injection

An issue was discovered in Jorani 0.6.5. SQL Injection error-based allows a user of the application without permissions to read and modify sensitive information from the database used by the application via the startdate or enddate parameter to leaves/validate...

CVE-2018-15917

CVE-2018-15917 affects Jorani Leave Management System v0.6.5. The issue is a persistent XSS in the language parameter (session/language) that stores user input in the session, enabling an attacker to inject arbitrary script executed by other users (including admins). Evidence across sources confi...

CVE-2018-15918

An issue was discovered in Jorani 0.6.5. SQL Injection error-based allows a user of the application without permissions to read and modify sensitive information from the database used by the application via the startdate or enddate parameter to leaves/validate...

CVE-2018-15917

Persistent cross-site scripting XSS issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language...