EUVD-2022-37148

Malicious code in bioql PyPI...

Jorani v1.0 SQL Injection Vulnerability

Jorani is a leave management system developed by Benjamin BALET, an individual developer in France. Designed to provide small organizations with a simple workflow for leave and overtime requests. Jorani v1.0 suffers from an SQL injection vulnerability that stems from a lack of valid validation in...

CVE-2022-34132

Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php...

Sql injection

Benjamin BALET Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php...

Cross site scripting

Benjamin BALET Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

CVE-2022-34132

Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php...

CVE-2022-34132

Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php...

CVE-2022-34132

Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php...

CVE-2022-34132

CVE-2022-34132 affects Jorani v1.0, with a SQL injection vulnerability exploitable through the id parameter in application/controllers/Leaves.php. The issue is documented across multiple feeds (NVD, CNVD, OSV, RH, CNVD mirrors) as a lack of input validation enabling access to database information...

CVE-2022-34133

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

CVE-2022-34133

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

CVE-2022-34133

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

CVE-2022-34133: Improper Neutralization of Input During Web Page Generation

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

CVE-2022-34132: Improper Neutralization of Special Elements used in an SQL Command

Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php...

PT-2022-22018 · Benjamin Balet · Jorani

Name of the Vulnerable Software and Affected Versions: Benjamin BALET Jorani version 1.0 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the Comment parameter at the application/controllers/Leaves.php endpoint. Recommendations...