CVE-2014-8082: Exposure of Sensitive Information to an Unauthorized Actor

lib/functions/database.class.php in TestLink before 1.9.13 allows remote attackers to obtain sensitive information via unspecified vectors, which reveals the installation path in an error message...

CVE-2009-4237: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.8.5 allow remote attackers to inject arbitrary web script or HTML via 1 the req parameter to login.php, and allow remote authenticated users to inject arbitrary web script or HTML via 2 the key parameter to...