CVE-2026-41464: Missing Authorization

ProjeQtor versions 7.0 through 12.4.3 contain a missing authorization vulnerability in the objectDetail.php endpoint that allows authenticated users with guest-level privileges to retrieve sensitive data belonging to other users including password hashes and API keys. Attackers can bypass access...

PT-2026-35443

ProjeQtor versions 7.0 through 12.4.3 contain a missing authorization vulnerability in the objectDetail.php endpoint that allows authenticated users with guest-level privileges to retrieve sensitive data belonging to other users including password hashes and API keys. Attackers can bypass access...

Project'Or RIA 3.4.0 (objectDetail.php, objectId param) - SQL Injection

No description provided by source...

CVE-2013-6163

Multiple cross-site scripting XSS vulnerabilities in ProjeQtOr formerly Project'Or RIA before 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 type parameter to view/parameter.php, 2 p1value parameter to view/main.php, or 3 objectClass parameter to view/objectDetail.p...

CVE-2013-6163: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ProjeQtOr formerly Project'Or RIA before 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 type parameter to view/parameter.php, 2 p1value parameter to view/main.php, or 3 objectClass parameter to view/objectDetail.p...

CVE-2013-6164: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in view/objectDetail.php in Project'Or RIA 3.4.0 allows remote attackers to execute arbitrary SQL commands via the objectId parameter...