PT-2026-35443

ProjeQtor versions 7.0 through 12.4.3 contain a missing authorization vulnerability in the objectDetail.php endpoint that allows authenticated users with guest-level privileges to retrieve sensitive data belonging to other users including password hashes and API keys. Attackers can bypass access...

CVE-2026-41464: Missing Authorization

ProjeQtor versions 7.0 through 12.4.3 contain a missing authorization vulnerability in the objectDetail.php endpoint that allows authenticated users with guest-level privileges to retrieve sensitive data belonging to other users including password hashes and API keys. Attackers can bypass access...

Project'Or RIA 3.4.0 (objectDetail.php, objectId param) - SQL Injection

No description provided by source...

CVE-2013-6163

Multiple cross-site scripting XSS vulnerabilities in ProjeQtOr formerly Project'Or RIA before 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 type parameter to view/parameter.php, 2 p1value parameter to view/main.php, or 3 objectClass parameter to view/objectDetail.p...

PT-2013-5953

Name of the Vulnerable Software and Affected Versions Project'Or RIA version 3.4.0 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the objectId parameter in the view/objectDetail.php file. Recommendations For Project'Or...

CVE-2013-6164: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in view/objectDetail.php in Project'Or RIA 3.4.0 allows remote attackers to execute arbitrary SQL commands via the objectId parameter...

PT-2013-5952

Name of the Vulnerable Software and Affected Versions ProjeQtOr versions prior to 4.0.0 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the type parameter to "view/parameter.php", the p1value parameter to "view/main.php", or the...

CVE-2013-6163: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ProjeQtOr formerly Project'Or RIA before 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 type parameter to view/parameter.php, 2 p1value parameter to view/main.php, or 3 objectClass parameter to view/objectDetail.p...