CVE-2021-28890

J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the 1 compId parameter to fast/sys/user/list, 2 deptId parameter to fast/sys/role/list, or 3 roleId parameter to fast/sys/role/authUser/list, related to the use of $ to join SQL statements...

CVE-2021-28890

J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the 1 compId parameter to fast/sys/user/list, 2 deptId parameter to fast/sys/role/list, or 3 roleId parameter to fast/sys/role/authUser/list, related to the use of $ to join SQL statements...

CVE-2021-28890: Improper Neutralization of Special Elements used in an SQL Command

J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the 1 compId parameter to fast/sys/user/list, 2 deptId parameter to fast/sys/role/list, or 3 roleId parameter to fast/sys/role/authUser/list, related to the use of $ to join SQL statements...

PT-2021-17976

Name of the Vulnerable Software and Affected Versions: J2eeFAST version 2.2.1 Description: The issue allows remote attackers to perform SQL injection attacks. This is possible via the compId parameter to "fast/sys/user/list", the deptId parameter to "fast/sys/role/list", or the roleId parameter t...

CVE-2019-19202

In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request...

PT-2019-15781

Name of the Vulnerable Software and Affected Versions Vtiger versions prior to 7.2.0 Description The issue concerns the My Preferences saving functionality, which allows a user without administrative privileges to change their own role. This can be achieved by adding roleid=H2 to a POST request...

CVE-2019-19202: Incorrect Default Permissions

In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request...