338 matches found
CVE-2026-70561
TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...
CVE-2026-70561 TestLink 1.9.20 and prior Authenticated IDOR via attachmentdownload.php
TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...
CVE-2026-70561 TestLink 1.9.20 and prior Authenticated IDOR via attachmentdownload.php
TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...
EUVD-2026-54574
TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...
CVE-2026-70561
TestLink 1.9.20 and earlier is affected by an insecure direct object reference in the attachmentdownload.php endpoint. An authenticated user, including low-privilege guests, can read arbitrary attachments by supplying any integer attachment ID, bypassing per-project access checks. Attackers can e...
TestLink 1.9.13 SQL Injection
A SQL injection vulnerability exists in TestLink version 1.9.13. The vulnerability allows remote attackers to execute arbitrary SQL commands and potentially compromise the database. This issue is older research added to the archive...
TestLink 1.9.13 Cross Site Scripting
A cross site scripting vulnerability exists in TestLink version 1.9.13. The vulnerability allows remote attackers to inject arbitrary web script or HTML. This issue is older research added to the archive...
CVE-2021-47760
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate...
CVE-2021-47760
...
EUVD-2026-2781
TestLink versions 1.16 through 1.19 contain an unauthenticated file download vulnerability in the attachmentdownload.php endpoint. Attackers can download arbitrary files by iterating file IDs through the 'id' parameter with 'skipCheck=1' to bypass access controls...
CVE-2021-47760
CVE-2021-47760 entry is rejected/not used and does not represent an active vulnerability.
PT-2026-3036
Name of the Vulnerable Software and Affected Versions TestLink versions 1.16 through 1.19 Description The software contains an unauthenticated file download issue. An attacker can download arbitrary files by manipulating the id parameter in the ''attachmentdownload.php'' endpoint, utilizing...
CVE-2023-50110
TestLink through 1.9.20 allows type juggling for authentication bypass because === is not used...
CVE-2018-1000113
A cross-site scripting vulnerability exists in Jenkins TestLink Plugin 2.12 and earlier in TestLinkBuildAction/summary.jelly and others that allow an attacker who can control e.g. TestLink report names to have Jenkins serve arbitrary HTML and JavaScript...
CVE-2022-35195
TestLink 1.9.20 Raijin was discovered to contain a broken access control vulnerability at /lib/attachments/attachmentdownload.php...
CVE-2022-35196
TestLink v1.9.20 was discovered to contain a Cross-Site Request Forgery CSRF via /lib/plan/planView.php...
CVE-2022-35194
TestLink v1.9.20 was discovered to contain a stored cross-site scripting XSS vulnerability via /lib/inventory/inventoryView.php...
CVE-2019-20107
Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the 1 tprojectid parameter to keywordsView.php; the 2 reqspecid parameter to reqSpecCompareRevisions.php; the 3 requirementid parameter to...