CVE-2011-10013

CVE-2011-10013 affects Traq versions 2.0–2.3. The vulnerability resides in admincp/common.php where flawed authorization allows unauthenticated access to admin-only functionality via plugins.php, enabling remote code execution. Documented exploit references exist (e.g., Exploit-DB entries; Metasp...

CVE-2011-10013 Traq 2.0–2.3 admincp/common.php RCE

Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt execution after a failed access check, allowing unauthenticated users to reach admin-only functionality. This can be exploited via plugins.php...

Traq security vulnerabilities

Traq is a PHP-based project management and issue tracking system from the individual developer Jack Polgar. A security vulnerability exists in Traq versions 2.0 through 2.3, which stems from a flaw in the authorization logic of the admincp/common.php script that could lead to remote code executio...

CVE-2011-10013: Improper Control of Generation of Code

Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt execution after a failed access check, allowing unauthenticated users to reach admin-only functionality. This can be exploited via plugins.php...

PT-2025-33082 · Traq · Traq

Name of the Vulnerable Software and Affected Versions: Traq versions 2.0 through 2.3 Description: Traq versions 2.0 through 2.3 contain a remote code execution issue in the admincp/common.php script. The flawed authorization logic does not halt execution after a failed access check, allowing...

CVE-2018-20779

Traq 3.7.1 allows SQL Injection via a tickets?search= URI...

CVE-2018-20779

Traq 3.7.1 allows SQL Injection via a tickets?search= URI...

CVE-2018-20780

Traq 3.7.1 allows admin/users/new CSRF to create an admin account aka groupid=1...

CVE-2018-20780

Traq 3.7.1 allows admin/users/new CSRF to create an admin account aka groupid=1...

Sql injection

Traq 3.7.1 allows SQL Injection via a tickets?search= URI...

Cross site request forgery (csrf)

Traq 3.7.1 allows admin/users/new CSRF to create an admin account aka groupid=1...

CVE-2018-20780

The CVE-2018-20780 entry concerns Traq 3.7.1, where a cross-site request forgery allows an attacker to trigger creation of an admin account (group_id=1). The vulnerability is CSRF in the web application, enabling unauthorized admin account creation without requiring user interaction beyond a craf...

CVE-2018-20779

The connected sources confirm a concrete vulnerability in Traq 3.7.1: an SQL Injection via the URI parameter tickets?search=, caused by insufficient input validation. Affected component is the Traq web application (PHP-based project management/issue tracker) and the flaw enables manipulation of S...

CVE-2018-20780

Traq 3.7.1 allows admin/users/new CSRF to create an admin account aka groupid=1...

CVE-2018-20779

Traq 3.7.1 allows SQL Injection via a tickets?search= URI...

PT-2019-10224

Name of the Vulnerable Software and Affected Versions: Traq version 3.7.1 Description: The issue allows creation of an admin account through a CSRF attack, specifically by setting group id to 1, which designates an admin role. This can be exploited by tricking an administrator into performing an...

Traq Cross-Site Request Forgery Vulnerability

Traq is a PHP-based project management and issue tracking system. Traq suffers from a cross-site request forgery vulnerability that arises from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could use this vulnerability to send...

PT-2019-10222

Name of the Vulnerable Software and Affected Versions: Traq version 3.7.1 Description: The issue allows for SQL injection via a tickets?search= URI. Recommendations: For version 3.7.1, update to a newer version that contains a fix for this issue...

CVE-2018-20780: Cross-Site Request Forgery (CSRF)

Traq 3.7.1 allows admin/users/new CSRF to create an admin account aka groupid=1...

Traq SQL Injection Vulnerability

Traq is a PHP-based project management and issue tracking system. Traq suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit this vulnerability to execute illegal SQL commands...