CVE-2024-25515

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sysfilestorageid parameter at /WorkFlow/wfworkfinishfiledown.aspx...

CVE-2024-25517

RuvarOA v6.01 and v12.01 expose a SQL injection vulnerability in the tbTable parameter of /WebUtility/MF.aspx. Root cause: lack of input validation for externally entered SQL statements. Impact per sources: potential unauthorized data access/alteration with high severity. Exploitation details are...

CVE-2024-25518

RuvarOA v6.01 and v12.01 expose a SQL injection via the template_id parameter on /WorkFlow/wf_get_fields_approve.aspx. Root cause: lack of validation for template_id input, enabling arbitrary SQL execution and potential data disclosure as described across CVE-2024-25518 and related feeds. Documen...

CVE-2024-25533

CVE-2024-25533 affects RuvarOA v6.01–v12.01. Error messages disclose the server path at /WorkFlow/OfficeFileUpdate.aspx and, per multiple sources, allow writing files or executing arbitrary SQL via crafted statements due to insufficient input validation. Affected versions: 6.01–12.01. Root cause ...

CVE-2024-25525

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownload.aspx...

CVE-2024-25508

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletintemplateshow.aspx...

CVE-2024-25508

RuvarOA is affected in v6.01–v12.01 by a SQL injection via the id parameter in the bulletin_template_show.aspx endpoint. Root cause: lack of input validation on id leading to arbitrary SQL execution that can read/modify data. References from multiple sources confirm the vulnerable versions and th...

CVE-2024-25512

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the attachid parameter at /Bulletin/AttachDownLoad.aspx...

CVE-2024-25507

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the emailattachid parameter at /LHMail/AttachDown.aspx...

CVE-2024-25508

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletintemplateshow.aspx...

CVE-2024-25509

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sysfilestorageid parameter at /WorkFlow/wffiledownload.aspx...

CVE-2024-25513

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the fileid parameter at /CorporateCulture/kaizendownload.aspx...