CVE-2024-46655

A reflected cross-site scripting XSS vulnerability in Ellevo 6.2.0.38160 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload or URL...

CVE-2024-42760

SQL Injection vulnerability in Ellevo v.6.2.0.38160 allows a remote attacker to obtain sensitive information via the /api/mob/instrucao/conta/destinatarios component...

Ellevo Cross-Site Scripting Vulnerability

Ellevo is an enterprise process-oriented software from Ellevo. A cross-site scripting vulnerability exists in Ellevo version 6.2.0.38160, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be exploited by an attacker to execute arbitrary Web...

CVE-2024-46655

A reflected cross-site scripting XSS vulnerability in Ellevo 6.2.0.38160 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload or URL...

PT-2024-30130 · Ellevo · Ellevo

Name of the Vulnerable Software and Affected Versions: Ellevo version 6.2.0.38160 Description: A SQL Injection vulnerability exists in Ellevo version 6.2.0.38160. This allows a remote attacker to obtain sensitive information via the /api/mob/instrucao/conta/destinatarios component. Recommendation...

CVE-2024-42759

An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint...