CVE-2021-40875

CVE-2021-40875 concerns Gurock TestRail before 7.2.0.3014, where improper access control allows a client-side request to the "/files.md5" file. The exposure reveals a full list of application files and their paths, which can be tested to potentially disclose hardcoded credentials, API keys, or ot...

CVE-2021-44263

CVE-2021-44263 affects Gurock TestRail before 7.2.4. The root cause is improper HTML escaping, leading to a cross-site scripting (XSS) vulnerability in the web-based test case management software. Affected versions prior to 7.2.4 are susceptible; the issue enables injected HTML/JavaScript content...

CVE-2019-7535

CVE-2019-7535 affects Gurock TestRail, specifically the index.php endpoint in version 5.3.0.3603. The issue leaks potentially sensitive information when handling an invalid request, demonstrated by full path disclosure and confirmation that PHP is used as the backend technology. The available doc...

CVE-2018-20063

CVE-2018-20063 affects Gurock TestRail 5.6.0.3853. The issue is an Unrestricted Upload of File vulnerability in the image-upload form (in the description editor) that allows remote authenticated users to execute arbitrary code by uploading an image with an executable extension but a safe Content-...

CVE-2021-37788

The CVE-2021-37788 case concerns Gurock TestRail web UI version 5.3.0.3603. The root cause is insufficient input validation of iFrame data in HTTP requests, enabling an unauthenticated, remote attacker to perform a clickjacking attack and potentially affect device integrity. Connected sources (PT...

CVE-2021-36538

CVE-2021-36538 affects Gurock TestRail before 7.1.2. The vulnerability is a cross-site scripting (XSS) flaw that enables remote authenticated attackers to execute arbitrary code via the reference field in milestones or the description fields in reports. The root cause details are not fully descri...

CVE-2014-4857

Gurock TestRail prior to 3.1.3 is affected by a cross-site scripting (XSS) vulnerability due to improper sanitization of the Created By field in project activities. The flaw enables script or HTML injection in the browser context of authenticated users, with evidence from multiple sources noting ...