CVE-2021-37213

The CVE-2021-37213 entry concerns Flygo, an attendance/clocking system by Larvata. Affected component: the check-in record page where an authenticated general user can exploit an insecure direct object reference (IDOR) by altering parameters (employee ID and date) to access other employees’ check...

CVE-2021-37215

The CVE-2021-37215 entry describes an Insecure Direct Object Reference (IDOR) in Flygo’s employee management page. After authenticating as a general user, an attacker can manipulate and overwrite another employee’s data by supplying that employee’s ID in an API parameter. Documents confirm this v...

CVE-2021-37212

CVE-2021-37212 describes an Insecure Direct Object Reference (IDOR) in the Flygo bulletin function. The issue allows a user who is authenticated as a general user to manipulate the bulletin ID in specific URL parameters to access and modify bulletin content. The vulnerability is documented across...

CVE-2021-37211

The CVE-2021-37211 entry concerns Flygo's bulletin/announcements feature that fails to filter special characters when adding a new announcement, enabling a stored XSS via input submitted with a general user credential. Attackers could inject JavaScript through the announcements field, leading to ...

CVE-2021-37214

CVE-2021-37214 affects Flygo's employee management page. It is an Insecure Direct Object Reference (IDOR ) vulnerability allowing an authenticated general user to alter the employee ID parameter to access/modify other employees’ data, escalate to administrator privileges, and execute arbitrary co...