CVE-2013-5027

CVE-2013-5027 (Collabtive 1.0) is described in the HTB23169 advisory as an improper access control vulnerability. The root cause is insufficient access restrictions in the installation flow, allowing a remote attacker to abuse the /install.php script (action=step3) to create a new administrative ...

CVE-2021-3298

CVE-2021-3298 affects Collabtive 3.1 where an authenticated user can trigger a persistent XSS by submitting a payload in the Address field during profile editing (manageuser.php?action=edit address1). Multiple connected sources (e.g., Exploit-DB entry for the 3.1 XSS payload, Red Hat/NVD/NASL-sty...

CVE-2015-0258

Collabtive up to version 2.0/2.1 had an avatar-upload input validation flaw in manageuser.php that could enable an authenticated user to upload crafted files (.php3/.php4/.php5/.phtml) and execute arbitrary code. Public advisories (USN-4590-1, DLA-2125-1) and Debian/Nessus entries describe fixes ...

CVE-2014-3247

Collabtive 1.2 contains a Stored XSS in the Add Project (admin.php?action=addpro) path. The desc parameter value is copied into the HTML document as plain text between tags, allowing arbitrary JavaScript execution. Affected product/version: Collabtive 1.12; fixed in version 2.0. Impact: authentic...

CVE-2024-48706

Collabtive 3.1 is vulnerable to cross-site scripting (XSS) via the title parameter when using action=add (managemessage.php) or action=editform (managetask.php). Root cause is unsanitized input in the title field. Affected: Collabtive 3.1. Exploitation details are not provided beyond the affected...

CVE-2014-3246

CVE-2014-3246 affects Collabtive (1.2/1.12). A SQL injection exists in the folder parameter of the fileview_list action in manageajax.php, exploitable by authenticated users. Several connected sources document the vulnerability, including exploit notes showing the folder parameter can be manipula...

CVE-2010-5285

CVE-2010-5285 describes a Cross‑Site Request Forgery (CSRF) in Collabtive 0.6.5, affecting admin.php via the edituser action. The vulnerability allows a remote attacker to hijack administrators’ authentication and perform actions that add new administrative users. This is tied to the specific ver...

CVE-2010-5284

CVE-2010-5284 affects Collabtive 0.6.5 with multiple XSS vulnerabilities. The issues stem from unsanitized user input in three parameters: User (edit profile), y (newcal action), and pic (thumb). Impact is remote script/HTML injection in the context of the affected web app; exploit details or CVS...

CVE-2012-2670

CVE-2012-2670 affects Collabtive prior to 0.7.6. Affected component: manageuser.php/ avatar upload handling. Root cause: improper access controls allow remote authenticated users, and possibly unauthenticated attackers, to bypass restrictions and upload/execute arbitrary files by uploading an ava...

CVE-2010-4269

CVE-2010-4269 affects Collabtive 0.65 (managechat.php): a SQL Injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the chatstart[USERTOID] cookie in a pull action. OpenVAS entries confirm Collabtive "managechat.php" SQL Injection vulnerability; no product/ven...

CVE-2024-46240

CVE-2024-46240 affects Collabtive 3.1. The vulnerability is a Cross-site Scripting (XSS) flaw in admin.php, exploitable via the name parameter under action=system and the company/contact parameters under action=addcust. Root cause: XSS in these input points. The connected sources confirm Collabti...

CVE-2024-48707

CVE-2024-48707 affects Collabtive 3.1. The vulnerability is an XSS in the web UI triggered by the name parameter in two endpoints: (a) managemilestone.php when action=add or action=edit, and (b) admin.php when action=addpro. The underlying cause is unsanitized/unvalidated input in these parameter...

CVE-2020-13655

CVE-2020-13655 affects Collabtive 3.0 and later. The issue is an XSS in managefile.php where, when action equals movefile and id corresponds to a project the user can access, the file and target parameters are reflected. This is a client-side scripting vulnerability that could enable code executi...

CVE-2013-6872

CVE-2013-6872 affects Collabtive prior to 1.2. It is a SQL injection in managetimetracker.php via the id parameter in a projectpdf action, exploitable by remote authenticated users. The NVD entry lists a CVSS v2 base score of 6.5 (Medium) with network access, low attack complexity, single authent...

CVE-2024-48708

CVE-2024-48708 affects Collabtive 3.1 with a Cross-Site Scripting (XSS) vulnerability that can be triggered via the name parameter in two pages: tasklist.php (action=add/edit) and admin.php (action=adduser/edituser). The connected Nessus/Red Hat/Ubuntu/etc. entries confirm the same description an...

CVE-2019-8935

CVE-2019-8935 corresponds to a stored/reflected XSS in Collabtive 3.1. The vulnerability is triggered via the manageuser.php?action=profile id parameter, allowing injection that could affect an authenticated user. Connected sources provide multiple vendor/cve references confirming the XSS impact ...