CVE-2019-7400

Rukovoditel before 2.4.1 allows XSS.

CVE-2019-7541

Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring.

CVE-2024-34468

Rukovoditel before 3.5.3 allows XSS via user_photo to My Page.

CVE-2020-21732

Rukovoditel Project Management app 2.6 is affected by: Cross Site Scripting (XSS). An attacker can add JavaScript code to the filename.

CVE-2020-11822

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the application structure --> user access groups page. Thus, an attacker can inject malicious script to steal all users' valuable data.