CVE-2024-25507

RuvarOA v6.01 and v12.01 are affected by a SQL injection via the email_attach_id parameter in /LHMail/AttachDown.aspx. Root cause: lack of validation of external SQL input in that endpoint. CVSS v3.1 base score 9.4 (CRITICAL); impact: Confidentiality and Integrity high, Availability low. No remed...

CVE-2024-25533

CVE-2024-25533 affects RuvarOA v6.01–v12.01. Error messages disclose the server path at /WorkFlow/OfficeFileUpdate.aspx and, per multiple sources, allow writing files or executing arbitrary SQL via crafted statements due to insufficient input validation. Affected versions: 6.01–12.01. Root cause ...

CVE-2024-25514

RuvarOA versions 6.01 and 12.01 are affected by a SQL injection vulnerability in the template_id parameter of /SysManage/wf_template_child_field_list.aspx. The issue originates from lack of input validation in the affected endpoint. Documented impact includes potential data exposure or manipulati...

CVE-2024-25523

RuvarOA v6.01 and v12.01 are affected by an SQL injection vulnerability in the /filemanage/file_memo.aspx endpoint, exploitable via the file_id parameter. Root cause: lack of input validation against external SQL input. Impact (per sources): potential unauthorized data theft and data integrity/av...

CVE-2024-25515

CVE-2024-25515 affects RuvarOA v6.01 and v12.01, with a SQL injection vulnerability exploitable via the sys_file_storage_id parameter in the /WorkFlow/wf_work_finish_file_down.aspx endpoint. Connected sources (Red Hat, CNVD, CNVD CNVD-2024-33626, NVD, etc.) confirm the vulnerability description a...

CVE-2024-25529

RuvarOA v6.01 and v12.01 are affected by a SQL injection in the id parameter of /WorkFlow/wf_office_file_history_show.aspx. Root cause is lack of input validation on the id parameter, enabling unauthorized SQL execution. Impact per CVSS: high confidentiality, integrity, and availability impact (s...

CVE-2024-25521

CVE-2024-25521 affects RuvarOA v6.01 and v12.01. A SQL injection vulnerability exists in the get_company.aspx endpoint via the txt_keyword parameter, caused by lack of input validation against external SQL statements. Reported impact includes the ability to perform illegal SQL commands to access ...

CVE-2024-25527

RuvarOA v6.01 and v12.01 contain a SQL injection vulnerability in the id parameter of /PersonalAffair/worklog_template_show.aspx due to lack of validation of externally entered SQL statements. This could allow an attacker to execute arbitrary SQL commands to access or exfiltrate data, as describe...

CVE-2024-25524

CVE-2024-25524 affects RuvarOA v6.01 and v12.01, where a SQL injection is exploitable via the sys_file_storage_id parameter in /WorkPlan/WorkPlanAttachDownLoad.aspx. The root cause is lack of input validation in that parameter, enabling arbitrary SQL execution and potential data disclosure/altera...

CVE-2024-25512

CVE-2024-25512 affects RuvarOA v6.01 and v12.01. The vulnerability is a SQL injection in the /Bulletin/AttachDownLoad.aspx endpoint via the attach_id parameter, arising from input validation gaps. Impact described across sources includes the ability to execute arbitrary SQL and exfiltrate sensiti...

CVE-2024-25526

CVE-2024-25526 affects RuvarOA v6.01 and v12.01. A SQL injection vulnerability exists in the project_id parameter of /ProjectManage/pm_gatt_inc.aspx, caused by insufficient input validation. Impact is described as high (CVE metrics: CVSS 3.1: HIGH, 8.1/CRITICAL under I/H/A). Some sources indicate...

CVE-2024-25525

CVE-2024-25525 affects RuvarOA versions 6.01 and 12.01. A SQL injection vulnerability arises from lack of validation of the filename parameter in the /WorkFlow/OfficeFileDownload.aspx endpoint. Impact is described as high (CVE metrics show CRITICAL with Confidentiality, Integrity, and Availabilit...

CVE-2024-25519

CVE-2024-25519 affects RuvarOA v6.01 and v12.01, with a SQL injection vulnerability via the idlist parameter in /WorkFlow/wf_work_print.aspx. The root cause is lack of validation of externally entered SQL statements against the idlist parameter, enabling potentially dangerous SQL execution and da...

CVE-2024-25520

CVE-2024-25520 affects RuvarOA v6.01 and v12.01. A SQL injection exists via the id parameter to /SysManage/sys_blogtemplate_new.aspx, stemming from a lack of input validation. Attackers could execute arbitrary SQL commands, with potential exposure or manipulation of database data (per CNVD/Red Ha...

CVE-2024-25522

CVE-2024-25522 affects RuvarOA v6.01 and v12.01, where the office_missive_id parameter in /WorkFlow/wf_work_form_save.aspx is vulnerable to SQL injection. Multiple connected sources describe an inability to validate external SQL input, enabling attackers to execute arbitrary SQL and exfiltrate da...

CVE-2024-25510

RuvarOA v6.01 and v12.01 are affected by an SQL injection in the id parameter of /AddressBook/address_public_show.aspx. The root cause is lack of validation for external SQL statements, enabling attackers to execute arbitrary SQL and potentially steal sensitive data. Public sources (CNVD, CNNVD, ...

CVE-2024-25513

CVE-2024-25513 affects RuvarOA v6.01 and v12.01, with a SQL injection vulnerability exploitable through the file_id parameter of /CorporateCulture/kaizen_download.aspx. The issue arises from lack of input validation on external SQL input, enabling an attacker to execute arbitrary SQL commands and...

CVE-2024-25531

CVE-2024-25531 affects RuvarOA v6.01 and v12.01, with a SQL injection vulnerability exploitable via the PageID parameter in /WebUtility/SearchCondiction.aspx. Root cause: lack of input validation on PageID allows external SQL input to be executed. Impacts include potential unauthorized access to ...

CVE-2024-25517

RuvarOA v6.01 and v12.01 expose a SQL injection vulnerability in the tbTable parameter of /WebUtility/MF.aspx. Root cause: lack of input validation for externally entered SQL statements. Impact per sources: potential unauthorized data access/alteration with high severity. Exploitation details are...

CVE-2024-25511

CVE-2024-25511 affects RuvarOA v6.01 and v12.01, where an SQL injection can be triggered via the id parameter in /AddressBook/address_public_new.aspx. The underlying issue is lack of validation of external SQL statements, enabling attackers to execute arbitrary SQL commands and potentially access...

CVE-2024-25530

RuvarOA v6.01 and v12.01 are affected by a SQL injection in the PageID parameter of /WebUtility/get_find_condiction.aspx due to unvalidated SQL statements. Root cause: lack of validation in PageID handling. Impact: high risk of unauthorized database access and data exposure (CVSS v3.1 base score ...

CVE-2024-25508

RuvarOA is affected in v6.01–v12.01 by a SQL injection via the id parameter in the bulletin_template_show.aspx endpoint. Root cause: lack of input validation on id leading to arbitrary SQL execution that can read/modify data. References from multiple sources confirm the vulnerable versions and th...

CVE-2024-25518

RuvarOA v6.01 and v12.01 expose a SQL injection via the template_id parameter on /WorkFlow/wf_get_fields_approve.aspx. Root cause: lack of validation for template_id input, enabling arbitrary SQL execution and potential data disclosure as described across CVE-2024-25518 and related feeds. Documen...

CVE-2024-25532

CVE-2024-25532 affects RuvarOA v6.01 and v12.01. The vulnerability is a SQL injection via the bt_id parameter in /include/get_dict.aspx, as described across multiple sources (NVD/Red Hat/CVE listings). The initial data indicates a CVSS v3.1 base score of 9.8 (CRITICAL) with network access, no aut...

CVE-2024-25509

CVE-2024-25509 affects RuvarOA v6.01 and v12.01, where a SQL injection exists via the sys_file_storage_id parameter in the /WorkFlow/wf_file_download.aspx endpoint. Root cause appears to be lack of input validation for that parameter, enabling SQL statements to be interpreted by the database. Imp...

CVE-2024-25528

CVE-2024-25528 affects RuvarOA v6.01 and v12.01. A SQL injection vulnerability exists via the id parameter at the endpoint /PersonalAffair/worklog_template_show.aspx (also described as related to the /worklog template show.aspx path in several reports). Root cause: improper handling of user-suppl...