CVE-2019-19858

Serpico (SimplE RePort wrIting and CollaboratiOn tool) 1.3.0 contains a stored XSS vulnerability in the admin/add_user/UID path via the author parameter. The issue is documented across multiple sources (NVD, OSV, CVE records) with the root cause described as lack of proper validation on client-si...

CVE-2019-19854

CVE-2019-19854 affects Serpico (SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The issue is CSRF protection failure: the app does not use CSRF tokens and relies on the Origin header to validate requests. This weakness is stated to enable privilege escalation from User to Administrator when ...

CVE-2019-19856

CVE-2019-19856 affects Serpico (SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The vulnerability is a stored cross-site scripting (XSS) flaw in the admin/list_user page, exploitable via the type parameter. The issue is supported by multiple connected sources describing Serpico’s admin/User ...

CVE-2019-19859

The CVE-2019-19859 entry concerns Serpico (SimplE RePort wrIting and CollaboratiOn tool) version 1.3.0. The vulnerability is described as an input validation error in the Add Collaborator feature, where the author parameter allows unlimited data to be submitted even if it does not match existing ...

CVE-2019-19857

Affected product: Serpico 1.3.0 (SimplE RePort wrIting and CollaboratiOn tool). Vulnerability: Admin can change their password without providing the current password via interfaces outside the Change Password screen. This bypasses the Old Password check and is noted to be problematic in conjuncti...

CVE-2019-19855

CVE-2019-19855 affects Serpico (SimplE RePort wrIting and CollaboratiOn tool) v1.3.0. The vulnerability is a stored XSS in admin/list_user exploitable via the auth_type parameter. This is due to improper input handling in that endpoint, enabling script execution in a victim’s browser when the aff...

CVE-2020-12687

CVE-2020-12687 affects Serpico prior to 1.3.3. The /admin/attacments_backup endpoint may be accessed by non-admin authenticated users, allowing retrieval of all user attachments (including administrator data). Red Hat, CNVD, OSV, and other sources corroborate this information. A fix is available ...