CVE-2017-17695

The CVE concerns Techno - Portfolio Management Panel with a SQL Injection vulnerability in the panel/search.php s parameter (affecting versions up to 2017-11-16). The CNVD entry explicitly describes a remote attacker manipulating the s parameter to execute SQL commands and potentially disclose da...

CVE-2017-17693

Techno - Portfolio Management Panel (through 2017-11-16) has an access control vulnerability in panel/portfolio.php?action=delete that fails to verify authorization, enabling an attacker to remove feedback. Multiple sources (CNVD-2017-38468, NVD entry CVE-2017-17693) corroborate the flaw and its ...

CVE-2017-17696

Techno - Portfolio Management Panel is affected by an information disclosure vulnerability through an invalid s parameter to panel/search.php, enabling disclosure of sensitive paths. The CVE notes impact as a path disclosure; affected versions include 2017-11-16 and earlier. Connected sources (CN...

CVE-2017-17694

Techno – Portfolio Management Panel (up to 2017-11-16) is affected by a Cross‑Site Scripting flaw exploited via the panel/search.php?s parameter. The vulnerability allows injection of arbitrary web script/HTML, potentially leaking cookies (as indicated by CNVD) and other user data. Affected compo...

CVE-2017-17110

Techno Portfolio Management Panel 1.0 is affected by an SQL injection in the parameter 'id' of the single.php endpoint. The CNVD entry describes a SQL injection vulnerability that lets an attacker inject arbitrary SQL commands via single.php?id=, enabling data access/manipulation. The issue is co...