CVE-2019-13489

Trape (up to 2019-05-08) contains an SQL injection in the data[2] variable handled by core/db.py, allowing potentially arbitrary SQL execution. The root cause cited (CNVD) is lack of validation of externally entered SQL statements in database-based applications. No remediation details are provide...

CVE-2019-13488

CVE-2019-13488 affects Trape up to 2019-05-08, with an XSS in static/js/trape.js. The vulnerability allows remote injection of script/HTML via the country, query, or refer parameters to the /register URI because the jQuery prepend() method is used without proper sanitization. Affected component/f...