27 matches found
CVE-2021-43481
CVE-2021-43481 affects Webtareas up to version 2.4p3, with an SQL Injection vulnerability exploitable via the POST parameter “$uq” in editapprovalstage.php. The issue stems from inadequate input filtering in that endpoint, enabling attackers to perform SQL injection. Public reports and exploits d...
CVE-2022-44290
WebTareas 2.4p5 contains a SQL injection in deleteapprovalstages.php via the id parameter. Nuclei details describe an authenticated time-based blind SQL injection that can extract sensitive data (tasks, user credentials, projects). CVSS v3.1 base score 9.8 (CRITICAL). Remediation guidance: upgrad...
CVE-2022-44291
WebTareas 2.4p5 contains a SQL injection vulnerability exposed via the id parameter in phasesets.php. The Nuclei template and multiple sources describe an SQL injection that could enable time-based extraction of data (e.g., project phases, task data, user credentials) without authentication. Root...
CVE-2022-44957
WebTareas 2.4p5 contains a Cross-Site Scripting (XSS) vulnerability in the /clients/listclients.php component. The issue allows an attacker to inject arbitrary script or HTML via the Name field, potentially affecting authenticated WebTareas users and enabling script execution. Root cause: insuffi...
CVE-2021-36608
CVE-2021-36608 corresponds to a Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1. The issue is triggered via the Name field in /projects/editproject.php. The connected records confirm the affected product/version and the vulnerable parameter, but do not provide details about the underl...
CVE-2021-36609
CVE-2021-36609 describes a Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1, exploitable via the Name field in /linkedcontent/editfolder.php. The issue is triggered by user-supplied input passed to this parameter, enabling script execution in a victim’s browser. Affected product: webTa...
CVE-2022-44955
CVE-2022-44955 affects webtareas version 2.4p5, where a cross-site scripting (XSS) vulnerability exists in the Chat function. The vulnerability allows an attacker to inject a crafted payload into the Messages field to execute arbitrary web scripts or HTML. Documented impact is limited to the abil...
CVE-2022-44960
CVE-2022-44960 affects webtareas v2.4p5, where an XSS flaw exists in the /general/search.php?searchtype=simple component. A crafted payload in the Search field can trigger arbitrary web scripts/HTML in the user’s browser. The evidence consistently points to a client-side script injection vulnerab...
CVE-2022-44954
CVE-2022-44954 affects webtareas version 2.4p5, with a cross-site scripting (XSS) vulnerability in the /contacts/listcontacts.php component. The issue arises when a crafted payload is injected into the Last Name field after clicking “Add,” allowing execution of arbitrary scripts. The available do...
CVE-2021-41917
CVE-2021-41917 concerns webTareas
CVE-2021-41920
Summary: The provided documents confirm a SQL Injection vulnerability in webTareas 2.4 and earlier. Affected component: webTareas web application; endpoint /includes/library.php. Root cause / exploit path: unauthenticated user can perform time and boolean-based blind SQL injection via POST parame...
CVE-2021-41919
The CVE-2021-41919 entry affects webTareas 2.4 and earlier. The vulnerability stems from an upload vulnerability in the /includes/upload.php endpoint, where an authenticated user can upload or replace files, enabling potential code or malware injection and, under certain conditions, code executio...
CVE-2022-44962
CVE-2022-44962 corresponds to a cross-site scripting (XSS) vulnerability in webtareas version 2.4p5, located in the /calendar/viewcalendar.php component. The issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Subject field, which could affect u...
CVE-2020-14973
The CVE-2020-14973 entry affects webTareas 2.0p8, specifically the loginForm in general/login.php. It is a reflected Cross-Site Scripting (XSS) vulnerability via the query string. The impact is limited to client-side code execution in a comparison to the vulnerable context; exploitation details a...
CVE-2022-44961
CVE-2022-44961 affects webtareas 2.4p5. A cross-site scripting (XSS) vulnerability exists in the component /forums/editforum.php, allowing an attacker to inject crafted payloads into the Name field to execute arbitrary web scripts/HTML in a victim’s browser. Connected sources confirm the affected...
CVE-2022-44953
CVE-2022-44953 affects webtareas 2.4p5, with a cross-site scripting (XSS) vulnerability in the /linkedcontent/listfiles.php component. The issue allows an attacker to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name field after clicking “Add.” The CVSS vector ind...
CVE-2022-44959
CVE-2022-44959 affects webtareas 2.4p5, with a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php. A crafted payload injected into the Name field can cause arbitrary web scripts/HTML to run in a user’s browser, enabling client-side code execution. Several connect...
CVE-2020-25734
The CVE-2020-25734 entries in connected records indicate that webTareas up to version 2.1 exposes a directory listing vulnerability on the Default/ path via the web interface. The core detail consistently cited is that this enables listing of files under Default/, implying a potential information...
CVE-2020-23660
The candidate CVE CVE-2020-23660 affects webTareas v2.1 and is described as Cross Site Scripting (XSS) on the Search functionality. Connected sources (NVD, Red Hat, Red Hat PRION mirrors, CVE lists) consistently describe webTareas v2.1 XSS but do not provide additional technical details such as r...
CVE-2020-25735
WebTareas v2.1 and earlier versions are affected by cross-site scripting (XSS) in multiple PHP endpoints: clients/editclient.php, extensions/addextension.php, administration/add_announcement.php, administration/departments.php, administration/locations.php, expenses/claim_type.php, projects/editp...
CVE-2022-44956
CVE-2022-44956 affects webtareas 2.4p5, with an XSS in /projects/listprojects.php. The Name field accepts crafted input enabling arbitrary web script/HTML execution. Root cause is input handling in that component; impact is client-side script execution. Mitigations referenced in connected documen...
CVE-2020-23069
CVE-2020-23069 affects webTareas 2.0 through a path traversal flaw in the extpath parameter of general_serv.php, enabling a malicious user to read arbitrary files. The issue is documented across multiple sources (NVD/CNVD and regional advisories) and is framed as a path traversal vulnerability in...
CVE-2021-41916
CVE-2021-41916 describes a CSRF vulnerability in webTareas up to version 2.4 where an attacker can create a new administrative profile and add a user without the victim’s knowledge by enticing an authenticated admin to visit a crafted page. This is driven by cross-site request forgery on authenti...
CVE-2020-25733
The connected sources confirm a vulnerability in webTareas version 2.1 where the application allows uploading of executables (.exe) and server-side script files (.shtml). This indicates insufficient validation of uploaded file types, potentially enabling attackers to place executable or script co...
CVE-2023-53971
WebTareas 2.4 has an authenticated remote code execution vulnerability in the chat photo upload feature. An authenticated user can upload a PHP file to /files/Messages/ and execute it via the generated file path, as described across multiple sources. Impact is described as high (CVSS 3.1: High, 8...
CVE-2023-53972
WebTareas 2.4 exposes an unauthenticated SQL injection via the webTareasSID cookie parameter. Multiple connected sources confirm the issue and describe exploitation through error-based and time-based blind techniques to extract data and access sensitive information. The PT-2025-52709 entry notes ...