Soplanning: >> Soplanning >> 1.12 Security Vulnerabilities
SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter.
CVSS Score
8.8
EPSS Score
0.003
Published
2020-01-09
Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in Simple Online Planning (SOPPlanning)before 1.33.
CVSS Score
9.8
EPSS Score
0.487
Published
2020-01-07
Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb_mois and mb_ligness and the debug GET parameter to export.php, which allows malicious users to execute arbitrary code.
CVSS Score
5.4
EPSS Score
0.006
Published
2020-01-06
Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which allows remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash.
CVSS Score
7.5
EPSS Score
0.36
Published
2017-08-31
Directory traversal vulnerability in the file_get_contents function in SOPlanning 1.32 and earlier allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) in a URL path parameter.
CVSS Score
5.3
EPSS Score
0.847
Published
2017-08-31
The installation process for SOPlanning 1.32 and earlier allows remote authenticated users with a prepared database, and access to an existing database with a crafted name, or permissions to create arbitrary databases, or if PHP before 5.2 is being used, the configuration database is down, and smarty/templates_c is not writable to execute arbitrary php code via a crafted database name.
CVSS Score
5.3
EPSS Score
0.03
Published
2017-08-31
Page 2