Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2865▼ 160 respecto a la semana anterior
Críticas / altas1384▲ 52 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior
Sin puntuar (sin CVSS)266▼ 260 respecto a la semana anterior
10 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Media (6.1) | 1.1% | — | Auieo Candidats | 3/11/2022 | 17/6/2026 | CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks. | |
| Modificada | Media (6.1) | 1.1% | — | Auieo Candidats | 3/11/2022 | 17/6/2026 | CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks. | |
| Modificada | Media (6.1) | 1.1% | — | Auieo Candidats | 3/11/2022 | 17/6/2026 | CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks. | |
| Modificada | Media (6.1) | 1.2% | — | Auieo Candidats | 3/11/2022 | 17/6/2026 | CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks. | |
| Modificada | Alta (7.5) | 0.86% | — | Auieosoftware Candidats | 3/11/2022 | 17/6/2026 | CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE. | |
| Modificada | Crítica (9.8) | 1.3% | — | Auieo Candidats | 3/11/2022 | 17/6/2026 | CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks. | |
| Modificada | Alta (8.8) | 0.45% | — | Auieo Candidats | 3/11/2022 | 17/6/2026 | CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions. | |
| Modificada | Alta (8.8) | 1.0% | — | Auieo Candidats | 3/11/2022 | 17/6/2026 | CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user. | |
| Modificada | Media (6.5) | 0.99% | — | Auieo Candidats | 18/8/2022 | 17/6/2026 | CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=candidates&a=show' via the 'candidateID', in '/index.php?m=joborders&a=show' via the 'jobOrderID' and '/index.php?m=companies&a=show' via the 'companyID'… | |
| Modificada | Alta (8.8) | 0.60% | — | Auieo Candidats | 22/2/2020 | 17/6/2026 | CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings&a=addUser URI. |