Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas3007▼ 67 respecto a la semana anterior

Críticas / altas1403▲ 50 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior

Sin puntuar (sin CVSS)390▼ 120 respecto a la semana anterior

12 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-67102	Analizada	Alta (7.6)	0.23%	—	Jorani	17/2/2026	17/6/2026	A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL commands via the entity parameter.
CVE-2023-53870	Aplazada	Media (5.1)	0.36%	—	Jorani^AI	15/12/2025	17/6/2026	Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts. Attackers can craft XSS payloads in the language parameter to execute arbitrary JavaScript and potentially steal user session information.
CVE-2023-48205	Modificada	Media (5.3)	0.76%	—	Jorani Leave Management System	7/12/2023	17/6/2026	Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails.
CVE-2023-45540	Modificada	Media (6.5)	0.52%	—	Jorani Leave Management System	16/10/2023	17/6/2026	An issue in Jorani Leave Management System 1.0.3 allows a remote attacker to execute arbitrary HTML code via a crafted script to the comment field of the List of Leave requests page.
CVE-2023-2681	Modificada	Alta (8.8)	0.78%	—	Jorani	3/10/2023	17/6/2026	An SQL Injection vulnerability has been found on Jorani version 1.0.0. This vulnerability allows an authenticated remote user, with low privileges, to send queries with malicious SQL code on the "/leaves/validate" path and the “id” parameter, managing to extract arbritary information from the database.
CVE-2023-26469	Modificada	Crítica (9.8)	83%	—	Jorani	17/8/2023	17/6/2026	In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.
CVE-2022-48118	Modificada	Media (6.1)	0.47%	—	Jorani	27/1/2023	17/6/2026	Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.
CVE-2022-34134	Analizada	Alta (8.8)	0.43%	—	Jorani	28/6/2022	17/6/2026	Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/controllers/Users.php.
CVE-2022-34133	Analizada	Media (6.1)	0.58%	—	Jorani	28/6/2022	17/6/2026	Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at application/controllers/Leaves.php.
CVE-2022-34132	Analizada	Crítica (9.8)	1.6%	—	Jorani	28/6/2022	17/6/2026	Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php.
CVE-2018-15918	Modificada	Media (5.4)	2.9%	—	Jorani Project Jorani	5/9/2018	17/6/2026	An issue was discovered in Jorani 0.6.5. SQL Injection (error-based) allows a user of the application without permissions to read and modify sensitive information from the database used by the application via the startdate or enddate parameter to leaves/validate.
CVE-2018-15917	Modificada	Media (5.4)	5.9%	—	Jorani Project Jorani	5/9/2018	17/6/2026	Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language.