Auieo
Auieo Candidats: vulnerabilidades y CVE
Auieo Candidats tiene 9 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE9
Últimos 12 meses0
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2022-42749 | Media (6.1) | 1.1% | — | 3 nov 2022 | CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user… |
| CVE-2022-42748 | Media (6.1) | 1.1% | — | 3 nov 2022 | CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate… |
| CVE-2022-42747 | Media (6.1) | 1.1% | — | 3 nov 2022 | CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user… |
| CVE-2022-42746 | Media (6.1) | 1.2% | — | 3 nov 2022 | CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user… |
| CVE-2022-42744 | Crítica (9.8) | 1.3% | — | 3 nov 2022 | CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi… |
| CVE-2022-42751 | Alta (8.8) | 0.45% | — | 3 nov 2022 | CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account… |
| CVE-2022-42750 | Alta (8.8) | 1.0% | — | 3 nov 2022 | CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user. |
| CVE-2022-25228 | Media (6.5) | 0.99% | — | 18 ago 2022 | CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=candidates&a=show' via the 'candidateID', in… |
| CVE-2020-9341 | Alta (8.8) | 0.60% | — | 22 feb 2020 | CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings&a=addUser URI. |