Veille CVE

Recherche « SOPlanning »

10 CVE

Critique 0 Élevée 3 Moyenne 7 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « SOPlanning » ✕
  1. CVE-2026-50644 8.6 Élevée

    SOPlanning

    SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL commands into the audit configuration form which is then saved. The execution is triggered when the audit functionality is accessed (by the attacker or another user). This issue was fixed in version 1.56.01.

  2. CVE-2026-40549 5.1 Moyenne

    SOPlanning

    SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged GET or POST request to the application. This issue affects SOPlanning version 1.55 and below.

  3. CVE-2026-40548 6.4 Moyenne

    SOPlanning

    SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a legitimate user.csv file alongside a malicious file, which is extracted on the server. When combined with CVE-2026-40547 (Path Traversal), the malicious file (e.g., a PHP script) can be placed in a web-accessible location and executed via the browser. This issue affects SOPlanning version 1.55 and below.

  4. CVE-2026-40547 6.4 Moyenne

    SOPlanning

    SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vulnerable endpoint and construct payloads that allow reading and executing files previously added through the backup functionality. Critically, due to CVE-2026-40543 (Missing Authorization), any backup file can be read by any (unauthorized) user. This issue affects SOPlanning version 1.55 and below.

  5. CVE-2026-40546 8.7 Élevée

    SOPlanning

    SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially gaining full control over the database. This issue affects SOPlanning version 1.55 and below.

  6. CVE-2026-40545 5.1 Moyenne

    SOPlanning

    SOPlanning is vulnerable to Reflected XSS via the taches parameter. An attacker can craft a malicious URL which, when opened by authenticated victim, results in arbitrary JavaScript execution in the victim’s browser. This issue affects SOPlanning version 1.55 and below.

  7. CVE-2026-40544 5.1 Moyenne

    SOPlanning

    SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the victim’s browser when a user clicks the Edit button for the malicious backup. This issue affects SOPlanning version 1.55 and below.

  8. CVE-2026-40543 8.8 Élevée

    SOPlanning

    SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file, which includes additional sensitive information. This issue affects SOPlanning version 1.55 and below.

  9. CVE-2024-33724 5.4 Moyenne

    SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.

  10. CVE-2024-33722 6.3 Moyenne

    SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[].