Read the docs

Auieo

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

Auieo records in CISA KEV

No Auieo vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Candidats 9 records HIGH

Records

9 records

TI-2022-20762 CVE-2022-42744 · GHSA-942w-mcgr-2rjq

SQL injection in CandidATS

Priority HIGH 82

CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01565 Published 2022-11-03 No fix listed CWE-89
TI-2022-20769 CVE-2022-42751 · GHSA-3fq7-mmjq-fv4x

Cross-site request forgery in CandidATS

Priority HIGH 73

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00538 Published 2022-11-03 No fix listed CWE-352
TI-2022-20768 CVE-2022-42750 · GHSA-6jrf-5qcg-qcqx

Cross-site scripting in CandidATS

Priority HIGH 73

CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01235 Published 2022-11-03 No fix listed CWE-79
TI-2022-20767 CVE-2022-42749 · GHSA-8v8c-wrxg-38v2

Cross-site scripting in CandidATS

Priority MEDIUM 60

CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0133 Published 2022-11-03 No fix listed CWE-79
TI-2022-20766 CVE-2022-42748 · GHSA-5587-9qwv-rggc

Cross-site scripting in CandidATS

Priority MEDIUM 60

CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0133 Published 2022-11-03 No fix listed CWE-79
TI-2022-20765 CVE-2022-42747 · GHSA-crwf-v7hm-2cqq

Cross-site scripting in CandidATS

Priority MEDIUM 60

CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0133 Published 2022-11-03 No fix listed CWE-79
TI-2022-20764 CVE-2022-42746 · GHSA-xhh6-6v9x-7wmr

Cross-site scripting in CandidATS

Priority MEDIUM 60

CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01387 Published 2022-11-03 No fix listed CWE-79
TI-2022-08941 CVE-2022-25228 · GHSA-6q7g-6gr4-vqh8

SQL injection in CandidATS

Priority LOW 31

CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=candidates&a=show' via the 'candidateID', in '/index.php?m=jo…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01045 Published 2022-08-18 No fix listed CWE-89
Open these records in search →