TI-2024-19644 CVE-2024-29875 · GHSA-44mc-ggjv-3xj6
SQL injection in Sentrifugo
Priority MEDIUM 50
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/exportactiveuserrpt, 'sort_name' parameter.
Sapplica
Records18All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high8CVSS 7.0–8.9
Exploited now
Sapplica records in CISA KEVNo Sapplica vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
18 records
TI-2024-19643 CVE-2024-29874 · GHSA-3525-gmp6-g5m5
SQL injection in Sentrifugo
Priority MEDIUM 50
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/activeuserrptpdf, 'sort_name' parameter.
TI-2024-19642 CVE-2024-29873 · GHSA-cxq6-hcg5-hcjv
SQL injection in Sentrifugo
Priority MEDIUM 50
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/businessunits/format/html, 'bunitname' parameter.
TI-2024-19641 CVE-2024-29872 · GHSA-mgmq-g3mf-5h3g
SQL injection in Sentrifugo
Priority MEDIUM 50
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/empscreening/add, 'agencyids' parameter.
TI-2024-19640 CVE-2024-29871 · GHSA-j67q-hvmw-6m2r
SQL injection in Sentrifugo
Priority MEDIUM 50
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/sentrifugo/index.php/index/updatecontactnumber, 'id' parameter.
TI-2024-19645 CVE-2024-29876 · GHSA-qqp2-2gr9-622w
SQL injection in Sentrifugo
Priority MEDIUM 44
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/activitylogreport, 'sortby' parameter.
TI-2024-19639 CVE-2024-29870 · GHSA-j95q-fjjg-wf7f
SQL injection in Sentrifugo
Priority MEDIUM 44
SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter./sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter.
TI-2018-11316 CVE-2018-15873 · GHSA-2wx7-cf6v-q9v8
A SQL Injection issue was discovered in Sentrifugo 3.2 via the deptid parameter.
Priority MEDIUM 44
A SQL Injection issue was discovered in Sentrifugo 3.2 via the deptid parameter.
TI-2020-16271 CVE-2020-26804 · GHSA-6jgh-69hg-fvcw
In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements"…
Priority MEDIUM 41
In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab.
TI-2020-16270 CVE-2020-26803 · GHSA-mrj6-v8w9-4v5f
In Sentrifugo 3.2, users can upload an image under "Assets -> Add" tab.
Priority MEDIUM 41
In Sentrifugo 3.2, users can upload an image under "Assets -> Add" tab.
TI-2023-14012 CVE-2023-29770 · GHSA-rhm3-5ppf-x22h
In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an…
Priority MEDIUM 40
In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated attacker to upload any file without extension filtering.
TI-2019-12068 CVE-2019-16059 · GHSA-7774-4928-rfp7
Sentrifugo 3.2 lacks CSRF protection.
Priority LOW 39
Sentrifugo 3.2 lacks CSRF protection.
TI-2020-16272 CVE-2020-26805 · GHSA-p6rg-53wx-7278
In Sentrifugo 3.2, admin can edit employee's informations via this endpoint -->…
Priority LOW 35
In Sentrifugo 3.2, admin can edit employee's informations via this endpoint --> /sentrifugo/index.php/empadditionaldetails/edit/userid/2.
TI-2024-19648 CVE-2024-29879 · GHSA-6qxg-84xw-6m8w
Cross-site scripting in Sentrifugo
Priority LOW 32
Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter.
TI-2024-19647 CVE-2024-29878 · GHSA-2vwx-x49m-q6hr
Cross-site scripting in Sentrifugo
Priority LOW 32
Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/sitepreference/add, 'description' parameter.
TI-2024-19646 CVE-2024-29877 · GHSA-f64p-xgr6-r5f4
Cross-site scripting in Sentrifugo
Priority LOW 32
Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/expenses/expensecategories/edit, 'expense_category_name' parameter.
TI-2020-08232 CVE-2020-10218 · GHSA-rvc2-pw96-7pj9
A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the…
Priority LOW 31
A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the index.php/holidaygroups/add id parameter because of the HolidaydatesController.php addAction function.
TI-2020-17203 CVE-2020-28365 · GHSA-x8gm-jvwx-xhv6
Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS) vulnerability by inserting a…
Priority LOW 28
Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS) vulnerability by inserting a payload within the X-Forwarded-For HTTP header during the login process.